RiskUKOctober2017

Mobile Technology: Risk Management for BYOD and The Cloud
Warrington continued: “It’s that balance of
making sure you have the security right. If you
don’t put some kind of policy in place then
people will work around the situation in any
event. They’ll find a way. Your workforce is like
water in that it will always gravitate towards
the path of least resistance. If you turn around
and give people in your working environment
the kind of workloads where they’re having to
operate from home at weekends or while on the
move then you must accept the fact that, unless
you put proper rules in place, they’re going to
do whatever works best for them.”
Core to the introduction of a BYOD policy will
be to give users access to the processes they
need to do their jobs. This involves more than
just securing endpoints in the right way. Steve
Armstrong, a SANS Institute instructor, advises
against relying purely on endpoint solutions,
and instead to “think about controlling your
data before it’s sent to the endpoint.”
You need to think about what data you’re
replicating. Is it reliable? Is it secure? Does this
person actually need access to that data? “It’s
good to have endpoint security,” stated
Armstrong, “but don’t think you’ve just
outsourced the problem.”
EMM comes into play
That access needs to be managed and enforced
with what’s known as Enterprise Mobility
Management (EMM). EMM helps to prevent
unauthorised access and establish acceptable
behaviour for mobile IT, partition accountability
and address the problems of lost and stolen
devices as well as what to do when an
employee and an employer finally part ways.
The simplest EMM solution for the widest
range of devices will be the one that works
best. To be sure, any solution that’s too
complex or restrictive is doomed to failure.
Back in 2014, another study by Gartner
predicted that 20% of all BYOD policies would
fail due to overcomplexity.
Access management must be disciplined.
People (including guests) and devices that
don’t require access to areas of your business
should not have access. It’s as simple as that.
The proliferation of admin rights for regular
users across global organisations is a regular
cause of security breaches. Some EMM
solutions make good use of container security
which effectively separates the data of
employees and enterprises, even when working
on devices that are brought in from home.
Network access control solutions and strong
SSL VPNs will be critical to the adoption of
BYOD, affording users access to what they need
while protecting the business from security
“Survey results published by Strategy Analytics have
shown increasing fears around BYOD, with 10% of those
professionals quizzed suggesting they expect the use of
BYOD-enabled tablets to decrease due to the EU’s GDPR”
risks. Bear in mind that technological solutions
are necessary, but not quite sufficient enough
for an effective BYOD policy.
Humans may be your weakest point, but
they’re also your most critical aspect. They’ll
need to be educated about security cleanliness,
what they can and cannot do on a company
network and how they might work not only
efficiently, but also safely.
Employee perspectives
When looking at the issue from the point of
view of the business itself, it’s easy to forget
about the perspective of the employee. The
benefits of a BYOD policy cannot be taken as a
‘given’ when it comes to employees. They need
to be assured that their privacy will be
respected, just as employers would expect their
security policies to be observed.
Moreover, finding out what employees want
and, just as importantly, what they actually
need from such a policy will only serve to
create a more agile and workable document
which is easier to stomach.
Much of this comes down to education, itself
a fundamental aspect of implementing BYOD.
Education is absolutely critical to the future
safe working of BYOD within your organisation.
In essence, BYOD has to orbit around the
very subject of a BYOD policy: the user. Here,
simplicity is king. Complex policies will mean
inefficient working, blocks to productivity and
hard-to-follow instructions. They’ll merely
increase the likelihood of the user finding some
way of circumventing a cumbersome security
policy and possibly opening up your
organisation to compromise.
What about the future?
Looking ahead, new developments are being
made in BYOD that will allow the introduction
of Artificial Intelligence in workplaces, thus
removing much of the scope for human error
that BYOD sometimes risks. Bring Your Own Bot
(or BYOB) has been touted as the future
iteration of BYOD, with the arrival of intelligent
personal assistants like Amazon Alexa.
BYOD provides a new challenge to security
professionals and one that’s not entirely
avoidable. However, a forward-thinking BYOD
policy will plug security holes far more
effectively than if you choose to ignore them.
Adam Jaques:
Technologist at Pulse Secure
25
www.risk-uk.com