Is it OK to use work devices for personal purposes?

The incident involving Scottish Health Secretary Michael Matheson has highlighted significant issues surrounding the personal usage of work devices and cybersecurity. Matheson admitted his sons set up a data-hotspot on his parliamentary iPad data to watch football matches while on a holiday in Morocco, incurring around £11,000 in roaming fees.

This situation raises concerns not only about the personal use of government-issued devices but also about the security protocols and cost monitoring in place for such devices.
In the context of this incident, a wider discussion about cybersecurity and the personal use of work devices is pertinent. It's important to address the potential risks that come with the personal use of work devices, such as the exposure of sensitive information, the vulnerability to cyber threats, and the potential for unauthorised access.

It's also worth noting that Matheson was warned almost a year earlier to update the device, which he did not do, resulting in the high costs incurred. This led to public outcry and demands for accountability, resulting in Matheson agreeing to foot the bill himself.

Organisations must establish clear-cut policies that segregate personal use from work on official devices. Regular updates and adherence to digital security protocols should be non-negotiable, and all users must be made aware of the potential implications of their activities on work devices.

To ensure compliance by users, cybersecurity training and awareness should be continuously provided. Employees, including those in high offices, need to be educated about the potential risks associated with the personal use of work devices. This includes the possibility of data breaches, exposure of sensitive information, and the introduction of malware into secure systems.

Recommendations for secure device management:

1. Enforce Strict Usage Policies: Clearly define what constitutes acceptable use of work devices and enforce these policies through regular monitoring and consequences for non-compliance.
2. Regular Security Updates: Mandate regular updates to both hardware and software to protect against vulnerabilities.
3. Separate Work and Personal Data: Employ technological solutions that compartmentalise work and personal data, ensuring that sensitive information remains secure.
4. Implement Financial Controls: Set up alerts for unusual activities, such as high data usage, to prevent unexpected costs.
5. Conduct Regular Ongoing Training: Establish a routine cybersecurity training program that includes scenarios related to the use of work devices outside the office.