Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

12/9/2013
09:06 AM
Mike Jennett
Mike Jennett
Commentary
100%
0%

Don't Be Overprotective About BYOD

Too many IT departments are putting a crimp in bring-your-own-device programs with overbearing security precautions.

If you are a parent today, you live your life in fear. Everything needs to be sanitized with 99.7% anti-bacterial soap. The corporate world isn't much different when it comes to bring-your-own-device (BYOD) policies. We have security and IT executives who are scared to death that viruses from the outside are going to walk in on their employees smartphones and attack their networks.

I understand the need for security and I have seen firsthand how networks can be taken down by errant viruses and attacks. However, many IT organizations are acting like frightened parents. Most of us who grew up prior to the millennial age lived in a world where eating dirt was just a way of setting yourself up for a healthy adulthood. That did not mean you skipped taking showers and covering your mouth when coughing, but you weren't followed around with a bottle of hand sanitizer.

When we look at the new world of BYOD, it isn't that much different. Yes, threats to security are out there, and yes, there are bad people hiding around the corners that wish to do your enterprise harm. Nevertheless, sanitizing every phone and keeping them out of your network just isn't feasible or even a healthy strategy. You need to balance the BYOD security risk and the potential gains.

[Want to learn more about mobile security? Read Android Security: 8 Signs Hackers Own Your Smartphone.]

Sure, you can treat your network like the boy in the bubble, but you'll be losing a great productivity tool and, possibly, some great employees. A prime example of this mentality was shown when IBM banned Siri on their employees’ phones. IBM had valid concerns about data security, but this could easily be seen as an over-reaction and lead employees to stick with their two-phone mentality (one supplied by the company for business use and one for personal use).

The key is to provide options for employees that will help protect corporate data without being overbearing. Rebecca Abrahams hits this topic on the head with her article "Gen Y Does Not Want to Hear About BYOD Security Measures." Abrahams acknowledges the importance of security in the mobile world, but she also emphasizes the need for balance and education.

The key is to show your employees that you trust them and that you aren't afraid that every little thing their mobile phone touches is going to bring down your network. A truly successful BYOD security implementation works in the background with little interference with the workings of the user. Just as you were taught to wash your hands and cover your mouth when you cough when you were a child, new employees need to be given the proper tools and knowledge to successfully protect themselves and their corporate data.

Easy steps employees can take can to protect themselves and their employer's data should be spelled out in a corporate BYOD policy. Some of the basics include requiring a PIN on devices and setting up encryption. These two steps are basic building blocks for securing phones and data.

So, when implementing BYOD, look at what you really need to be afraid of. A high-profile financial institution handling loads of money will need one level of BYOD security policies whereas a midsized business selling widgets won't need to look like Fort Knox. Be realistic as you go down the path to BYOD. Don't let perfect get in the way of good policies that will help make your employee more productive. Embrace the dirt while fighting the germs that need to be fought.

Mike Jennett is the Enterprise Mobility Deployment Program Director for Hewlett Packard where he is responsible for all aspects of the development, deployment, and integration of mobile apps and infrastructure for HP IT. He has an extensive background in mobility, web and enterprise application deployment.

IT groups need data analytics software that's visual and accessible. Vendors are getting the message. Also in the State Of Analytics issue of InformationWeek: SAP CEO envisions a younger, greener, cloudier company. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bubbajones4u4
50%
50%
bubbajones4u4,
User Rank: Apprentice
12/10/2013 | 4:45:59 PM
Overprotective BYOD
BYOD is a big test of trust in a corporate enviornment, and the question to data access and security between personal and business data is the $1 millon question. I agree, there is a thing as being overprotective, but in terms of data security I don't know if there is such a thing.

We were looking to bring in a larger MDM system for BYOD at our hospital, but the doctors (who own the hospital) felt it was to intrusive since they all wanted to use their own devices, but didn't want IT to have total control over them. Still, they wanted the ability to send HIPAA compliant patient info (mostly text messages) to admin and other doctors.

In the end, we changed our stratagy and started looking for individual apps to deal with the various security issues. Example: to allow for HIPAA text messaging, we got an app (Tigertext) which is HIPAA compliant, and installed it on all the doctors devices. It auto-deletes the messages after X period of time, and IT can still wipe the device if it is lost or stolen, but the doctors didn't feel it violated thier 'privacy' which made it acceptable to them. More info: www.tigertext.com
WKash
50%
50%
WKash,
User Rank: Apprentice
12/10/2013 | 10:14:43 AM
Re: The Problem With Perfect
CIOs will always face a yin and yang dllemma between the need for information access and the need to keep that information secure.  Walling off corporations from mobile dangers at the expense of productive uses of mobile is clearly not the anwer.  Neither is giving into BYOD demands simply to satisfy your workforce.  As most enlighted CIOs understand, the answer is in learning how to find the pathway to "Yes, we can, if we do x,y,z" instead of "No, we can't because of a,b,c."
Laurianne
100%
0%
Laurianne,
User Rank: Apprentice
12/9/2013 | 2:30:13 PM
The Problem With Perfect
Practical post. Focusing on perfect can be dangerous, as you point out. In our quest for perfection we can miss out on a lot of productivity gains. Readers, do you feel IT faces too much pressure to provide "perfect" mobile security?
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5613
PUBLISHED: 2020-02-18
In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec endpoint. Depending on the higher-level protocol in use over ipsec, this could allow an action to be repeated.
CVE-2020-7450
PUBLISHED: 2020-02-18
In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer over...
CVE-2019-10792
PUBLISHED: 2020-02-18
bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVE-2019-10793
PUBLISHED: 2020-02-18
dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVE-2019-10794
PUBLISHED: 2020-02-18
All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.