How to Stay Compliant With Mobile

Our panelists agreed that the biggest risk impact of this sudden change depends on how well prepared the firm was prior to the event. Some firms have struggled with the use of personal mobile devices for business, as they had not yet issued policy guidelines or implemented control mechanisms on all devices. Others had noted the challenge of employees who had downloaded freeware or other unauthorized apps onto their devices, such as Signal, Marco Polo, House Party or Discord.

They also agreed, however, that the greatest concern surrounding mobility for firms large and small, prepared and unprepared, is the opening of potential cybersecurity exposures due to out-of-date security patches, the use of unsafe apps, and the recent rise in phishing, credential stealing, ransomware, and other advanced security risks. They emphasized security exposures, but also noted concerns over:

• Discovery/compliance risk: created by the challenge of collecting and reviewing non-email content, such as persistent chats
• Application risk: caused by the use of downloadable applications that lack reliable means of accessing historical data, as well as the use of easily accessible "freeware" versions of enterprise apps that lack important features or controls
• IP leaks and internal policy risks: stemming from the lack of controls to guard against the misuse of information assets on new communications platforms. Also cause for concern is the challenge of spotting workplace infractions such as harassment now that they are happening in the virtual world
• Privacy risks: there is no discussion of mobility without referencing data privacy requirements such as the California Consumer Privacy Act (CCPA), and the need for firms to maintain full transparency on how they are using personal information

Sean highlighted the risks associated with increased data volume, referring to the 3x increase in the length of the calls and volume of text messages. This generates greater compliance burden and risk if these sources are not captured and preserved in a compliant way.

Brandon added that this also impacts discovery & investigative burden dramatically, as targeted sources are now whatever your clients and your colleagues are using. He noted, “I work with some teams that I've communicated with using text, using chat, using in-meeting chat phone calls just with a single exchange. When you add encryption, employees think they're doing the right thing by using a secure or encrypted channel.  But, from a forensics perspective, you may or may not be able to get that information if it's needed for regulatory or compliance reasons.”