Strong policies - A must for BYOD

For organizations, the proliferation of personal devices in the work environment paves the way for untold efficiencies and increased productivity, not to mention lowered carrier costs. Workers can answer e-mail, upload information on file shares and update Websites from the commuter train, the beach condo or their kids’ soccer games − often on their dime. On a more personal level, studies have found that employees are happier and more efficient when they use devices and applications of their choice for work.

 

Sounds like a win-win situation? Well, here’s the dilemma − while everyone wants to be more productive, surprisingly few firms have policies in place to adequately secure the influx of mobile devices entering the workplace. And without these policies, organisations have simply no choice but to say no to the devices, and consequently to greater productivity and higher cost savings.

 

According to an independent survey Fortinet commissioned late last year with 350 mid to large enterprise IT decision makers in Asia, as many as 85% of respondents are concerned about their firms' ability to secure corporate data in this new user-led IT environment. Most companies are not confident of or do not have the means to secure personal mobile devices:  67% of respondents say they only allow the use of corporate mobile devices onto which security policies can be directly enforced. Twenty-six percent of enterprises place responsibility for securing personal mobile endpoints directly with the users/owners of those devices − a dangerous practice.

 

In a sense, we can empathise with enterprises' reluctance to embrace employee-owned devices. Generally, these devices are devoid of the most basic security features − such as antivirus and password protection − incorporated in practically all workplace PCs. Meanwhile, the agility enabled by personal devices means that business critical apps can, and will, be accessed from any network in any location. This leaves a staggering amount of sensitive data on the devices, whose exposure could be highly detrimental to the business. 

 

Yet, it's getting tougher for firms to say no to employees using their own devices − it's clear that staff aren’t going to stop using their own handhelds for business, and they will just try to figure out ways to make it work.

 

So what’s the answer to managing the BYOD-linked security challenges? Here are three IT measures that would provide some peace of mind for organizations:

 

Implement A Relevant Mobile Policy: It’s simple Policy 101. Most organizations should take the time to really assess their goals and determine relevant threats (e.g. malicious Websites, productivity loss, excessive bandwidth usage) to the network. Some questions the IT department need to ponder over:

 

 What applications are required, and which are not permitted?

 Which employees will be allowed to use these devices?

 Who has network access based on who, what, where and when?

 

Companies should also control access based on the need to know, and conduct continuous vulnerability assessments. And of course, they need to figure out how to enforce the policies they have laid down.

 

Remote Management Software: It's important to be able to apply the range of basic security functions, such as antivirus or remote data wiping software, to any device housing corporate data. Remote management software gives IT the ability to automatically update users’ devices with the latest patches to prevent any existing vulnerabilities from being exploited in mobile attacks. Firms should also implement centralised remote locate, track, lock, wipe, backup and restore facilities so that they could protect, retrieve and restore corporate data on lost or stolen mobile devices.

 

Blocking Non-Compliant Devices: This is where organizations can practice the art of compromise. Often workers are eager to use their personal devices for work but reluctant to install additional software − some of which might have the potential to wipe their valuable contacts and photos from their phone, tablet or laptop. As a compromise, firms could allow their workers to use their own devices IF they agree to install certain apps in accordance with the organization’s security policy. If not, then the workers can stick with an IT-issued device. An alternative solution some firms may want to consider could be dual persona phones that have two logical partitions – one for professional and the other for personal usage, with IT having complete control over the professional partition.

 

Ultimately however, organizations need to realise that in order to effectively protect their corporate networks and data from potential threats coming from mobile devices, they must handle the security issue at the network level rather than at endpoint level. In fact, it is extremely difficult to protect individual phones and tablets by using security agents: technically, mobile devices today do not have enough computing power and there are too many types of OSes and devices to maintain up–to-date agents;  user-wise, it is very difficult to enforce the installation of security software on personal devices that employees bring at work. 

 

As a result, the only effective solution is to make sure that the core network is protected and that the enterprise can control both inbound and outbound access to the corporate network from external devices. This network security strategy requires strong control over users and applications, on top of device management. It requires IT organizations to have the power to detect and control the use of applications on their networks and endpoints based on application classification, behavioral analysis and end-user association; and to detect and control Web-based applications at a granular level, including inspecting encrypted application traffic, regardless of ports and protocols used.

 

It's clear that organizations will have to put in a fair amount of effort to adapt and switch to a new way of supporting their employees but there is no alternative − BYOD is here to stay and IT managers just have to get ahead of the curve.