Now that’s still a lot of documents, but once you’ve identified a class of document, it’s not so much about going backwards and securing them, it’s more about going forward. If a document fits this type of profile then this is what happens to it and people that need to see it are invited to it; the document never actually leaves our cloud. If I have a document I want you to see and work on, I can’t actually email it to you. I can’t put it on your USB drive or I can’t email it to you as an attachment. But, I can invite you to it, and once you come to it everything you do is audited.
We already have the auditing and the inviting and the quarantine pieces in place. It’s just the classification part we don’t have, and that’s very difficult and will take time.
Going back to BYOD, you say you give out three types of devices. Do users have a say in what they get?
We learned that lesson the hard way. At the end of 2008 we were about to launch our first commercial field force to sell our drug, so we decided to buy the entire field force the same laptop, and while we were at it, we decided to buy everyone else the same laptop. This is like IT 101. Put everybody on the same laptop and three years later upgrade them all.
So we did that. We went out and bought everyone the same laptop and it didn’t matter what you did or whether you needed something with more power or less power. We just bought you the same laptop. Most people were just doing Word all day. It doesn’t matter.
And then three years later it’s time to replace all the laptops and we did that, but by now we’re really moving the company towards the cloud and BYOD, so everyone is bringing in their own stuff, but they still have to use the crappy laptop we gave them. So people end up with two laptops on their desks.
That’s when we stopped and said, “So, are we really going to do this, or are we going to continue screwing around?” So it was determined then and there we were never going to do this PC upgrade thing again.
So now it’s a matter of going to every person in the company and saying, “What do you need to be better?” The biggest return is simply asking that question. “Oh, you need a Gantt charting system? How about Smartsheet? Test it out. Oh, you found this product that you really like and you want to put it in permanently? Let’s look at it. We’ll talk to the vendor and, if they’re good, they check out, you can have them.”
I hear people talking about shadow IT and my sense is if there is shadow IT in your company then your CIO really screwed up. Because if you let people talk openly about what they need to make their departments better and you actually listen to them, you’ll never have it happen to you.
Do you give people a stipend for the stuff or do they buy it?
We just buy it for them.
So they specify what they want?
If they want a Windows PC, I have an opinion. If I’m going to buy you a PC, I’m going to go look at the best in the market and help you make the decision. But if you want a Mac, it’s one of two. If you want a Chromebook, then Samsung or Acer, take your pick. We don’t really care because they’re the same price. And for phones, it is Android or iPhone.
We got rid of desk phones. So everyone can either use their mobile phone or, if they still want to call from their extension, we retained our DIDs so every laptop is outfitted with Cisco IP Communicator software, so they can make calls from their laptop. Our entire building is wireless here. We have no wires except for power. So every employee can just pick up whatever it is that they have and go sit somewhere else.
You see people walking around the building all day with their Bluetooth air traffic controller headsets on their heads, talking to people. It’s funny. And we have this area with couches and during the day people are just sprawled out there with their laptops working. It’s a good feeling that we’re not just all sitting in our little tiny holes.
And our business continuity plan is now one bullet: go home. Because if the whole building shuts down, just go home and keep working, or don’t come in, or go down to Starbucks.
How about when it comes to other cloud services. Do you allow people to sign up for whatever they want?
We know people use Dropbox and Box, which is fine because I know where my documents are. Every document starts out in Google Drive and if you decide to move it to Box it’s tracked. We know you’ve done that, and employees know we know they’ve done that.
We’re not big fans of Box and Dropbox and we tell employees, “You know they’re not secure, right?” But I’m unwilling to blacklist anything because that’s like telling a 10-year-old boy he can’t play Mario Brothers. He’ll get up at two in the morning and sneak downstairs and do it anyway.
So rather than blacklist anything we listen and recommend. Someone comes to us and says, “I need to do this, and I was looking at this app.” And we might say, “There’s a better app to solve that problem and it also gives you x, y and z. And that’s a huge win for us when that works. And if the user says, “No, this isn’t going to work for me,” we say “Let’s look at the market together to see what else is out there?”