Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

11/20/2019
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Employee Privacy in a Mobile Workplace

Why businesses need guidelines for managing their employees' personal information -- without compromising on security.

Consumer privacy has long been the focal point of controversies regarding how companies handle personal data. While this is clearly an important matter, it has kept the spotlight off of another important issue: the way businesses handle the personal data of their own people.

Consumer privacy is typically associated with the way companies use personal data to make a profit. But employee data is used by companies to monitor for things such as security threats, risky online behavior, and productivity drains. Because monitoring for these types of issues is essential for any business, it's easy to see how some companies might justify higher levels of employee surveillance. 

The US Electronics Communications Privacy Act (ECPA), enacted in 1986, prohibits companies from carrying out certain privacy infringements, such as monitoring their employees' personal phone calls without consent. Even if the federal government were to conduct an overhaul to employee privacy legislation, it would be extremely complex and probably become antiquated shortly after its enactment — given the rate at which technology advances.

Employee privacy is a difficult subject. And for today's increasingly mobile workplace, it's becoming even more difficult.

When Smartphones Are Put to Work
It wasn't too long ago that monitoring people through their phones was synonymous with wiretapping. And it also wasn't too long ago that a company-issued desktop computer or laptop was the primary or only computer one would use in the workplace.

Today, mobile Internet traffic eclipses desktop/laptop traffic, accounting for 52% of combined traffic worldwide, according to a September 2019 report from Statista.

When cellular phones first transformed into handheld computers, the way companies distributed them to employees generally followed the way any other work equipment was distributed. And while the intent may have been for company-issued smartphones to be looked at by employees the same way company-issued desktops or laptops are typically considered — as company property for company purposes — there's a much greater mix of personal and business use on smartphones compared with desktops/laptops. According to our research, 50% of all corporate data usage on mobile devices is not business critical.

Given this degree of personal and business activity on the same device, businesses are constantly adapting the ways they approach mobility, and employee privacy is becoming a major factor in this ongoing process.

The method of ownership for mobile devices used by employees has expanded beyond the traditional corporate owned, business only (COBO) model to include bring your own device (BYOD) and company owned, personally enabled (COPE) models. Today, many businesses use mixed combinations of these ownership models across individual employees and departments.

BYOD has been widely adopted in recent years and, on the surface, it makes a lot of sense. As of 2018, 81% of Americans owned a smartphone, according to Pew Research Center. Why spend money on a new phones for employees when they probably already have their own? Why not just offer a fixed stipend to compensate them for work-related activity conducted on their devices? It's like the difference between providing a company car and reimbursing an employee for gas expenses.

There are obvious privacy ramifications of monitoring what a person does on his or her personal device, even if there are reasonable grounds from a security perspective when it comes to business data and applications. An organization has a strong basis for seeing what their employees do with files stored in their corporate Dropbox account, for example, but should it also be able to see their employees' private messages, social media activity, and photos?

Regardless of whether an employee is using a corporate-issued device or their own device for work, there is bound to be some crossover between personal and business data. And when businesses collect and monitor employee data, how can they approach this crossover in a responsible way that does not infringe on personal privacy or compromise any security measures?

Employee Privacy Framework
To find the right balance, organizations can utilize a framework made up of four pillars to inform the way they handle their employees' personal information as they establish privacy policies, develop their internal infrastructures, and implement new products.

These pillars are: User Identity, User Activity, Policy, and Transparency.

Under each pillar are best practices for how organizations should collect, store, and use their employees' personal information. These best practices can account for many gray areas that currently make it difficult for certain security processes to be conducted without infringing on employees' personal privacy.

Source: Wandera
Source: Wandera

 

For example, in monitoring network activity, a company needs to understand who is accessing corporate resources and from what devices, as well as determine "normal" parameters so that anything unusual can be detected and flagged for inspection. However, in COPE and BYOD environments, what behaviors are OK for businesses to monitor?

By applying the principle of data minimization, organizations can limit the amount of information collected to only what is needed for the intended purpose. This could mean that user information would only be collected on the work profile of a device, or only when corporate applications are in use. It could also mean that location data is not continuously tracked or that the access of personal applications (such as social media, messaging, photos, etc.) is not monitored.

Taking this approach of only collecting the most necessary data, when it's necessary, should help organizations approach their employees' personal information in a more responsible manner, helping them establish better trust with their people as they keep the business secure.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How Medical Device Vendors Hold Healthcare Security for Ransom."

Michael J. Covington, Ph.D., is a seasoned technologist and the Vice President of Product Strategy for Wandera, a leading provider of mobile security. Michael is a hands-on innovator with broad experience across the entire product life cycle, from planning and R&D to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19642
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
CVE-2019-19637
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19638
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
CVE-2019-19635
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19636
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.