READ: Bring Your Own Device (BYOD): Security Risks and Mitigating Strategies

CITATION
GHOSH, A., GAJAR, P. K., & RAI, S. (2013). BRING YOUR OWN DEVICE (BYOD): SECURITY RISKS AND MITIGATING STRATEGIES. Journal of Global Research in Computer Science, 4(4), 62-70. 


Good article though poorly written.  Here are the important points of what it said.

• BYOD is a brand new concept emerging.
• An employee seems highly dependent on using any of their portable devices because they find their own devices cooler and easier to use
• Organizations can benefit by allowing users to use their own devices if that is not compromising security of the organization and the privacy of the user
• BYOD brings with it Bring Your Own Technology and Bring Your Own Software
• Benefits
• Organization spending is reduced with regard to devices, procurement, training
• Increase in employee moral
• Devices tend to be cutting edge technology
• Employees handle the devices more efficiently
• Employees look after the devices with more diligence
• Security concerns
• Devices may not have all the sophisticated apps needed to protect corporate data
• Devices subject to malware attacks and modification (such as jail breaking)
• A variety of operating systems to work with at the organization level
• Business and personal data on the same phone can make for difficult segregation
• Disgruntled employee may store confidential data and give to someone else
• BYOD may conflict with existing organizational policies, contracts, and laws
• Risks invovled
• Credential stolen or breached
• Confidential business data stolen
• Device can be lost or stolen
• Threats invovled
• Malware
• Spam
• Phishing
• Bluetooth and Wi-Fi exploits

The article mentions "...some control strategies need to be developed to address the issue of mitigating the risk, so that ways of accessing the resources ca be made secure." but fails to really address it.  This is good for me as this is yet another article that fails to really give solid answer to the requirement's analysis needed for  BYOD infrastructure along with the needed life cycle analysis.

The article talks about five control objectives and gives suggestions as what to do.  These are:

• Identification and access control
• Data protection
• Application security
• Integrity control
• Compliance

No mention is made as  to how to go about implementing any of this at the organization level for the variety of devices.  Further, no mention is made on how to integrate a BYOD mobile security system in the overall security system of an organization though they do mention it should be done.

One suggestion made is to have a Mobile Device Management system or MDM, like Blackberry has.  More or less, the Blackberry model is discussed without going into any details on how to do such with the variety of devices and operating systems they run.

By: Nima Zahadat