Mobile
12/9/2013
09:06 AM
Mike Jennett
Mike Jennett
Commentary
Connect Directly
RSS
E-Mail
100%
0%

Don't Be Overprotective About BYOD

Too many IT departments are putting a crimp in bring-your-own-device programs with overbearing security precautions.

If you are a parent today, you live your life in fear. Everything needs to be sanitized with 99.7% anti-bacterial soap. The corporate world isn't much different when it comes to bring-your-own-device (BYOD) policies. We have security and IT executives who are scared to death that viruses from the outside are going to walk in on their employees smartphones and attack their networks.

I understand the need for security and I have seen firsthand how networks can be taken down by errant viruses and attacks. However, many IT organizations are acting like frightened parents. Most of us who grew up prior to the millennial age lived in a world where eating dirt was just a way of setting yourself up for a healthy adulthood. That did not mean you skipped taking showers and covering your mouth when coughing, but you weren't followed around with a bottle of hand sanitizer.

When we look at the new world of BYOD, it isn't that much different. Yes, threats to security are out there, and yes, there are bad people hiding around the corners that wish to do your enterprise harm. Nevertheless, sanitizing every phone and keeping them out of your network just isn't feasible or even a healthy strategy. You need to balance the BYOD security risk and the potential gains.

[Want to learn more about mobile security? Read Android Security: 8 Signs Hackers Own Your Smartphone.]

Sure, you can treat your network like the boy in the bubble, but you'll be losing a great productivity tool and, possibly, some great employees. A prime example of this mentality was shown when IBM banned Siri on their employees’ phones. IBM had valid concerns about data security, but this could easily be seen as an over-reaction and lead employees to stick with their two-phone mentality (one supplied by the company for business use and one for personal use).

The key is to provide options for employees that will help protect corporate data without being overbearing. Rebecca Abrahams hits this topic on the head with her article "Gen Y Does Not Want to Hear About BYOD Security Measures." Abrahams acknowledges the importance of security in the mobile world, but she also emphasizes the need for balance and education.

The key is to show your employees that you trust them and that you aren't afraid that every little thing their mobile phone touches is going to bring down your network. A truly successful BYOD security implementation works in the background with little interference with the workings of the user. Just as you were taught to wash your hands and cover your mouth when you cough when you were a child, new employees need to be given the proper tools and knowledge to successfully protect themselves and their corporate data.

Easy steps employees can take can to protect themselves and their employer's data should be spelled out in a corporate BYOD policy. Some of the basics include requiring a PIN on devices and setting up encryption. These two steps are basic building blocks for securing phones and data.

So, when implementing BYOD, look at what you really need to be afraid of. A high-profile financial institution handling loads of money will need one level of BYOD security policies whereas a midsized business selling widgets won't need to look like Fort Knox. Be realistic as you go down the path to BYOD. Don't let perfect get in the way of good policies that will help make your employee more productive. Embrace the dirt while fighting the germs that need to be fought.

Mike Jennett is the Enterprise Mobility Deployment Program Director for Hewlett Packard where he is responsible for all aspects of the development, deployment, and integration of mobile apps and infrastructure for HP IT. He has an extensive background in mobility, web and enterprise application deployment.

IT groups need data analytics software that's visual and accessible. Vendors are getting the message. Also in the State Of Analytics issue of InformationWeek: SAP CEO envisions a younger, greener, cloudier company. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bubbajones4u4
50%
50%
bubbajones4u4,
User Rank: Apprentice
12/10/2013 | 4:45:59 PM
Overprotective BYOD
BYOD is a big test of trust in a corporate enviornment, and the question to data access and security between personal and business data is the $1 millon question. I agree, there is a thing as being overprotective, but in terms of data security I don't know if there is such a thing.

We were looking to bring in a larger MDM system for BYOD at our hospital, but the doctors (who own the hospital) felt it was to intrusive since they all wanted to use their own devices, but didn't want IT to have total control over them. Still, they wanted the ability to send HIPAA compliant patient info (mostly text messages) to admin and other doctors.

In the end, we changed our stratagy and started looking for individual apps to deal with the various security issues. Example: to allow for HIPAA text messaging, we got an app (Tigertext) which is HIPAA compliant, and installed it on all the doctors devices. It auto-deletes the messages after X period of time, and IT can still wipe the device if it is lost or stolen, but the doctors didn't feel it violated thier 'privacy' which made it acceptable to them. More info: www.tigertext.com
WKash
50%
50%
WKash,
User Rank: Apprentice
12/10/2013 | 10:14:43 AM
Re: The Problem With Perfect
CIOs will always face a yin and yang dllemma between the need for information access and the need to keep that information secure.  Walling off corporations from mobile dangers at the expense of productive uses of mobile is clearly not the anwer.  Neither is giving into BYOD demands simply to satisfy your workforce.  As most enlighted CIOs understand, the answer is in learning how to find the pathway to "Yes, we can, if we do x,y,z" instead of "No, we can't because of a,b,c."
Laurianne
100%
0%
Laurianne,
User Rank: Apprentice
12/9/2013 | 2:30:13 PM
The Problem With Perfect
Practical post. Focusing on perfect can be dangerous, as you point out. In our quest for perfection we can miss out on a lot of productivity gains. Readers, do you feel IT faces too much pressure to provide "perfect" mobile security?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If you’re still focused on securing endpoints, you’ve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3352
Published: 2014-08-30
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, related to an "iFrame vulnerability," aka Bug ID CSCuh...

CVE-2014-3908
Published: 2014-08-30
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2010-5110
Published: 2014-08-29
DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

CVE-2012-1503
Published: 2014-08-29
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.

CVE-2013-5467
Published: 2014-08-29
Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Monitoring Server (ms) and Shared Libraries (ax) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM)...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.