THE IT SECURITY PROFESSIONAL |
Barlowtek
The It security Pro
Helping Organizations Understand IT Security
&
Best Practices
Securing BYOD on your NetworkWhen it comes to enabling our users to be the best employee they can be. It is important that IT Security be the department of ennablement and not the department of “NO”. With this mindset, it is important to remember that our job is to protect our network. When you enable your users to use their own device on your network, you should remember that certain steps can be taken that allow you to maintain the security and still be able to enable your business to profit from the enhanced productivity that will come from allowing BYOD (Bring-Your-Own-Device) on the network. Rules Establishing rules that will allow the usage of BYOD on the network is the first step in allowing user owned devices on the secured enterprise network. The rules or policies should clearly define where the business ends and what employee’s areas of responsibility are clearly delineated within those documents. For some companies this may be a difficult area to define, since they may offer the employee a phone to use for business purposes. (Where do you draw the line between the company and the employee for text messages or personal email content?) While consulting a legal adviser is always good practice, it is especially important that it be done during the creation of your BYOD policy. While employees may take offense to having the IT Security Team digging around in their personal information or device, it is important that there is some mechanism that allows the company to have that control. In addition, having the employee sign a document that ensures that they will follow the guidelines that you develop will go a long way in maintaining that control. Device Support Now that you will be allowing BYOD on your enterprise network, it is important to determine what specific devices you will be willing to support. While there may be several different manufactures, you will need to spell out specific details, such as the following:
Exclusion List
Just as it is important to have a list of devices that you will support on the network. It is also important to have a list of items that you will not support. The most mentioned item when it comes to BYOD is a “cracked” device that has had its OS altered in some way. The reason for this is that you will not be able to determine what sort of specific features that it will have. This is due to it being altered from its original configuration. While there may be benefits to the user for doing this, the risks outweigh the benefit in this case. Exclusion lists may include the same information as the list of permitted devices and OS versions. In addition, some specific software may not be permitted on the network, which will need to be spelled out to the end user. Without these specific details, you will have end users trying to get all sorts of devices onto the network because you never spelled out that they couldn’t do it. Customer Support One of the biggest mistakes that IT Security teams make is taking the place of the employee’s cell service provider. There is a reason why they went with the provider they did. Any sort of service of the device needs to go through the provider and not your team. Failure to draw this line in the sand will make your team liable for any damages done to the device by your staff. This is not a good situation to be in when you are trying to enable your end users, and you now are their go to team if they have any issues with their device. Software Additions Some businesses that enable BYOD on their networks due so because it just makes good business sense to do so. In addition, there may be some productivity applications that the company may want to include on the device to make the employee’s job easier. Organizations will also deploy remote wiping software that will allow the business to remove all information that belongs to the company from the device. This process may also be part of your Security Incident Policy, which spells out the responsibility of the employee if they lose or misplace the device. Summary While there are some clear benefits from allowing BYOD on your corporate network. You should look into what specific requirements you will ask of your employees and how you will enforce those policies across the enterprise. Enabling our end users should be something that we all want to strive for, but we need to do it with an eye on security. This focus will ensure that you have an effective policy and process for allowing your employees to use the devices that they have purchased in a responsible manner.
0 Comments
Your comment will be posted after it is approved.
Leave a Reply. |
IT Security ProSecuring the future one byte at a time! Mr. Barlow is here, staying ahead of the curve in Information Security Leadership. Ready to help your company stay safe and secure. Categories
All
Archives
January 2023
|