The Personal Device Problem
When a government employee accesses institutional email, systems, or documents from a personal device with no security controls, the institution's security is only as strong as that personal device. This is a policy and culture problem as much as a technical one. Institutions need clear, enforced policies on which devices can access which systems.
Minimum Device Requirements for Institutional Access
Any device accessing institutional systems should have: screen lock enabled (PIN/password/biometric), full-disk encryption enabled, automatic OS and software updates turned on, and no unauthorised software installed. For high-sensitivity systems, only institution-managed devices should be permitted — period.
What Happens When a Device Is Lost or Stolen
Without encryption and remote wipe capability, a lost laptop or phone containing institutional data is a reportable breach. With proper controls — encryption, remote wipe enabled, access credentials separate from device access — a lost device is an inconvenience rather than a crisis. The controls that prevent this are not complicated to implement.
Public Wi-Fi and Institutional Systems
Staff accessing institutional systems from hotel Wi-Fi, airport lounges, or any public network without a VPN is exposing session credentials and data to anyone monitoring that network. Institutions should provide VPN access, require its use for remote access to internal systems, and train staff on why this is not optional when working outside the office.