Security Versus Privacy in Today’s Enterprise

By Rachel Holdgrafer, Business Content Strategist, Code42

Whether enterprise security or personal data privacy should prevail in the enterprise is the debate of the century. With internal actors responsible for 43 percent of enterprise data loss and 62 percent of respondents to the2016 Cyber Defense report indicating that a cyber attack is somewhat or very likely in the next year, today’s enterprise must have endpoint security in place to protects its data. Similarly, as the FBI demands that Apple build a backdoor into its iPhone iOS, personal data privacy is becoming even more critical.

Data is the exhaust of our digital lives—both personally and professionally. Protecting it is paramount for the enterprise and the individual. Terms of use, conditions of employment and IT policies protect the enterprise. Who—or what—protects the individual?

The simple smartphone

Bruce Schneier publishes extensively about how metadata—the context around a data point—is fundamentally “surveillance data,” tracking and recording relationships, associations, locations and search terms. Smartphones are not typically backed up by the enterprise and in an individual’s quest for personal data privacy, that’s a good thing. Smartphones should remain the individual’s outlet for conducting personal business. Here’s why:

Smartphones generate an enormous amount of data when they are turned on. Location services, GPS coordinates, phone calls, text messages, email, application usage, web searches—all create data streams that reveal a stunning amount about the human being carrying the phone. The graphic below examines four basic data streams created by the average smartphone and the deductions that can be made about you as a result.

Private and secure

It’s possible for individual privacy and data security to coexist in the enterprise, but both the enterprise and the end user must play a role to make it a reality.

End users must take an active part in protecting their digital privacy and recognize that the devices and networks—as well as the data being created on them—belong to the enterprise. With this in mind, employees must conduct less personal business on enterprise-owned machines and networks, utilizing their personal smartphone or laptop instead. When the use of corporate devices and networks cannot be avoided, end users should be aware that the files and the meta data associated with their actions are visible to IT.

Additionally, end users must take an active approach to current events and pending legislation that may impact personal privacy. They must take action when necessary to ensure personal privacy standards are maintained (e.g. pushing back to prevent implementation of backdoors in mobile devices and unregulated collection and use of personal data).

In turn, the enterprise must do its part to respect and maintain personal data privacy. Employees need to be educated. The enterprise must explicitly tell employees when and where personal data will be collected and where, if anywhere, on their networks employees can assume privacy. With clear policies in place, the enterprise must uphold those policies and alert employees to any changes in how personal data will be collected, indexed or used.