RiskUKOctober2017

‘The Perimeter’, as it
was once known, is
quickly going the way
of the Dodo. Between
Bring Your Own Device
schemes and the mass
migration to the cloud,
IT security
professionals can no
longer rely on the
boundaries of their
network to be the true
borders in their area of
responsibility. That
being the case, where
do they go from here?
Adam Jaques offers his
take on the matter
Left To Their Own Devices
Quite predictably, Bring Your Own Device
(BYOD) refers to a policy of allowing
employees to literally bring their own
devices into work and use their employer’s
network in order to do their job. It might prove
to be a headache for IT professionals inside the
host company, but has clearly been quite
attractive to management, who often see an
opportunity to save money, increase
productivity and, ultimately, streamline the
working lives of their employees.
This poses tough questions for security
professionals. They’ve every right to be
worried, too. A panoply of studies show that,
time and time again, human error is so often
the prime cause of a breach. Further, recent
reports have indicated that personal devices on
corporate networks are behind many insider
threats. In short, BYOD serves up a whole new
salad of security variables for IT security
professionals, many constituent elements of
which may seem tough to digest.
The moving parts that a BYOD policy
introduces confront IT Departments with a
variety of devices, brands and users and a
veritable kaleidoscope of data that can be
difficult to manage. You’re not only adopting
your employees’ devices, but often the services
and Apps that they regularly use as well.
Let’s be clear that BYOD isn’t going away
anytime soon. The corporate perimeter is
already heading out of sight. Workforces are
increasingly mobile and dispersed with the rise
of networked technology and the proliferation
of ‘Work at Home’ policies. It’s a trend that will
be hard to fight. A study by analyst Gartner
shows that, by the end of this year, 50% of
companies will require employees to use their
own devices for work-related tasks.
BYOD: the central considerations
So what do organisations need to think about
on the path towards BYOD? Compliance
considerations must come before the first draft
of any BYOD policy. Industry regulations and
standards must be understood along with the
issues that concern your specific sector when it
comes to IT.
In the healthcare sector, for example, BYOD
policy needs to take into account the great
wealth of intimately personal data that will flow
through users’ devices. For engineering, the
policy must recognise the value of the
Intellectual Property with which members of
staff are engaged on a daily basis.
All of this becomes especially important for
European organisations, who will soon face the
daunting compliance challenge of the EU’s
General Data Protection Regulation (GDPR),
which comes into effect in May 2018. The raft of
requirements it will introduce are all backed up
by a hefty 4% penalty on global revenue for
particularly delinquent proven offenders.
Survey results published by Strategy
Analytics have shown increasing fears around
BYOD on the part of European businesses, with
10% of those professionals quizzed suggesting
they expect the use of BYOD-enabled tablets to
decrease with the advent of the GDPR.
The GDPR need not become a hindrance to
BYOD adoption, but it does mean organisations
that want to allow mobile IT will have to be all
the more diligent when it comes to
implementation. Even if drafting a policy proves
cumbersome, not having one in place will not
stop employees from using enterprise IT on
their own devices. It will merely leave the
business without a structure to accommodate
this and risks compliance problems at some
juncture further down the line.
Opening up to risk
“There are always going to be some businesses
for whom BYOD is inappropriate,” explained
Vince Warrington, founder of Protective
Intelligence, a consultancy that advises
companies on security. “There are always going
to be people who struggle with not being able
to take their work laptop home, especially if
they need to work late or across a weekend to
meet deadlines. What they’re more likely to do
is e-mail their work to themselves, thus
opening up the enterprise to security risks.”
24
www.risk-uk.com