Customer Service Meets Infosec

Computerworld - At issue: Users want to sync data to handhelds, removing it from the protected network.

Action plan: Find a way to say yes, despite security concerns.

Once again, users demands for mobility have come crashing up against my commitment to the best security possible. Some users want to synchronize their data with their Palm Treos. Looked at from the viewpoint of productivity, its a no-brainer to say yes. But as the person responsible for keeping data from straying too far from home, my knee-jerk reaction is to say no, no, no. Our policy is to keep confidential and protected information on the protected network.

The justification for this policy should be clear to anyone who follows the news about data breaches. Laptops and other mobile devices have accounted for countless breaches at this point. I want to keep my state agency off the front page. And unlike a retailer, were dealing with data that is governed by HIPAA. Its my job to protect all of that information and avoid having to report to the feds and face a possible fine. So far, no breaches. But I am becoming known as the mobility Nazi.

I dont mind the label as much as my inner conflict when security concerns keep me from approving things that will boost productivity. My users might not believe this, but Id like to make their lives easier. They have it hard enough operating within the confines of a bureaucratic organization.

In fact, I believe that all departments must have a customer service orientation, regardless of whether their customers are external or internal. As the head of security, I have to balance our need to protect data with our users need to work efficiently. After all, if a business cant do its job, security could be beside the point. The business could go under. True, a state agency isnt going to go bankrupt, but there are still good reasons to be more productive. Im a state employee, but Im also a taxpayer, and I like knowing that the government is trying to be more efficient. As a taxpayer, I want the cost savings that entails and a smooth, hassle-free experience when I have to get something done.

Smart Security

The trick is to do smart security. If data needs to go mobile, so be it. I will do everything in my power to provide the absolute best security that technology can provide. And that costs taxpayers money. As you would in any business, you have to calculate the return on investment and proceed accordingly.