BYOD. Outline. Steven Aiello. Tatiana Melnik. Outline. B.Y.O.D Movement Natural Evolution

Transcription

1 Ouline BYOD LEGAL & TECHNICAL IMPLICATIONS Online Tech Webinar - November Inroducion Overview of BYOD Legal Concern and Drafing Conideraion Technical Iue and Conideraion Queion RESSED IN THIS PRESENTATION ARE THOSE OF THE AUTHORS AND DO OR THEIR CLIENTS. SSARILY REPRESENT OFFICIAL Taiana Melnik Seven Aiello Aorney helping clien proec heir daa and he daa oher enru o hem Focu on healhcare IT informaion echnology daa privacy and ecuriy and inellecual propery HIT columni for he Journal of Healh Care Compliance Managing Edior for he Nanoechnology Law & Buine Journal JD BS in Informaion Syem BBA in Inernaional Buine Sr Produc Online Tech 15 year experience managing IT in he healhcare and financial ecor Bachelor in Technology Managemen Maer of Science wih a focu on informaion aurance Cerificaion Include CISSP CISA VCP CCNA Ouline B.Y.O.D Movemen Naural Evoluion Inroducion Overview of BYOD Legal Iue and Drafing Conideraion Technical Iue and Conideraion Queion 88% of US adul are cell phone owner (PewInerne, March 2012) 46% of hoe adul own mar phone Forbe: The primary buine driver i geing work done. Buine uer do no wan o compromie. They wan convenience. They wan o be able o do he work wihou being ehered o heir lapop. People deerve and demand a grea uer experience. & 1

2 B.Y.O.D Movemen Single / Dual Ue B.Y.O.D Movemen Co Saving Mobile device hif From ingle ue one for work one for peronal To dual ue one device for boh work and peronal Why? Convenience Increaed inegraion of work and peronal live Le mainenance (one phone v wo phone) Co aving Cae Sudy: Equal Employmen Opporuniy Commiion In 2011 EEOC budge for mobile device BlackBerry) = $800K In 2012 Budge reduced o $400K Queion? How do you reduce expene? B.Y.O.D Movemen Co Saving B.Y.O.D Movemen Co Saving Two-pronged approach o reduce expene Negoiae wih wirele carrier Saved $240K Implemen a BYOD program BYOD wa a good opion becaue here wa a more efficien ue of reource 75% of our uer never made phone call from heir BlackBerry i he killer app. They eiher ued he phone on heir dek or hey ued heir peronal cell phone o make call becaue i ju eaier. We alo found here were a number of zero-ue device. People have hem parked in heir dek drawer, and he only ime hey ue i i when hey ravel. - Kimberly Hacher CIO U S Equal Employmen Opporuniy Commiion (EEOC) BYOD Pilo B.Y.O.D Movemen Employee Saifacion B.Y.O.D Movemen Employee Saifacion & Seven Muli-vendor / Android Open ource open ecoyem No vendor lock in Taiana Apple / IOS Cloed ecoyem Le ineroperabiliy concern Le ecuriy concern Of mobile malware ample 97% of hoe are for he Android plaform. Source McAfee Mobile Malware Growh Con nuing in 2013 Feb Mobile Vulnerabiliie by Plaform Source Source Symanec Inerne Securiy Threa Repor 2012 Trend vol 18 Pub. April

3 B.Y.O.D Movemen Srong Suppor B.Y.O.D Movemen Srong Suppor Recognizing he proliferaion of mobile echnology, HHS ha rongly advocaed for uing mobile device Improving public healh oucome drive down healhcare co Helping wih chronic dieae managemen Reminding people o ake medicaion Reaching rural area Empowering individual hrough educaion Communiy Parnerhip Tex4Baby Many parner (communiy and governmen healh org wirele carrier buinee) Free ex meage o women (i) who are pregnan or (ii) whoe babie are < 1 yr old Provide hem wih reminder and oher informaion aimed a improving heir healh and he healh of heir babie B.Y.O.D Iue Securiy challenge B.Y.O.D Iue Securiy challenge Peronal device plugged ino corporae compuer yem via USB Peronal device connecing o corporae Wi-Fi nework NAC or MAC filering for corporae acce poin VPN acce i alway wie even for corporae Wi-Fi nework Daa exfilraion & daa hef from lo of olen device App icaion like office reader on phone Dropbox ued o ync documen from a work lapop o a peronal phone Poenially eniive corporae lef on phone Mobile Threa in 2012 Source Source Symanec Inerne Securiy Threa Repor 2012 Trend vol 18 Pub. April 2013 Ouline B.Y.O.D Iue Legal Concern Inroducion Overview of BYOD Legal Concern and Drafing Conideraion Technical Iue and Conideraion Queion Compliance concern Healhcare finance inurance highly regulaed Compliance wih inernal conrol o proec confidenial informaion Breach Noificaion law Daa Derucion law Liigaion Hold Where i your daa? Wage and Hour law Malpracice iue (docor aorney) 3

4 B.Y.O.D Iue Legal Concern B.Y.O.D Iue Legal Concern Privacy & ecuriy iue currenly mo prominen concern Numerou daa breache reuling from lo/olen lapop and USB drive Daa breache from device old on ebay Craigli ha are no properly wiped Indury Example: Healhcare Legilaor raied concern wih uing mobile device for healhcare Safey Securiy Reliabiliy of he nework infrarucure Numerou agencie evaluaing iue FDA FCC NIST (Dep. of Commerce) FTC Office of Civil Righ (HHS) Sae legilaor and regulaor are alo paying aenion California i paricularly acive (hp //oag.ca.gov/privacy/privacy-law) B.Y.O.D Corporae Mauriy B.Y.O.D Policy Drafing Conideraion Differen rule for mall companie v big companie? Office of Civil Righ Fine are deigned o end a meage In addiion here could be cla acion law uie Liigaion i expenive Generally no Bu penalie may be differen Regulaory agencie do generally ake abiliy a company ab liy o pay no accoun Small company pay a f ne of $100K v. large company pay a f ne of $1.5M per inc den per year Bu boh pay omehing. Why have a policy? To proec your clien / cuomer / paien' righ To inill profeionalim hroughou your enerprie To proec your organizaion from liabiliy To proec your employee from liabiliy B.Y.O.D Policy Drafing Conideraion B.Y.O.D Policy Drafing Conideraion Regulaor are focuing on mobile device! OCR Acion Sae daa breach law GLBA/FTC Safeguard Rule PCI DSS FDA mobile medical device/app California encrypion mandae Many Policie Affec BYOD Accepable Ue Policie Securiy Policie (e.g. paword encrypion) Social Media Policy Remoe Acce Policy Liigaion Hold Policy Remoe Working Policy (over 40 hour/wk?) Inciden Repone Policy Breach Noificaion Policy Privacy Policie 4

5 B.Y.O.D Policy Drafing Conideraion B.Y.O.D Policy Drafing Conideraion Wha Kind of Iue Should a Dicree BYOD Policy Addre? hp // org/reading room/whiepaper/pda/ecuriypolicy-handheld-device-corporae-environmen_32823 Incorporae oher relaed policie by reference (e.g. privacy accepable ue ocial media ec ) Include he righ eam Senior managemen (reource iniuional uppor) Chief IT officer (e he raegic direcion including policy) IT aff (implemen raegy/policy) Legal/Regulaory (ubjec maer experie/enforcemen) Human reource (enforcemen) B.Y.O.D Policy Drafing Conideraion B.Y.O.D Policy Drafing Conideraion Policie are cied by regulaor and plainiff aorney When FTC evaluae privacy complain from conumer i look o he company privacy policy Charge brough under Secion 5 of he FTC Ac - bar unfair and decepive ac and pracice (plu 33 oher law rule and guide providing he FTC wih enforcemen auhoriy o proec conumer privacy) A of May he FTC ha brough 32 legal acion again organ zaion ha have violaed conumer privacy righ or miled hem by failing o maina n ecuriy for eniive conumer informaion. A of May he FTC ha brough 32 legal acion again organizaion ha have violaed conumer privacy righ or miled hem by failing o mainain ecuriy for eniive conumer informaion. 32 doen ound like a lo doe i? Maybe bu conider when he FTC ake acion mo companie ener ino a conen agreemen where hey agree o 20 YEARS of hird pary audi The reporing period for he Aemen hall cover 1) he fir one hundred and eighy (180) day afer ervice of he order for he iniial Aemen and (2) each wo (2) year period hereafer for weny (20) year afer ervice of he order for he biennial Aemen. Agreemen w h Compee Inc. Cbr Syem Inc. and oher B.Y.O.D Policy Implemenaion B.Y.O.D Policy Implemenaion Review policie and procedure on a regular bai Quarerly ign off and annual review Lack of diligence on he par of corporae officer I your company echnically maure enough o enforce he policie i wriing? Wha i he ecuriy povery line? hp://451reearch com/1r-inigh-living-below-heecuriy-povery-line 5

6 B.Y.O.D Policy Implemenaion B.Y.O.D Policy Implemenaion Mobile device encrypion Pa code requiremen Enforce creen lock imer Enforce no jail broken phone Enforce an enrollmen yem for remoe wipe Enforce applicaion and OS updae policie Log review ylog neflow daa ec Correlaion i hard and uually VERY expenive B.Y.O.D Daa Securiy B.Y.O.D Daa Delivery Daa claificaion: no everyhing ha he ame value o eparae i Daa iolaion: you can proec everyhing o eparae i Applicaion Delivery via Microof Terminal Server Service Maure echnology Well underood eay o uppor Many clien available Work very well for able B.Y.O.D Daa Delivery B.Y.O.D Daa Delivery Key o proecing your daa VPN ry and keep ervice off he open Inerne 2 Facor Auhenicaion Ue i no excue i lierally free for mall buinee Srong encrypion: Baked in wih new operaing yem Window XP end of life April (exended uppor) 6

7 B.Y.O.D Daa Delivery B.Y.O.D Cae Sudy: Healhcare Talk abou echnical oluion for delivering daa o BYOD Advanced - VMware Maachue Eye and Ear Infirmary Daa breach: Feb docor lapop olen during a lecure our in Souh Korea Impaced daa of abou reearch paricipan Repor o OCR (HITECH): April OCR Inveigaion Iniiaed: Ocober B.Y.O.D Cae Sudy: Healhcare B.Y.O.D Cae Sudy: Healhcare Maachue Eye and Ear Infirmary Pre Releae announcing reoluion: Sepember Almo 2 year! Financial penaly: $1.5 million Correcive Acion Plan: 3 year of monioring Wha did OCR find problemaic? MEEI did no demonrae ha i conduced a horough analyi of he rik o he confidenialiy of ephi on an on-going bai [and] did no fully evaluae he likelihood and impac of poenial rik o he confidenialiy of ephi mainained in and ranmied uing porable device Securiy meaure were no ufficien o enure he confidenialiy of ephi ha i creaed, mainained, and ranmied uing porable device o a reaonable and appropriae level B.Y.O.D Cae Sudy: Healhcare B.Y.O.D Cae Sudy: Healhcare Wha did OCR find problemaic? MEEI did no adequaely adop or implemen policie and procedure o: 1. addre ecuriy inciden idenificaion reporing and repone 2. reric acce o auhorized uer for porable device 3. provide i wih a reaonable mean of knowing wheher or wha ype of porable device were being ued o acce i nework 4. receip and removal of porable device ino ou of and wihin he faciliy Wha did OCR find problemaic? MEEI did no adequaely adop or implemen echnical policie and procedure o allow acce o ephi uing porable device only o auhorized peron or ofware program MEEI had no reaonable mean of racking non-meei owned porable media device conaining i ephi ino and ou of i faciliy or he movemen of hee device wihin he faciliy 7

8 B.Y.O.D Cae Sudy: Healhcare Diclaimer Wha did OCR find problemaic? MEEI did no implemen an equivalen reaonable and appropriae alernaive meaure o encrypion ha would have enured confidenialiy of i ephi or documen he raionale upporing he deciion no o encryp Thi preenaion i informaional only. I doe no coniue legal or profeional advice. You are encouraged o conul wih an aorney if you have pecific queion relaing o any of he opic covered in hi preenaion. Conac Deail Upcoming Online Tech Even Pleae feel free o conac u wih queion: Taiana Melnik melnik@melniklegal com (734) www melniklegal com Seven Aiello aiello@onlineech com (734) www onlineech com/whiepaper Indiana Healhcare Sympoium Indianapoli IN November TechTomorrow 2013 Columbu OH November Deroi CIO Summi Novi MI November mhealh Summi Wahingon DC December