Technology & Innovation

Open corporation: Security

January 21, 2013

Global

January 21, 2013

Global
Our Editors

The Economist Intelligence Unit

_____________________

Security and the open corporation

For several years now, employees have been upending business-as-usual by bringing the new electronics, cloud services and social networks they love at home into the office. The invading technologies are numerous, powerful and always on, and their use is exasperatingly difficult for companies to control—a deeply unsettling combination for information security departments.

The arrival of consumer technologies in the workplace, a trend known as consumerisation, has been both a boon and a challenge to corporations. New mobile devices and web services have empowered and delighted employees, made them more productive and improved collaboration. And they have enhanced companies’ ability to reach and engage customers.

But while the benefits and business opportunities are clear, this trend is also forcing information technology departments to do some painful soul-searching. As a decentralising force that demands openness, consumerisation has undermined prevailingly centralised and closed corporate networks. Unsurprisingly, companies cite security concerns as the top impediment to their full embrace of today’s technologies.

But there’s no stopping progress. Consumerisation is not the only, or even the strongest, force undermining the old network-security paradigm, experts say. Wily and increasingly sophisticated attackers have made the fortification mentality obsolete by skilfully bypassing corporate networks’ hard outer shells and running frighteningly free through their soft interiors.

As a result, cutting-edge security departments are radically revising their approaches to security. For many, this means abandoning efforts to control every device and restrict every outside program an employee or business partner might try to introduce. It also means stepping up employee security training and putting more emphasis on protecting the data.

It is a wrenching psychological shift for security professionals. Historically, security was about control, lockdown and risk avoidance, says Jamil Farshchi, senior business leader of planning and initiatives at Visa and former information security chief at Los Alamos National Laboratory.

But that attitude now effectively puts a halt to business, he says. “We know that there are some risks here, but the challenge for us is to identify what those risks are and to articulate those risks, rather than just saying ‘no’ across the board.”

Security that says ‘yes’

Saying “no” is working less and less well. Top executives are demanding the freedom to use their iPads. Employees are simply using their devices without permission. And managers are grumbling that they will lose the tech-savvy young talent they want to firms that are more open.

Some companies are trying to say “yes” as often as possible. Nearly one-fifth of IT executives who responded to a spring 2011 survey by research firm IDC described their departments as “proactive” in their adoption of cloud, mobile and social technologies. Another 27% said their departments were becoming increasingly involved.

This proactive group stood out for its tendency to put technology at the centre of business strategy and operations and to reap real benefits from new technologies. This group also tended to focus more keenly on data protection and backup than the other firms surveyed.

New consumer technologies and emerging tools for managing them are untested and by their nature introduce new vulnerabilities. But if this new approach to security leads to a more open corporate mindset, the result could be better security, not worse.

Indeed, companies that embrace consumerisation are the ones lionised today as dynamic, fast-moving and flexible competitors that are cost-conscious and tech-savvy. “It has to do with the culture of a company,” says Lawrence Pingree, research director at Gartner, a research firm. “How open is the organisation to its users?”

Turmoil (such as a merger) can help companies join this camp, because it readies people for change, says Doug Neal, one of the researchers at the Leading Edge Forum at Computer Sciences Corp., who first coined the term consumerisation in 2004. New companies that are just starting to build their technology infrastructures can have an easier time, too.

Neal advocates an approach to security that lets employees use any device, including their own, and shrinks the firewall to leave those devices outside and surround and control only “the really secret stuff”. The tough thing here is properly classifying what is truly sensitive and what is not, and doing that at scale.

The approach requires treating employees like “adults, not children,” Neal says. That means not only educating them about security threats, but having them sign agreements that spell out appropriate use of technology and data and stiff consequences for transgressions, says Paul Dorey, a visiting professor at the University of London and former chief information security officer at BP, who promotes consumerisation-friendly security approaches.

Neal also advocates stepping up detection and reaction to security incidents. One company at the centre of the consumerisation trend is taking that to an extreme. The security team at Facebook, the social-networking giant, gives top priority to network monitoring and quick intrusion response. “For us, the news story is unauthorised access to Facebook, so we have to protect against unauthorised access,” says Michael Podobnik, Facebook’s manager of information security.

Facebook has built an unusual system that looks for red flags based on the steps hackers take during an attack—from reconnaissance to exploitation and removal of data—that Podobnik says is highly effective. It also tries to deter attackers by working aggressively to identify and track them down.

The approach lets Facebook minimise internal barriers—including around data—that might be speed bumps for its tech-savvy employees. “The lockdown mentality is actually a scary concept,” Podobnik says. “That illusion of control makes you sloppy,” he adds.

Holding onto control—or the illusion of it

Of course, there are still plenty of companies that prefer lockdown, even if it hurts business agility. Industries like defence, financial services and healthcare face stringent data-security regulations. “Even if they feel that they’re visionary, they’re concerned that the regulator won’t be or can’t be,” Dorey says.

Farshchi says regulators of financial firms are increasingly open to discussions about how to bring in consumer technologies safely. But in government and defence, regulators have pushed back hard, he says. A culture of risk aversion is the primary characteristic of firms in lockdown.

The majority of companies are likely pursuing a path somewhere in between openness and lockdown. They are giving employees the smartphones they want and leaning on mobile management technologies to keep them secure. They are using network firewalls to keep a lid on employee Web use. Though they aren’t upending their approach to security, they aren’t turning a blind eye to what is happening in their workplaces either, the experts agree.

“The biggest danger now is a ‘don’t ask, don’t tell’,” mentality, Neal says. And the biggest success factor—the key to lowering risk and preserving customer trust—might just be security.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week