Taking Charge with Apps, Policy, Security and More. October 2, 2010 Hilton Alexandria Mark Center Alexandria, Virginia

Transcription

1 Taking Charge with Apps, Policy, Security and More October 2, 2010 Hilton Alexandria Mark Center Alexandria, Virginia

2

3

4 vs.

5 NSFW PSFW

6 NSFW Security & Compliance NETWORK: Existing security weaknesses? REMOTE ACCESS : Who uses? What for? LEGAL: Existing compliance regs? Know This! PSFW SFW SEC POLICIES: Encryption, pwd, breach? Compared to mobile? SEC TOOLS: Computer trespass? Net intrusion? AUTHENTICATION: ActiveSync, Citrix, other? Know Do This! This! VPN: Separate mobile VPN? WiFi: Improve mobile workspace? Expand signal? Separate network? MDM: Support group policies? Sunset legacy auth protocols?

7 Business Policies & Procedures NSFW PSFW SFW QUALIFICATION: Who qualifies for corp phones? BYOD? TECH SUPPORT: Who will support the end user? USER TRAINING: Who will train end users? How? SELECTION: Which devices will be supported? Why? PROCESS: How will employees apply for BYOD? What medium? POLICY: Acceptable use? Employee privacy? FINANCE: Stipend vs. reimbursement? Cont. telco contracts? CONTRACTS: Additional T s & C s? Employee use agreement? ROLLOUT: Communication plan? Legacy support?

8 Backend Support & Diversity NSFW PSFW SFW COMPATIBILITY: Resources that rely on IE/Flash/Silverlight/Java? BANDWIDTH: How much is enough? ADMIN TRAINING: Familiarity w/byod devices and management? IT CAPABILITIES: Remote wipe? Remote control? Self enrollment? IT SERVICES: /contacts/calendar, duh. Expense reports? SUPPORT PROCEDURES: Reuse existing call center? Tiered support? APPS: Sanctioned only? White or blacklist? Internal app store? CLOUD: Access internal file share? Put it on Google Docs? Dropbox? DEVELOPMENT: Architecture standards? HTML5 vs. Native? SSO?

9 3 2 1 BYOD Strategy Checklist Quick Reference Security & Compliance Bus. Policies & Procedures Backend Sup. & Diversity Network Security Qualification Backend Compatibility Remote Access Support Policy Bandwidth Availability Legal/Compliance User Training Administrator Training Security Policies Device Selection IT Capabilities & Controls Security Tools Application/Enroll Process IT Services & Offerings Authentication Computer Use Policies Support Procedures VPN Access Financial Strategy & Costs Apps Availability Mobile Workplace & WiFi Employee Use Agreement Cloud Availability MDM Approach Rollout/Comm Plan Development

10 BYOD Strategy Checklist Deliverables Security & Compliance Bus. Policies & Procedures Backend Sup. & Diversity Network Security Policy (update) BYOD Security Strategy (new) Vendor Assessments (incl. MDM new) Security Architecture Integration Standards (update/new) Computing Acceptable Use Policy (update) End-User BYOD Training Materials (new) BYOD Application Form (new) BYOD Communication & Rollout Plan (new) Device Management Profiles (update/new) Administrator BYOD Training Materials (new) App Development Architecture Standards (update/new) BYOD Procurement Process/Workflow (update/new)

11 The First 30 Days Enrolled Devices Other Android iphone ipad 290 devices enrolled in first 30 days Pended Devices Other 4 19% 79% 67% 2% 12% Android ios 57 7 (12%) Mostly unapproved models 10 (4%) Mostly jailbroken Enrolled Pended

12 Privacy Policy Considerations An employee s election of having their personal device authorized for some limited work purposes should not open the door to infringing on what would otherwise be private on their personal device. [Company] cannot monitor employee personal SMS text messages or personal phone calls. [Company] cannot go into employee personal non-company-related applications to check on what they are doing e.g. Facebook. This would apply when employees are audited for adherence to company policies No remote review of an employee s personal voic s, s or other personal application information

13 Employee Use Agreement Terms (Sample) Critical Terms in the Employee Use Agreement: This allows for protection against computer trespass, invasion of privacy and other claims Employee agrees to [Company s] use of remote wipe technology to wipe company data Employee agrees to [Company s] monitoring of personal device when connected to the corporate network Employee agrees to produce the personal device for inspection in response to legitimate requests Employee agrees to release [Company] from any liability for destruction, or incidental viewing, of personal information Employee shall install corporate security package as per [Company s] requirements and will not modify corporate security package without appropriate notification Employee agrees to immediately report loss or theft of device Employees will not store any PHI on their devices and will adopt to strong data encryption technologies and will limit storage of [Company] information on their devices or to their cloud accounts Employee acknowledges that all company policies apply to the dual-use devices at all times Employees to agree to reimbursed for their usage up to an amount as specified by Procurement Dept.

14 Thank You! Seth A. Kaplan CTO, Molina Healthcare, Inc. (Questions?)