Bring-Your-Own-Device is one of the hottest topics in business networking, and for obvious reasons. On the face of it, BYOD can bring a lot of benefits to your business and your workforce:
-
Universal WiFi makes it easier to work anywhere on your grounds.
-
Workers will be most comfortable using their own devices, minimizing training and transitional problems.
-
Having workers bring their own equipment means you don't have to pay for it, or for repairs.
-
Personal devices, paired with strong Unified Communications, makes it possible for workers to contribute from anywhere, on virtually any device, in total security.
Security, however, is also the chief concern when moving to a BYOD security implementation. The extra power BYOD provides to your employees also means they have to take on greater responsibilities.
A successful BYOD plan largely relies on your employees maintaining security. As such, we strongly recommend any business interested in this topic to take time out to train or retrain their employees on proper smart device security policies.
Security Issues For Effective Bring Your Own Device Policies
1 - Every device becomes a door to your network.
The first and most important lesson to drive home is this: If you allow personal devices, that means your employees are carrying around a "back door" into your network wherever they go.
They must give greater consideration to the care of their smartphones and tablets. Incidents like forgetting them at a restaurant can open up the potential for security violations, if their device falls into the wrong hands.
2 - Device security cannot be compromised.
This one is a deal-breaker: Your employees must be able to enable and always use the security features of their personal device. If an employee is unwilling or unable to put a passcode/password on their smartphone, that smartphone does not become part of your network.
Similarly, "jailbroken" or other hacked devices have compromised security from the very beginning. That's the explicit purpose of jailbreaking. Therefore, such compromised devices also cannot be safely allowed on your network. You can never trust whatever security they have remaining, or the homebrewed hacks that enable such tricks.
3 - The worst place for passwords is on a phone.
It's hardly surprising that people tend to keep lists of their personal passwords on their phone. Passwords tend to end up written down somewhere, especially unmemorable messes requiring multiple extended symbol-characters.
If your passwords are complex enough they're regularly written down, that's a security problem in and of itself. However, storing them on a cell phone is very possibly the worst solution of all. If someone steals and cracks the phone -which isn't difficult for a pro- that means every password is open for the taking.
Don't do this, and don't allow your employees to either.
4 - All losses must be reported immediately.
This is another burden that falls on your employees if you implement a personal device policy: If they lose their device, even temporarily, they must quickly communicate this to someone in IT or Security.
While it's fair to say that most small businesses are not at large risk of significant espionage or other "black hat" hacking operations, it can happen to anyone. Plus, it's inarguable that a small business that implements big-business security is ultimately going to have better odds than a big business with small-business protections.
Devices which have been permanently lost/stolen should be immediately banned from the network. Devices which left the owner's possession for more than a few minutes should be thoroughly scanned for malware, and potentially rolled back to a pre-loss backup, if such exists.
Employees may grumble, but these are all "better safe than sorry" measures.
Results With Strong Training
Fundamentally, nearly all organizations aside from those literally dealing in Classified data can benefit from BYOD policies, but only if your employees understand their security responsibilities. Clear policies and training will create a strong foundation for +success.
And for more security tips, just contact us and ask!
