Mobile
12/9/2013
09:06 AM
Mike Jennett
Mike Jennett
Commentary
Connect Directly
RSS
E-Mail
100%
0%
Repost This

Don't Be Overprotective About BYOD

Too many IT departments are putting a crimp in bring-your-own-device programs with overbearing security precautions.

If you are a parent today, you live your life in fear. Everything needs to be sanitized with 99.7% anti-bacterial soap. The corporate world isn't much different when it comes to bring-your-own-device (BYOD) policies. We have security and IT executives who are scared to death that viruses from the outside are going to walk in on their employees smartphones and attack their networks.

I understand the need for security and I have seen firsthand how networks can be taken down by errant viruses and attacks. However, many IT organizations are acting like frightened parents. Most of us who grew up prior to the millennial age lived in a world where eating dirt was just a way of setting yourself up for a healthy adulthood. That did not mean you skipped taking showers and covering your mouth when coughing, but you weren't followed around with a bottle of hand sanitizer.

When we look at the new world of BYOD, it isn't that much different. Yes, threats to security are out there, and yes, there are bad people hiding around the corners that wish to do your enterprise harm. Nevertheless, sanitizing every phone and keeping them out of your network just isn't feasible or even a healthy strategy. You need to balance the BYOD security risk and the potential gains.

[Want to learn more about mobile security? Read Android Security: 8 Signs Hackers Own Your Smartphone.]

Sure, you can treat your network like the boy in the bubble, but you'll be losing a great productivity tool and, possibly, some great employees. A prime example of this mentality was shown when IBM banned Siri on their employees’ phones. IBM had valid concerns about data security, but this could easily be seen as an over-reaction and lead employees to stick with their two-phone mentality (one supplied by the company for business use and one for personal use).

The key is to provide options for employees that will help protect corporate data without being overbearing. Rebecca Abrahams hits this topic on the head with her article "Gen Y Does Not Want to Hear About BYOD Security Measures." Abrahams acknowledges the importance of security in the mobile world, but she also emphasizes the need for balance and education.

The key is to show your employees that you trust them and that you aren't afraid that every little thing their mobile phone touches is going to bring down your network. A truly successful BYOD security implementation works in the background with little interference with the workings of the user. Just as you were taught to wash your hands and cover your mouth when you cough when you were a child, new employees need to be given the proper tools and knowledge to successfully protect themselves and their corporate data.

Easy steps employees can take can to protect themselves and their employer's data should be spelled out in a corporate BYOD policy. Some of the basics include requiring a PIN on devices and setting up encryption. These two steps are basic building blocks for securing phones and data.

So, when implementing BYOD, look at what you really need to be afraid of. A high-profile financial institution handling loads of money will need one level of BYOD security policies whereas a midsized business selling widgets won't need to look like Fort Knox. Be realistic as you go down the path to BYOD. Don't let perfect get in the way of good policies that will help make your employee more productive. Embrace the dirt while fighting the germs that need to be fought.

Mike Jennett is the Enterprise Mobility Deployment Program Director for Hewlett Packard where he is responsible for all aspects of the development, deployment, and integration of mobile apps and infrastructure for HP IT. He has an extensive background in mobility, web and enterprise application deployment.

IT groups need data analytics software that's visual and accessible. Vendors are getting the message. Also in the State Of Analytics issue of InformationWeek: SAP CEO envisions a younger, greener, cloudier company. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bubbajones4u4
50%
50%
bubbajones4u4,
User Rank: Apprentice
12/10/2013 | 4:45:59 PM
Overprotective BYOD
BYOD is a big test of trust in a corporate enviornment, and the question to data access and security between personal and business data is the $1 millon question. I agree, there is a thing as being overprotective, but in terms of data security I don't know if there is such a thing.

We were looking to bring in a larger MDM system for BYOD at our hospital, but the doctors (who own the hospital) felt it was to intrusive since they all wanted to use their own devices, but didn't want IT to have total control over them. Still, they wanted the ability to send HIPAA compliant patient info (mostly text messages) to admin and other doctors.

In the end, we changed our stratagy and started looking for individual apps to deal with the various security issues. Example: to allow for HIPAA text messaging, we got an app (Tigertext) which is HIPAA compliant, and installed it on all the doctors devices. It auto-deletes the messages after X period of time, and IT can still wipe the device if it is lost or stolen, but the doctors didn't feel it violated thier 'privacy' which made it acceptable to them. More info: www.tigertext.com
WKash
50%
50%
WKash,
User Rank: Apprentice
12/10/2013 | 10:14:43 AM
Re: The Problem With Perfect
CIOs will always face a yin and yang dllemma between the need for information access and the need to keep that information secure.  Walling off corporations from mobile dangers at the expense of productive uses of mobile is clearly not the anwer.  Neither is giving into BYOD demands simply to satisfy your workforce.  As most enlighted CIOs understand, the answer is in learning how to find the pathway to "Yes, we can, if we do x,y,z" instead of "No, we can't because of a,b,c."
Laurianne
100%
0%
Laurianne,
User Rank: Apprentice
12/9/2013 | 2:30:13 PM
The Problem With Perfect
Practical post. Focusing on perfect can be dangerous, as you point out. In our quest for perfection we can miss out on a lot of productivity gains. Readers, do you feel IT faces too much pressure to provide "perfect" mobile security?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If you’re still focused on securing endpoints, you’ve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web