You Cannot Forbid To Bring: How To Implement The BYOD Concept And Not Harm Information Security

The ability to perform work tasks using their own gadgets is perceived by many as an element of freedom, a progressive approach to company-employee relationships, and generally a typical example of a win-win strategy. In general, there is no reason to doubt: the employee is happy to use equipment that he has chosen to solve problems, and the company receives an employee who is always in touch and does the work even after hours. According to Frost & Sullivan, BYOD adds up to 58 minutes a day to employees and increases productivity by 34%.

Despite all the advantages, BYOD gives rise to problems - problems of incompatibility and timely installation of security updates, theft and damage to personal devices. And this is only a small part of the headache that you have to endure in the name of convenience. We will talk about how to solve these problems while maintaining a balance between safety and efficiency, in this post.

BYOD
It stands for Bring Your Own Device, or "bring your device." In 2004, BroadVoice VoIP provider proposed connecting customers' equipment to its network and designated a method such as BYOD. In 2009, Intel “updated” the concept of BYOD, somewhat expanding its meaning. With a light hand, Intel began to mean the use by employees of companies of personal devices to solve business problems.

Since there is no strict definition of BYOD, different organizations may understand this concept in different ways. For example, some companies allow employees to use personal devices to solve work issues, but the employee incurs all communication and repair costs themselves. Other companies compensate for these costs or connect employees to a corporate contract.

Since in the case of BYOD, the company does not choose the devices that employees use, the compatibility problem is raised to its full potential. CYOD, another similar BYOD concept, allows eliminating it, at the same time solving financial and legal issues.

CYOD
The abbreviation CYOD stands for Choose Your Own Device - "choose your device." Under this concept, an employee can choose from the list of typical devices that will best allow him to solve his tasks. Depending on corporate policies, CYOD may allow or prohibit the use of corporate devices for personal use.

COPE
This term stands for Corporate-Owned, Personally Enabled and means that the devices selected by the employee are purchased by the company, but it is up to them to configure and maintain them. As a rule, COPE also implies the possibility of using the device for personal purposes.

POCE
POCE - Personally owned, company enabled, "purchased by an employee, authorized by the company." Essentially, this is just another name for BYOD.

Benefits of BYOD

For staff

• One device for personal and work tasks (if this does not contradict corporate policy),
• The ability to use the latest device models,
• Mobility,
• Flexible schedule,
• Remote work.

For the company

• Cost reduction - the company does not have to purchase devices for employees,
• Increasing employee motivation,
• Availability of employees after hours
• Higher efficiency in resolving urgent issues,
• Reduced need for office space.

Risks and threats BYOD
Risks associated with BYOD are a natural consequence of the benefits of the concept. The more freedom employees who use personal devices to interact with the network of the company get, the greater the potential damage they can cause.

Loss or theft of the device
If an employee loses the laptop on which he performed work for the company, this will create a lot of problems. Over time, corporate documents, including confidential ones, as well as documents containing personal data inevitably accumulate on the device. The leak of such information is likely to lead to fines, competitors or attackers can use them to blackmail or simply sell on the black market to cybercriminals who organize targeted or phishing attacks.
But in addition to documents, the device stores credentials for access to the corporate network and/or encryption keys recorded in the registry so as not to mess with tokens. Using this information, an attacker can penetrate the network, steal everything that he can reach, install malware.

Another problem is that an employee who is deprived of his working tool cannot do what he is paid for. And this issue needs to be resolved as quickly as possible. If a large corporation is likely to be able to pick up equipment from the reserve, one cannot count on such a luxury in a startup.

Vulnerabilities and Malware
Obviously, employees working according to the BYOD scheme will use their devices to solve not only work but also personal tasks. After completing the work, they will watch online videos, look for essays for children and play games downloaded from torrent trackers. And with non-zero probability, their children will do the same.

The result of such frivolity, as a rule, is not too inspiring: malware appears on the device - spyware, ransomware, and backdoors. When connected to a corporate network, the entire set of malware will look for new victims. And it is possible that he will find it. But even without this, stolen logins, passwords and details of corporate bank cards will not bring any benefit.

Even if the employee behaves responsibly, does not visit suspicious sites and does not download pirated software, the problem of phishing emails remains, as well as keeping the OS and programs up to date. Using well-known vulnerabilities, malware can infiltrate the device on its own or with minimal involvement of the user who clicked on the link in the letter, very similar to the usual letter of the counterparty.

Mobility as a problem The mobile
nature of the use of equipment within BYOD means not only an increased risk of losing your favorite gadget but also risks associated with confidentiality. Fans of working in coffee houses and other public places do not take into account the fact that:

they are in the field of view of strangers and video surveillance cameras, which means that the passwords that they enter and the documents they work with are made public by strangers;
the use of public Wi-Fi networks at airports and hotels carries the risk that the transmitted information will be intercepted or a malicious script will penetrate the device;
the active use of the mobile Internet in roaming can lead to financial losses.

How to protect yourself?
The risks posed by BYOD cannot be completely eliminated. But by combining organizational and technical measures, damage can be minimized or even completely eliminated. The main ways to ensure BYOD security are virtualization, the management of mobile devices, applications and data, as well as intelligent endpoint protection systems.

Virtualization
The beauty of this technology is that the user's device is used exclusively to gain access to the virtual workstation. All documents and programs are also located there and are not copied to the device. The service of virtual workplaces is carried out by IT specialists of the company, so all that is required of an employee is to keep secret the details for access to the corporate network. This will not help if spyware penetrates the device, but eliminates data leakage during the theft.

MDM, MCM, MAM and other mobile device management systems
Mobile device management systems allow you to centrally manage the entire BYOD zoo, setting restrictions on documents, on resources to which the user has access, and on operations that he can perform when connected to a corporate network.

For example, the Microsoft Intune tool supports devices based on Windows, macOS, iOS, Android and allows administrators to:

• Automatically delete corporate data if the device does not connect to the service within a specified time;
• Establish a ban on the storage of corporate information in any location other than "Onedrive for business";
• Request a pin or fingerprint to access office applications
• Prevent the copying of corporate data from office to personal applications.
• Similar solutions for managing mobile devices are offered by Apple (Apple MDM), Citrix - XenMobile, Cisco - Meraki, Trend Micro - Enterprise Mobile Security and several third-party manufacturers.

BYOD Protection
Even the most advanced controls will not help if the device gets into the device, therefore, in the case of BYOD, it is worthwhile to use XDR-class security solutions (X Detection and Response, where X corresponds to various corporate environments). Such systems can detect and help stop unknown threats, providing monitoring of all information systems in the enterprise. The approach to Trend Micro XDR includes the EDR subsystem (Trend Micro Apex One), which forms the multi-level protection of end devices, as well as network products of the Deep Discovery family, which allow detecting threats on nodes without security agents.

What is the result
Uncontrolled use of BYOD can create huge problems for companies. In order to fully feel all the advantages of using personal devices to solve business problems, it is necessary to take risks into account and protect the network perimeter and user devices. An additional level of protection will be provided by the development and implementation in the everyday practice of a security policy that users can focus on during their work.