CITATION
Mansfield-Devine, S. (2012). Interview: BYOD and the enterprise network. Computer Fraud & Security, 2012(4), 14-17.
Good article from the Computer Fraud & Security journal. Some important points:
BYOD wouldn't worry anyone if it was not for security implications.
Most companies start our by saying no to BYOD then get forced to open it up and lose all control.
Since companies in BYOD don't "own" desktops, they need to make the employees part of the security model.
In the past, presumably if something was connected to the network, it was approved by IT. BYOD blows this out of water.
The policies have to be a lot more sophisticated now; enterprise needs a system that automates this.
You need a system that can do access control based not only on "who" but "who", "what" and maybe "where".
Some employees know more about these devices than IT staff; they need to be part of the policy making and the solution. They need to be part of the security system process.
Example: Doctors were recommended Blackberry RIM; they refused and asked for iPads; reason? iPads are easy to take from patient to patient, have larger screen, had no keyboards, and are easy to sanitize.
The article also suggests a 10-step process for BYOD.
By: Nima Zahadat
Sunday, May 19, 2013
READ: BYOD-is it Good, Bad, or Ugly from the User viewpoint?
CITATION
Jones, J. (2012). BYOD–is it Good, Bad or Ugly from the User Viewpoint? BYOD, from http://blogs.technet.com/b/security/archive/2012/07/26/byod-is-it-good-bad-or-ugly-from-the-user-viewpoint.aspx
URL
http://blogs.technet.com/b/security/archive/2012/07/26/byod-is-it-good-bad-or-ugly-from-the-user-viewpoint.aspx
Some useful pieces:
A user quote: A sad example of workplace pushing off its responsibility to workers.
A user quote: This article left out two key facts/ First,as happened in my case, subsidies were offered to get people to turn in the company Blackberry, and then once BYOD was entrenched the subsidy disappeared due to "cost cutting". Second "BYOD" soon became a requirement and managers fully expected employees to be on call at all times.
Our research found that 67% of people are using personal devices in the workplace today, but only 53% reported having a policy in place explicitly allowing such activity. For 23 percent the response was either that no policy or guidance exists, or they simply aren’t aware of what the policy is, and for almost a quarter (24%) there is a policy in place specifically banning the use of personal devices in the workplace.
Why is it so important to users to be able to use their own device? There’s a reason that laptops, smartphones, and tablets come in a myriad of shapes and sizes, running different operating systems, and with different software available: people have unique, subjective opinions about what works and what doesn’t, and it’s infuriating to work with devices you’re not familiar with. Users chose their own device to meet their personal needs, so they’re more comfortable with their personal gadgets than with company-issued technology.
Another common user pet peeve is that organizations take too long to deploy new hardware, operating systems, and applications. BYOD enables users to embrace cutting edge technologies on their own, which reduces frustration and leads to happier employees.
The first issue is money. When a company issues a laptop, or mobile phone to an employee, it is understood that the company bought the hardware, and is accepting responsibility for any monthly wireless bills. When the burden for supplying devices shifts to the user, the financial waters can start getting murky.
However, our research found that it’s more common for organizations to allow personal devices, but not subsidize them. Many consider allowing employees to bring their own devices into the work environment is its own reward and don’t feel any obligation to offset those costs.
What about boundaries? When you have separate, company-issued devices you can simply turn them off or walk away during off hours, or when you’re on vacation. But, if you’re using the same device for both personal and business use, it’s easy to blur those lines and have work encroach on your personal time.
By: Nima Zahadat
Jones, J. (2012). BYOD–is it Good, Bad or Ugly from the User Viewpoint? BYOD, from http://blogs.technet.com/b/security/archive/2012/07/26/byod-is-it-good-bad-or-ugly-from-the-user-viewpoint.aspx
URL
http://blogs.technet.com/b/security/archive/2012/07/26/byod-is-it-good-bad-or-ugly-from-the-user-viewpoint.aspx
Some useful pieces:
A user quote: A sad example of workplace pushing off its responsibility to workers.
A user quote: This article left out two key facts/ First,as happened in my case, subsidies were offered to get people to turn in the company Blackberry, and then once BYOD was entrenched the subsidy disappeared due to "cost cutting". Second "BYOD" soon became a requirement and managers fully expected employees to be on call at all times.
Our research found that 67% of people are using personal devices in the workplace today, but only 53% reported having a policy in place explicitly allowing such activity. For 23 percent the response was either that no policy or guidance exists, or they simply aren’t aware of what the policy is, and for almost a quarter (24%) there is a policy in place specifically banning the use of personal devices in the workplace.
Why is it so important to users to be able to use their own device? There’s a reason that laptops, smartphones, and tablets come in a myriad of shapes and sizes, running different operating systems, and with different software available: people have unique, subjective opinions about what works and what doesn’t, and it’s infuriating to work with devices you’re not familiar with. Users chose their own device to meet their personal needs, so they’re more comfortable with their personal gadgets than with company-issued technology.
Another common user pet peeve is that organizations take too long to deploy new hardware, operating systems, and applications. BYOD enables users to embrace cutting edge technologies on their own, which reduces frustration and leads to happier employees.
The first issue is money. When a company issues a laptop, or mobile phone to an employee, it is understood that the company bought the hardware, and is accepting responsibility for any monthly wireless bills. When the burden for supplying devices shifts to the user, the financial waters can start getting murky.
However, our research found that it’s more common for organizations to allow personal devices, but not subsidize them. Many consider allowing employees to bring their own devices into the work environment is its own reward and don’t feel any obligation to offset those costs.
What about boundaries? When you have separate, company-issued devices you can simply turn them off or walk away during off hours, or when you’re on vacation. But, if you’re using the same device for both personal and business use, it’s easy to blur those lines and have work encroach on your personal time.
By: Nima Zahadat
READ: Beginner's Guide to BYOD
CITATION
Jones, J. (2012). Beginner's Guide to BYOD (Bring Your Own Device). [Blog].
URL
http://blogs.technet.com/b/security/archive/2012/07/18/beginner-s-guide-to-byod-bring-your-own-device.aspx
So BYOD is named after BYOB or Bring Your Own Beer.
Some useful pieces:
The popular perception is that the BYOD revolution was sparked by the advent of Apple’s iPhone.
Companies’ IT support policies have been pushing employees to be more independent and autonomous for decades. For years, IT Pros have opted to upgrade sooner and self-manage to get the benefits of new versions of products. It is frustrating for employees to know that a given task can be accomplished faster or easier using a different Web browser, or operating system, or application, but being handicapped by “supported products” dictated by the IT department.
Nomadic employees embrace the concept of being independent and autonomous, and manifest it by sometimes ignoring company policy and choosing the tools that help them be more effective, and work more efficiently.
There are also some significant downsides to consider, though. The organization has to address the fact that rogue devices outside of the control of the IT department might connect with corporate data and network resources, and the users have to accept the fact that BYOD comes with some policies that may limit their freedom with their own device.
There are frequently reports of sensitive customer or employee data being potentially compromised as a result of a laptop being taken from an unlocked car, or company data being compromised by an employee leaving a smartphone in a taxi. IT admins need to have BYOD policies in place to protect data no matter where it resides—even on devices that aren’t owned or managed by the company.
By: Nima Zahadat
Jones, J. (2012). Beginner's Guide to BYOD (Bring Your Own Device). [Blog].
URL
http://blogs.technet.com/b/security/archive/2012/07/18/beginner-s-guide-to-byod-bring-your-own-device.aspx
So BYOD is named after BYOB or Bring Your Own Beer.
Some useful pieces:
The popular perception is that the BYOD revolution was sparked by the advent of Apple’s iPhone.
Companies’ IT support policies have been pushing employees to be more independent and autonomous for decades. For years, IT Pros have opted to upgrade sooner and self-manage to get the benefits of new versions of products. It is frustrating for employees to know that a given task can be accomplished faster or easier using a different Web browser, or operating system, or application, but being handicapped by “supported products” dictated by the IT department.
Nomadic employees embrace the concept of being independent and autonomous, and manifest it by sometimes ignoring company policy and choosing the tools that help them be more effective, and work more efficiently.
There are also some significant downsides to consider, though. The organization has to address the fact that rogue devices outside of the control of the IT department might connect with corporate data and network resources, and the users have to accept the fact that BYOD comes with some policies that may limit their freedom with their own device.
There are frequently reports of sensitive customer or employee data being potentially compromised as a result of a laptop being taken from an unlocked car, or company data being compromised by an employee leaving a smartphone in a taxi. IT admins need to have BYOD policies in place to protect data no matter where it resides—even on devices that aren’t owned or managed by the company.
By: Nima Zahadat
READ: BYOD: Organizations Question Risk vs. Benefits
CITATION
Jones, J. (2012). BYOD: Organizations Question Risk vs Benefit. [Blog].
URL
http://blogs.technet.com/b/security/archive/2012/08/02/byod-organizations-question-risk-vs-benefit.aspx
Good blog on Microsoft Technet. Some useful pieces:
In the last post in this series we established that 40% of the people we surveyed consider it very important to be able to use personal devices at work, and 67% reported they are already doing so--whether sanctioned by their employer or not. There are some caveats as well, but in general it seems that a majority of users are in favor of BYOD.
One of the most common factors cited in support of BYOD is cost savings. The theory is that organizations can save money by investing less in hardware and software, and offloading that responsibility to users. We also can’t ignore the cost savings related to device maintenance. Employee familiarity with their personal device leads to lower numbers of support calls, plus employees (rather than the IT staff) will ensure the product is up-to-date.
The users may be concerned about the privacy of their personal data on their BYOD equipment, but many companies fall under industry and regulatory mandates that require a certain level of monitoring and protection for company data.
Some useful charts:
In order to implement BYOD effectively, organizations should have a clearly defined policy that outlines acceptable use, and proscribes uses or activities that are strictly forbidden. Without an established policy, BYOD is chaotic and confusing for both the company and the employees. (Part of my topic point)
While there are potential cost savings for companies that embrace BYOD, there are also some hidden costs to consider. First, IT personnel have to be familiar with a broad range of devices in order to get them connected to company resources, or be able to provide any support at all.
Another factor to consider is that some businesses rely on apps that are only available on specific mobile platforms, or are already invested in mobile device management (MDM) systems that are only capable of monitoring and managing certain mobile operating systems. The BYOD policy needs to spell out up front what those platforms are so users know which devices are compatible with business needs.
The 2011 ISACA IT Risk/Reward Barometer found that over 58% of U.S. security professionals view mobile devices owned by employees as posing the greatest risk their organization faces. This is particularly true of businesses that operate in healthcare, finance, or other fields that fall under compliance requirements such as HIPAA, SOX, GLBA, or PCI-DSS. Every organization has a duty to protect sensitive company and customer data, but those governed by industry or regulatory mandates face fines, or even possible jail time, for failing to do so.
Organizations that implement BYOD need to include minimum security requirements within the written policy as well. Mobile devices should be secured with a PIN or passcode of some sort, and data stored on the devices should be encrypted.
To take it a step farther, IT admins may also want tools in place that enable the company to remotely lock a lost or stolen device. In extreme cases, the company could remotely wipe all data from the mobile device, but that gets tricky because the employer may not have the right to erase the employee’s personal data.
Jones, J. (2012). BYOD: Organizations Question Risk vs Benefit. [Blog].
URL
http://blogs.technet.com/b/security/archive/2012/08/02/byod-organizations-question-risk-vs-benefit.aspx
Good blog on Microsoft Technet. Some useful pieces:
In the last post in this series we established that 40% of the people we surveyed consider it very important to be able to use personal devices at work, and 67% reported they are already doing so--whether sanctioned by their employer or not. There are some caveats as well, but in general it seems that a majority of users are in favor of BYOD.
One of the most common factors cited in support of BYOD is cost savings. The theory is that organizations can save money by investing less in hardware and software, and offloading that responsibility to users. We also can’t ignore the cost savings related to device maintenance. Employee familiarity with their personal device leads to lower numbers of support calls, plus employees (rather than the IT staff) will ensure the product is up-to-date.
The users may be concerned about the privacy of their personal data on their BYOD equipment, but many companies fall under industry and regulatory mandates that require a certain level of monitoring and protection for company data.
Some useful charts:
In order to implement BYOD effectively, organizations should have a clearly defined policy that outlines acceptable use, and proscribes uses or activities that are strictly forbidden. Without an established policy, BYOD is chaotic and confusing for both the company and the employees. (Part of my topic point)
While there are potential cost savings for companies that embrace BYOD, there are also some hidden costs to consider. First, IT personnel have to be familiar with a broad range of devices in order to get them connected to company resources, or be able to provide any support at all.
Another factor to consider is that some businesses rely on apps that are only available on specific mobile platforms, or are already invested in mobile device management (MDM) systems that are only capable of monitoring and managing certain mobile operating systems. The BYOD policy needs to spell out up front what those platforms are so users know which devices are compatible with business needs.
The 2011 ISACA IT Risk/Reward Barometer found that over 58% of U.S. security professionals view mobile devices owned by employees as posing the greatest risk their organization faces. This is particularly true of businesses that operate in healthcare, finance, or other fields that fall under compliance requirements such as HIPAA, SOX, GLBA, or PCI-DSS. Every organization has a duty to protect sensitive company and customer data, but those governed by industry or regulatory mandates face fines, or even possible jail time, for failing to do so.
Organizations that implement BYOD need to include minimum security requirements within the written policy as well. Mobile devices should be secured with a PIN or passcode of some sort, and data stored on the devices should be encrypted.
To take it a step farther, IT admins may also want tools in place that enable the company to remotely lock a lost or stolen device. In extreme cases, the company could remotely wipe all data from the mobile device, but that gets tricky because the employer may not have the right to erase the employee’s personal data.
- 53% of organizations officially condone BYOD in some way, but less than half of them provide any financial subsidy for users who supply their own equipment.
- 22% of organizations allow personal devices to be used, but require that they be managed by the company IT personnel.
- Cost savings resulting from employees using their own PCs and mobile devices may be offset by increased IT support and security costs.
- A majority of companies are somewhat or very concerned about the risk of data breaches or intellectual property leaks.
READ: Bring Your Own Device (BYOD): Security Risks and Mitigating Strategies
CITATION
GHOSH, A., GAJAR, P. K., & RAI, S. (2013). BRING YOUR OWN DEVICE (BYOD): SECURITY RISKS AND MITIGATING STRATEGIES. Journal of Global Research in Computer Science, 4(4), 62-70.
Good article though poorly written. Here are the important points of what it said.
The article talks about five control objectives and gives suggestions as what to do. These are:
One suggestion made is to have a Mobile Device Management system or MDM, like Blackberry has. More or less, the Blackberry model is discussed without going into any details on how to do such with the variety of devices and operating systems they run.
By: Nima Zahadat
GHOSH, A., GAJAR, P. K., & RAI, S. (2013). BRING YOUR OWN DEVICE (BYOD): SECURITY RISKS AND MITIGATING STRATEGIES. Journal of Global Research in Computer Science, 4(4), 62-70.
Good article though poorly written. Here are the important points of what it said.
- BYOD is a brand new concept emerging.
- An employee seems highly dependent on using any of their portable devices because they find their own devices cooler and easier to use
- Organizations can benefit by allowing users to use their own devices if that is not compromising security of the organization and the privacy of the user
- BYOD brings with it Bring Your Own Technology and Bring Your Own Software
- Benefits
- Organization spending is reduced with regard to devices, procurement, training
- Increase in employee moral
- Devices tend to be cutting edge technology
- Employees handle the devices more efficiently
- Employees look after the devices with more diligence
- Security concerns
- Devices may not have all the sophisticated apps needed to protect corporate data
- Devices subject to malware attacks and modification (such as jail breaking)
- A variety of operating systems to work with at the organization level
- Business and personal data on the same phone can make for difficult segregation
- Disgruntled employee may store confidential data and give to someone else
- BYOD may conflict with existing organizational policies, contracts, and laws
- Risks invovled
- Credential stolen or breached
- Confidential business data stolen
- Device can be lost or stolen
- Threats invovled
- Malware
- Spam
- Phishing
- Bluetooth and Wi-Fi exploits
The article talks about five control objectives and gives suggestions as what to do. These are:
- Identification and access control
- Data protection
- Application security
- Integrity control
- Compliance
One suggestion made is to have a Mobile Device Management system or MDM, like Blackberry has. More or less, the Blackberry model is discussed without going into any details on how to do such with the variety of devices and operating systems they run.
By: Nima Zahadat
Subscribe to:
Posts (Atom)