The line between managed settings and company policy

Lately I’ve been thinking about the line between electronic management controls and company policy - should you have to go through the effort of locking down things like dropbox.com on a fleet of laptops? How will you control that when people are remote? How can you prevent people from using countless other services that are similar, but different enough that they aren’t explicitly blocked?

Or is the solution something else entirely? I submit that its a matter of company policy. As part of the employee handbook, there is generally a section regarding usage of electronic assets. In most cases, there is also a (possibly separate) IT policy. So instead of working really hard to prevent the usage of file syncing software/webapps (which is a losing battle), policy can simply outlaw it. In other words, nothing physically stops you from robbing a store, but if you do, you are definitely going to get in trouble with the law! IT should be able to spend most of their time improving system functionality/workflows, making things easier, etc. Relegating the fight against certain types of functionality to policy makes things a whole lot simpler.

Of course, to do this there needs to be clear consequences to breaking policies, and there definitely needs to be support from upper management - meaning, it definitely needs to be enforced!