ACCG3058 Information Systems Audit and Assurance

An organisation has adopted a BYOD strategy for mobile devices such as smartphones and tablets. AN employees tablet has been identified as an unauthorised bridge between the organisation's secure network and the public interest.

The organisation's incident response team are baffled as to how this could happen and attempts to call the employee and retrieve the device have fallen on deaf ears. The employee owns the device and said he has sensitive personal information on the device and cites their right to privacy. He states: "under no circumstances will they allow any organisation to search the device".

How should we deal with this situation and could better training help mitigate this type of incident?