How are CFO's, in collaberation with IT, mitigating risks associated with "cyber espionage" and the proliferation of mobile devices accessing sensitive corporate data? (Webinar Attendee Question)

I think in essence things have not changed much in type of problem, but more in scope. This has long been an area for collaboration between IT and Finance.

My first step remains an information audit; ITAR, HIPAA and others require it, and it is a good first step for anyone. What are the paths for information, and how is it protected? Bad is not having good policies; worse, you don't want to find out that you've been storing SSNs in an internal-rogue context because they were stolen.

Strongly communicated policies are next. If you're going to allow BYOD (and not all companies do), what restrictions will you apply? Will IT get to touch/wipe all BYODs? Are there things that shouldn't be taken home or remote-officed (the answer is "yes"). And be prepared to enforce these policies. Make it clear that just as you would fire someone for storing the company's cash in the trunk of their car because it is "convenient", so too does violating data storage policies trump utility arguments.

In parallel, a battle must be fought on what information is captured and retained. When you are deliberately capturing user-identifiable data, such as in a HIPAA context, you will probably have good ways to restrict and protect that information. However, just as the black-hats are finding new ways to steal information, your own internal people are finding new ways to capture it. That data can create risk that exceeds the value of having it. Think of data as if it were a liability itself; if it isn't generating income for you, then all it is doing is creating risk. Processes and defenses reduce risk; elimination eliminates it.

The final step is the good news; just as the black-hats have new tech and avenues to penetrate your defenses, new defenses arise. Document-level access control, centrally managed intranets and through-to-BYOD vpns are all areas where Finance should be collaborating with IT on cost-benefit and process deployment.