Byod (bring Your Own Device) In The Workplace

By Author: techframework
Total Articles: 2
Comment this article

Considerations for Putting BYOD Policies in Place

If your employees are allowed to connect their own cellphones or tablets to the company network, a strong Bring-Your-Own-Device (BYOD) policy is required to keep viruses, hackers, and data exfiltration at bay. Users' own devices can help spread viruses and worms, increase the attack surface by adding more potential entry points, and allow their owners to download and leave with sensitive, confidential company data.

Employees will be unaware of the company's expectations or what actions are prohibited if there is no clearly established BYOD policy. Employers must also make difficult judgments about how to manage their employees' personal devices and data.

Defining the parameters of usage

Before you can start developing a BYOD policy, you'll need to figure out how much access your employees will have to their personal devices when connected to the company network. The visitor and internal Wi-Fi networks are separated in some organizations. Assume that your employees are only permitted to use a visitor Wi-Fi connection, which allows them to access the ...
... Internet but not internal corporate resources. In that situation, your BYOD policy could be as basic as a sentence in the HR manual prohibiting personal devices from connecting to visitor Wi-Fi. If, on the other hand, employees will be permitted, if not encouraged, to use their personal devices for work-related purposes, you'll need a far more extensive policy.

What devices are permitted?

Your BYOD policy may need to contain constraints on the sorts of allowed devices for network connection, depending on how employees will use their devices.

Will your staff be able to access company software via their mobile devices? Is it possible that there will be compatibility concerns with mobile device operating systems? Are they optimized for usage on mobile devices, if so? Will your staff solely use their devices for work-related purposes, such as making and receiving phone calls and accessing business webmail? Because different devices have varied operating systems and capabilities, asking questions like these can help you figure out which devices should be permitted to connect, and which should not.

Security standards for devices

If you offer personal devices access to internal resources, be sure those devices aren't compromised with malware that could spread throughout your network. Employees who use their own devices at work should be required to install and maintain antivirus/anti-malware software.

Losing or stealing a portable gadget is a possibility. Automatic screen lock with a strong PIN or biometric verification, as well as difficult passwords and multifactor authentication for network access, should be necessary. There may be regulatory considerations to consider depending on your environment and the sensitivity of the data. Other security technologies, such as VPN software, may also be worth considering.

Will you provide personal device support?

Another thing to think about when creating your policy is whether and to what degree your company's IT team will support personal devices. Depending on the additional stress on your team, the response may lead you to limit the use of those devices.

If you decide to support these devices and their users, you'll need to set certain ground rules. Excluding hardware support entirely is a smart practice. So that no warranties are invalidated and your business is not held liable for any physical damage, hardware issues should be fixed by suppliers and those authorized to support personal devices.

Will users be able to put proprietary software on their devices if they work for your company? Will you provide application support for those devices if that's the case? What if the user has other apps loaded on the device that prohibit the proprietary program from running? Explain the problem and inform the user that it is their responsibility to uninstall the personal app so that they can use their device to run the company app or to use an other device. After all, it is the user's own device. If a disagreement arises, this fact can lead to a different set of problems.

Termination of employment and remote device wiping

As previously stated, these are personal gadgets that users pay for and maintain. Whether you intend to compel users to give you with remote wipe capability is perhaps the most important factor when establishing the extent to which personal device usage will be permitted. Users who are willing to pay for a device and then utilize it for the company's benefit may object vehemently to a policy that appears to penalize them for doing so.
While the company's webmail app may not save messages and attachments on the user's smartphone, other proprietary programs may. BYOD users may also be able to download files from corporate servers. What data can be downloaded and saved should be specified in your policy.

There's always the chance that a user will break a company policy on data storage. The potential repercussions of a violation of your BYOD policy should be stated explicitly. This should, if necessary, include erasing the user's device. This action would clear the company's data and erase all of the user's personal information, potentially resulting in heated debates for the reasons indicated previously. There's also something else to think about. Many personal devices are set to automatically backup to the cloud. What remedies would you have if you could wipe the user's device, but not the backed-up data?

Finally, whether it's voluntary or involuntary, you'll need to design a policy for terminating employees. Will you delete their personal information from their device? Is the employee going to be on hand to supervise the activity? What if the employee refuses to let the gadget be wiped?

To sum up

Allowing your employees to connect personal devices to the business network may need the implementation of policies that, depending on the level of access, may result in the deletion of their personal data in certain circumstances. Personal devices can also significantly increase your company's attack surface, increasing the risk of a data breach. Decisions about personal device usage should only be made after thorough analysis of the potential ramifications, for these and other reasons outlined herein.

About The Author: https://techframework.com

Managed IT Services and CyberSecurity Solutions. https://techframework.com