Mobile

12/9/2013
09:06 AM
Mike Jennett
Mike Jennett
Commentary
100%
0%

Don't Be Overprotective About BYOD

Too many IT departments are putting a crimp in bring-your-own-device programs with overbearing security precautions.

If you are a parent today, you live your life in fear. Everything needs to be sanitized with 99.7% anti-bacterial soap. The corporate world isn't much different when it comes to bring-your-own-device (BYOD) policies. We have security and IT executives who are scared to death that viruses from the outside are going to walk in on their employees smartphones and attack their networks.

I understand the need for security and I have seen firsthand how networks can be taken down by errant viruses and attacks. However, many IT organizations are acting like frightened parents. Most of us who grew up prior to the millennial age lived in a world where eating dirt was just a way of setting yourself up for a healthy adulthood. That did not mean you skipped taking showers and covering your mouth when coughing, but you weren't followed around with a bottle of hand sanitizer.

When we look at the new world of BYOD, it isn't that much different. Yes, threats to security are out there, and yes, there are bad people hiding around the corners that wish to do your enterprise harm. Nevertheless, sanitizing every phone and keeping them out of your network just isn't feasible or even a healthy strategy. You need to balance the BYOD security risk and the potential gains.

[Want to learn more about mobile security? Read Android Security: 8 Signs Hackers Own Your Smartphone.]

Sure, you can treat your network like the boy in the bubble, but you'll be losing a great productivity tool and, possibly, some great employees. A prime example of this mentality was shown when IBM banned Siri on their employees’ phones. IBM had valid concerns about data security, but this could easily be seen as an over-reaction and lead employees to stick with their two-phone mentality (one supplied by the company for business use and one for personal use).

The key is to provide options for employees that will help protect corporate data without being overbearing. Rebecca Abrahams hits this topic on the head with her article "Gen Y Does Not Want to Hear About BYOD Security Measures." Abrahams acknowledges the importance of security in the mobile world, but she also emphasizes the need for balance and education.

The key is to show your employees that you trust them and that you aren't afraid that every little thing their mobile phone touches is going to bring down your network. A truly successful BYOD security implementation works in the background with little interference with the workings of the user. Just as you were taught to wash your hands and cover your mouth when you cough when you were a child, new employees need to be given the proper tools and knowledge to successfully protect themselves and their corporate data.

Easy steps employees can take can to protect themselves and their employer's data should be spelled out in a corporate BYOD policy. Some of the basics include requiring a PIN on devices and setting up encryption. These two steps are basic building blocks for securing phones and data.

So, when implementing BYOD, look at what you really need to be afraid of. A high-profile financial institution handling loads of money will need one level of BYOD security policies whereas a midsized business selling widgets won't need to look like Fort Knox. Be realistic as you go down the path to BYOD. Don't let perfect get in the way of good policies that will help make your employee more productive. Embrace the dirt while fighting the germs that need to be fought.

Mike Jennett is the Enterprise Mobility Deployment Program Director for Hewlett Packard where he is responsible for all aspects of the development, deployment, and integration of mobile apps and infrastructure for HP IT. He has an extensive background in mobility, web and enterprise application deployment.

IT groups need data analytics software that's visual and accessible. Vendors are getting the message. Also in the State Of Analytics issue of InformationWeek: SAP CEO envisions a younger, greener, cloudier company. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bubbajones4u4
50%
50%
bubbajones4u4,
User Rank: Apprentice
12/10/2013 | 4:45:59 PM
Overprotective BYOD
BYOD is a big test of trust in a corporate enviornment, and the question to data access and security between personal and business data is the $1 millon question. I agree, there is a thing as being overprotective, but in terms of data security I don't know if there is such a thing.

We were looking to bring in a larger MDM system for BYOD at our hospital, but the doctors (who own the hospital) felt it was to intrusive since they all wanted to use their own devices, but didn't want IT to have total control over them. Still, they wanted the ability to send HIPAA compliant patient info (mostly text messages) to admin and other doctors.

In the end, we changed our stratagy and started looking for individual apps to deal with the various security issues. Example: to allow for HIPAA text messaging, we got an app (Tigertext) which is HIPAA compliant, and installed it on all the doctors devices. It auto-deletes the messages after X period of time, and IT can still wipe the device if it is lost or stolen, but the doctors didn't feel it violated thier 'privacy' which made it acceptable to them. More info: www.tigertext.com
WKash
50%
50%
WKash,
User Rank: Apprentice
12/10/2013 | 10:14:43 AM
Re: The Problem With Perfect
CIOs will always face a yin and yang dllemma between the need for information access and the need to keep that information secure.  Walling off corporations from mobile dangers at the expense of productive uses of mobile is clearly not the anwer.  Neither is giving into BYOD demands simply to satisfy your workforce.  As most enlighted CIOs understand, the answer is in learning how to find the pathway to "Yes, we can, if we do x,y,z" instead of "No, we can't because of a,b,c."
Laurianne
100%
0%
Laurianne,
User Rank: Apprentice
12/9/2013 | 2:30:13 PM
The Problem With Perfect
Practical post. Focusing on perfect can be dangerous, as you point out. In our quest for perfection we can miss out on a lot of productivity gains. Readers, do you feel IT faces too much pressure to provide "perfect" mobile security?
More Than Half of Users Reuse Passwords
Curtis Franklin Jr., Senior Editor at Dark Reading,  5/24/2018
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11506
PUBLISHED: 2018-05-28
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer.
CVE-2018-11507
PUBLISHED: 2018-05-28
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. An attacker can trigger a long loop in image_load_pnm in image/image-pnm.cpp.
CVE-2018-11505
PUBLISHED: 2018-05-26
The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output.
CVE-2018-6409
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding ap_form table leads to a path traversal vulnerability via the download.php q parameter.
CVE-2018-6410
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.