Mobile devices herald security, cloud storage risks

IBM CIO Jeanette Horan initiated the policy because she's concerned that that the SaaS service could lead to the exposure of confidential corporate information, according to MIT's Technology Review magazine. (A survey by IBM of its employees found they were violating company rules by automatically forwarding internal e-mail to public Web mail services and using their smartphones as open Wi-Fi hotspots, opening corporate data to outside purview.)

Whether its Romney's email and Dropbox account or IBM's 400,000 employees, the risks associated with BYOD and cloud storage services highlight a problem IT shops now face: The potential loss of corporate data to an insecure public cloud. And it's not just Droxbox. There's a growing number of online consumer cloud services through which data can leak, including Box.net, Carbonite, Google Drive, Mozy, SugarSync, YouSendIt and Apple's iCloud.

"IBM has the world's BYOD program and they just locked down Evernote and Dropbox because they discovered their future product plans and all sorts of really sensitive data was being beamed automatically out to these services," said Dion Hinchcliffe, executive vice president of strategy at Dachis Group, a consultancy. "So they blocked all access to cloud storage applications."

Hinchcliffe said the use of mobile applications is a huge problem in enterprises, but companies have only begun to address the issue. He suggested that every company have a "bus stop" policy: If an employee wouldn't be comfortable leaving company information at a bus stop, they shouldn't be willing to store it in un unsanctioned public cloud.

While many enterprises now have a BYOD policy, they typically do not address the applications that come with mobile devices.