On the surface, a Bring Your Own Device (BYOD) policy seems like a great business move. By allowing employees to use their own devices, such as laptops, smartphones, and tablets, companies can save money and increase productivity. However, securing your network in a BYOD environment poses unique challenges from both a cybersecurity and a privacy standpoint. If you don’t address these risks properly you could be leaving your company, and it’s data, vulnerable. This guide is designed to help your company smoothly transition to a corporate BYOD policy.
The Risks of BYOD
Increased Risk of Data Leakage
When you allow your employees to access corporate data using their own devices from anywhere it increases the possibility that your data may be leaked. Mobile devices are the weakest link when it comes to network security because they are the most susceptible to attacks. Mobile phones and tablets require constant patch updates to secure security loopholes, and even a single missed patch can leave your company, and its data, vulnerable.
Increased Exposure to Vulnerabilities
Due to the nature of BYOD companies have minimal control over any corporate data either stored on employee devices or accessed via employee devices. If an employee forgets to install a security update, connects to a suspicious wifi signal, or loses their phone it could put your data at risk.
The Mixing of Corporate and Personal Data
Having employees use their own devices for work makes it difficult to distinguish between personal data and corporate data. If the device is lost or stolen corporate data can be put at risk. Allowing these two different types of data can also pose significant privacy concerns, especially if an employee leaves the company.
Increased Chances of Malware Infection
Not everyone is as careful with their devices as they should be. If an employee unknowingly installs malware onto their device, which is connected to the rest of your company’s network, they might end up spreading the malware to other devices. Depending on the nature of the malware your employee may unwittingly install keylogging software, which would allow unauthorized users to learn your employee’s usernames and passwords. This obviously poses a huge security risk, since unauthorized users could use that information to gain access to sensitive or private corporate data.
Increased IT Infrastructure
When a company switches to a BYOD policy the IT department will need to rework their existing infrastructure to accommodate a variety of personal devices. Most companies end up investing a lot of time, energy, and other resources to make sure that BYOD policies are compliant with existing security and privacy policies. You need to make sure things are done correctly to avoid having to divert more time and resources to fix problems created by a poorly implemented BYOD policy.
How to Protect Your Network While Using a BYOD Policy
BYOD can complicate your cybersecurity needs, but that doesn’t mean it is a bad idea. To help ensure your network stays secure here are some steps you should take and some policies you should consider implementing.
Conduct an IT Audit Before Enacting BYOD
Before you begin implementing a BYOD policy you should conduct a thorough audit of your current IT infrastructure and policies. That way you can address any potential cybersecurity gaps, problems or conflicts with your existing IT protocols before you begin. This will not only make the change over go more smoothly, but it will also help you ensure that you aren’t inadvertently exposing sensitive information or creating a gap in your cybersecurity when you begin to change things.
Not everyone needs access to everything. To help keep your network secure you should add role-based access. That means that how much access each employee is granted is tied to their role, and their access is limited to only to systems and information their job requires access to. You can also restrict access on a profile basis, which will limit who is allowed to access your systems remotely and allow restrictions on some applications or filesharing to within your internal office network. This will not only improve your cybersecurity but will also make it easier for you to audit and monitor your data and better control a leak should one occur.
Require Two-Factor Authentication for Mobile Access
Both passwords and physical devices can be stolen, which is why many companies are enacting two-factor authentication processes for employees who need to access the network remotely. Two-factor authentication requires employees to use two different pieces of information to confirm their identities. Most two-factor authentication systems pair a strong password with a second factor such as a text message confirmation, a hardware element, or something else. For example, if an employee tries to log in using a two-factor authentication method from their laptop they may be prompted to first enter their password and then send themselves a “push”. The push is generated by an app, and in order to log in the employee must acknowledge the push using their mobile phone before access is granted.
Install Mobile Device Management Technology
One of the biggest problems with BYOD is that because employees use their personal devices for both work related and personal uses corporate data and personal data can become intertwined. Installing Mobile Device Management (MDM) technology on all devices used for work helps you, and your employees, keep personal and corporate data separate. It also allows you to remotely access and remove corporate data from employee devices while keeping employee data private. This not only provides your company with stronger control over corporate data but also helps shield you from legal problems associated with accessing employee’s private information.
Enact Network Access Controls
A lot of data leaks are the result of poorly patched software. When software companies discover vulnerabilities in their programs they issue patches to fix them. However, patches are only useful if they are installed. Unpatched and out of date software is vulnerable to cybersecurity attacks because unscrupulous individuals now know exactly what vulnerabilities they can exploit to potentially gain unauthorized access. By incorporating Network Access Control (NAC) you can ensure that all devices that connect to your network are up to date on their software, including anti-virus software. Devices that are not up to date are denied network access until they are updated.
Protect Your Endpoints
Endpoint protection involves using security programs that scan all devices requesting access to your network. This software then identifies any devices that may be infected with malware or other viruses and denies them access. This not only protects your internal network but also helps safeguard other company technology assets and other employee devices.
Require Strong Passwords
One of the simplest things you can do to improve your company’s cybersecurity is require employees to use strong passwords. NIST (the National Institute of Standards and Technology) offers comprehensive password guidelines in section 188.8.131.52. (Memorized Secret Authenticators).
Require Immediate Notification for Lost or Stolen Devices
In a BYOD environment, employee’s personal devices are not only connected to your network but may also have corporate data stored on them. Therefore, if an employee’s device is lost or stolen your company should be informed immediately so that you can take proactive measures to protect your corporate data. You should have clear cut policies in place that requires employees to report lost or stolen devices and make sure that all employees understand that this is the case.
Use Device Locator and Remote Wiping Services
Should a device be lost or stolen you should have protocols in place for safeguarding the data stored on the device. A device locator service (such as Find My iPhone) can help you and your employees locate lost devices. However, if the device is stolen you may need to consider wiping it so that unauthorized users cannot use the device to access corporate data. Remote wiping services can help you remove corporate data from employee devices that may have fallen into unscrupulous hands.
Create a Policy for Exiting Employees
Ending a working relationship with an employee is never pleasant, but that doesn’t mean that you don’t need to be prepared for that eventuality. You need to have clear and robust policies in place for removing corporate data and access to your network from the personal devices of exiting employees. All employees should be aware of those policies and when an employee is exited those policies should be enacted as soon as possible.
A BYOD policy is a great way to reduce costs and increase employee productivity, but if it isn’t implemented correctly it can cause headaches and leave your corporate data vulnerable. Not everyone is a cybersecurity expert, and many businesses don’t have the resources to create a full time, in house cybersecurity team. That is where Managed Security Service Providers (MSSPs) come in. MSSPs can provide your company with protection and monitoring 24/7/365 and help you mitigate damage should a cybersecurity event occur.