Securing Your Company Against BYOD-Created Threats

Monday, May 14, 2012

Ashley Furness


The increasing emergence of Bring Your Own Device (BYOD) policies has both good and bad implications for business.

Employees get to use the device they device they are most comfortable with and employers enjoy increased productivity. But sensitive corporate data is very likely vulnerable to theft on employee-owned mobile devices.

Fortunately, help desk operators can take steps to fight back against these BYOD-created threats. Here are four strategies your company should implement to keep data secure, while supporting employees' choice to use their own laptops, smartphones and tablets in the workplace.

1. Encrypt All Data

Employees using public, often unencrypted Wi-Fi connections is one of the most significant and prevalent exposure points. In fact one study found 31 percent of corporate employees had used a laptop to connect to their company’s network through a public hotspot.

To curb this security risk, IT groups should distribute and manage Virtual Private Network (VPN) solutions for all mobile devices. These tools encrypt transmitted data regardless of where or how it is accessed through mobile devices.

2. Have a Plan for Lost or Stolen Devices

Brandon Hampton, a director for MOBI Wireless Management, describes stolen devices as a “worst case scenario.” He said IT teams should have a specific action plan in their BYOD policy for dealing with this contingency.

This should include such steps as changing email, Dropbox and other passwords if they were installed on the device. Also, BYOD-ers should agree to install remote wiping and locking tools. Hampton suggested using a mobile device management (MDM) solution.

3. Monitor and Control Network Use

Speaking of MDM, administrators should integrate these systems with help desk software. This will help agents watch for network bottlenecks and ensure compliance with BYOD policies.

Granting BYOD users network access on two or three devices is great for productivity, but this can also tax networks. An MDM can track in real time when a device signs in, what users access, and whether it’s configured with the appropriate security software.

Another option is a virtual desktop infrastructure (VDI) solution, which equips IT teams with tools for monitoring network, server and storage performance. It identifies a device causing a slowdown and automatically notifies an agent. Depending on the issue, they can then triage the issue to the appropriate response team.

4. Install Anti-malware/virus Infrastructure and Educate Users

Malware creation hit record highs last year with a reported 26 million new strains in circulation. This malicious software can wreak havoc on your company’s security if an infected smartphone, tablet or laptop is connected to your company’s network or email.

To combat these threats, IT teams should equip devices with anti-virus and anti-malware systems. These functions are sometimes wrapped into VPN or MDM software. Others can be installed separately to fight exposure to viruses, malware and spammers.

Experts also recommended help desks provide ongoing information on how to identify phishing techniques, poisonous apps and other virus-spreading tactics.

The New Help Desk Investment

All of these strategies add up to a significant shift in help desk operations and spending. The cost can seem daunting, but the decision now isn’t whether to make the investment but rather how much risk you are willing to take by doing nothing.

About the Author: Ashley Furness is the CRM Analyst at Software Advice—aonline resource for help des and CRM software buyers guides and more.

Possibly Related Articles:
General Policy
Information Security
Encryption Enterprise Security malware Security Strategies Access Control Virtualization Employees Policies and Procedures BYOD Mobile Device Management
Post Rating I Like this!
Spencer Parkinson I originally saw this post last week over on Software Advice. As I said in a comment over there, mobile application management is also an up and coming technology that is going to have big impact on how companies wrangle the security challenges associated with BYOD.

Spencer Parkinson
Marc Quibell I prefer the "Do not allow corporate data on personal devices" myself, such as your own personal laptop, phone..etc. If a company wants mobile devices for certain people, then issue them a company device. Otherwise you create a management nightmare. IMHO
Maureen Robinson Great tips, Ashley! You can read more about the risks to which a company is exposing itself by not implementing correctly a BYOD policy here:
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.