BYOD: Smartphones and tablets have become a natural extension of how we live and work, Your Guide to Complete Mobile Security. BYOD is Here to Stay

Transcription

1 BYOD: Your Guide to Complete Mobile Security BYOD is Here to Stay By Bill Hurley, Executive Vice President and Chief Technology Officer, Westcon Group with contributions from BlueCat and Fiberlink Smartphones and tablets have become a natural extension of how we live and work, blurring the lines between our work life and our personal life. Today s tech-savvy workers have personal devices such as iphones, ipads, Android, Windows Phones and Blackberry smartphones, and expect to be able to connect those devices to the corporate network. Moreover, various studies have shown that employees who are able to choose the type of devices they use for work tend to be happier, more engaged and productive. This Bring Your Own Device (BYOD) movement is transforming the way organizations interact with consumers, trading partners, supply chain partners, contractors and consultants. Despite the benefits of BYOD, many IT departments have legitimate concerns about security and compliance, as well as the added IT effort involved in registering, enrolling and tracking devices. The challenge is how to secure the network and critical corporate data, while allowing employees and contractors to use their own devices. Organizations that attempt to put a No BYOD here policy in place only force users to find other ways to get their devices onto the network beyond the visibility and control of IT. To make BYOD work, organizations need to find the right balance between simplicity and security. BYOD users must be able to quickly and easily register and enroll a device anywhere, anytime without overwhelming IT staff. If the device on-boarding process isn t simple, business users will either shy away from using their device or find ways to circumvent security policies, exposing the organization to compliance risks. The experience of getting a device onto the network should be as simple for non-technical users as the hotel guest Wi-Fi experience. Likewise, IT administrators need simple, automated solutions that reduce the burden of defining and enforcing BYOD policies and managing devices. BYOD requires a new way of thinking about network access and device security. While many organizations mobile security initiatives have focused on the end-point, securing devices with a mobile device management solution (MDM), a comprehensive mobile security strategy must integrate both network and device security into a unified solution that does not require major changes to the existing network infrastructure. Time to value POWERED BY In fact, 59% of firms now officially support personally owned smartphones to some extent which can achieve financial and user satisfaction objectives simultaneously. On one hand, your C-level executives will like the cost savings benefits from personally owned devices. On the other, it will help retain and attract top job talent especially those empowered workers who want and expect to use the devices they re comfortable with to be productive. Forrester Research, Market Overview: Cloud-Hosted Mobile Device Management Solutions and Managed Services, January 3, 2012 BYOD: Your Guide to Complete Mobile Security 1

2 is a significant consideration. BYOD is happening now. If the BYOD on-boarding process requires a lengthy and costly network overhaul, IT will not be able to respond to the needs of the business within an appropriate timeframe. This guide outlines how organizations can avoid the risks of unmanaged BYOD and get devices onto the network quickly, efficiently and securely by addressing BYOD management and security at the network and device level. We will identify the key requirements for a complete mobile security solution and look briefly at BYODShield, a unique solution from Westcon that delivers network and device security in a single, easy-todeploy package. Integrating industry-leading workforce mobility and security technologies, BYODShield protects both network and corporate data, and dramatically simplifies management for BYOD and corporate devices without requiring organizations to re-architect their networks. Four Guidelines for Effective BYOD When planning and implementing a BYOD strategy, there are four guidelines that organizations should consider to help remove the barriers to successful BYOD adoption, and achieve the right balance of simplicity and security. These four practices will help organizations design an effective BYOD policy that is realistic, completely secure and easy to manage. 1. Make It Simple When it comes to BYOD, simplicity is the key for both users and administrators. BYOD is about empowering users with instant network connectivity, while at the same time reducing the burden on IT of having to manually register, track and secure devices. An effective BYOD solution makes it simple for users to register and enroll their own devices, and simple for administrators to manage devices, maintain security policies and control network access. Simple for BYOD Users BYOD users expect immediate access to the network. The device on-boarding process getting a new device onto the network should be fast, intuitive and transparent for nontechnical users and guests. To deliver the responsiveness that users demand, organizations simply cannot make IT responsible for manually reviewing each request for device and system access. Moreover, if basic mobile device management issues get in the way of users productivity, they will overwhelm the helpdesk with calls or find ways to bypass mobile security policies altogether. BYOD by the Numbers îone î billion consumers will have smartphones by 2016 îin î 2016, 350 million employees will use smartphones 200 million will bring their own îemployees î pay for 70% of the tablets used for work îmobile î spend will reach $1.3 trillion as the mobile apps market reaches $55 billion in 2016 îbusiness î spending on mobile projects will grow 100% by 2015 Forrester Research, Mobile Is The New Face Of Engagement, February 13, 2013 attempting to connect an unknown device to the network is automatically redirected to a secure self-service Web portal where they must first register then enroll their device. Users are authenticated based on their existing network credentials. Behind the scenes, a lot has to happen at both the device and network level to deliver a simple user experience. Once a device is registered and enrolled, it is automatically connected to the corporate network. Mobile device management (MDM) then performs functions such as over-the-air configuration, security policy enforcement, and application distribution all transparently while the device is being used by its owner. The self-service portal insulates BYOD users from these backend complexities of network connection and mobile device management. Users and guests are empowered to connect their personal consumer devices to the network in just a few easy steps, without compromising security and compliance. Self-service also effectively eliminates the need for IT staff to be involved in the device on-boarding process. Fast and intuitive self-service device registration and enrollment is an essential first step for effective BYOD. A self-service portal allows users to register and enroll their own personal devices in order to access the network. The process is simple: Any user BYOD: Your Guide to Complete Mobile Security 2

3 Simple for Administrators For IT administrators, the first challenge of BYOD is how to quickly and simply get devices onto the network without making changes to the network infrastructure or overburdening network operations, central IT and helpdesk staff with manual device provisioning requests. A self-service portal reduces the load on IT by simplifying and automating BYOD registration, enrollment and on-boarding. However, there are other administrative functions that need to be simplified and automated to help IT cope with the influx of personal mobile devices, including: Half of all global information workers are using three or more devices for work, but IT doesn t see it. Forrester Research, Info Workers Using Mobile and Personal Devices for Work Will Transform Personal Tech Markets, February 22, 2012 îîbyod policy definition including granular device and network policies îîworkflow and task delegation to allow IT support for the BYOD environment and common tasks to be efficiently distributed to the appropriate groups, such as helpdesk or local administrators îîautomatic device tracking and auditing with the ability to link device users and IP activity for security, compliance and reporting îînetwork and device control including device quarantining and DNS blacklisting to manage application access It is worth noting that ongoing administrative effort associated with BYOD is much higher than with corporate devices due to the nature of consumer devices. Corporate-owned devices tend to be refreshed every 3-5 years, whereas the refresh cycle for personal consumer devices is much more frequent, as users tend to replace their personal devices every 1-2 years. This means that users will add new personal devices to connect to the network at a much faster rate than corporate devices. While corporate devices are typically a uniform type and version, BYOD devices are much more heterogeneous. This means your BYOD solution must also support a broad combination of device types and software versions. BYOD makes selfservice, workflow and automation a must in order to reduce the continuing IT costs and effort required to manage BYOD. 2. Make It Secure Many IT professionals fear that opening the network to BYOD will mean that anyone can bring a device onto the network and start accessing resources without proper verification and control. The concern is that IT staff will lose control of network security and unknown or rogue personal devices will put the organization and its sensitive data at risk. This is where a complete mobile security approach that addresses both the network and the device comes in. By implementing an MDM solution with integrated self-service BYOD registration and enrollment, organizations can require that users first self-register their devices before they can access the network. Users attempting to access the network with an unknown device are automatically redirected to a simple selfservice portal where they can quickly register the device using their existing network credentials. Unknown users are simply not allowed to register their device or access the corporate network. Once authenticated, the user is granted immediate access to the network, and IT is able to track the device and view the relationship between the device, its user and IP activity. By choosing an MDM solution with integrated network security and device enrollment, there are no gaps in visibility and control. A BYOD user simply cannot access the network without first registering and enrolling his or her device. Immediately upon registration and enrollment, the device is instantly and automatically tracked from the moment it is on the network to the moment it is off. This makes device registration a valuable first line of defense in securing the network. With a modern MDM solution that integrates network security and enrollment, organizations can rest assured that they have a comprehensive solution in place to help manage lost or stolen personal devices, as well as devices belonging to former employees. 3. Make It Visible When it comes to unknown or rogue devices on the network, what you can t see can hurt you. If you can t see a device on the network, you can t track it, which can expose an organization to significant liability. To secure corporate data and avoid the risk of unknown devices, organizations need to be able to view and control three key elements: the user, the device (e.g. its MAC address) and the IP address. In order to connect these three key elements, mobile device management and security must be tightly integrated with IP Address Management (IPAM) and DNS/DHCP core network services. When MDM is integrated with the IP and core services infrastructure, devices can be tracked, managed and audited from the moment they are first on-boarded to when they are finally off-boarded to provide complete network and device control. Organizations have a single, unified solution to provision and track all devices on the network, including mobile devices, data center servers, virtual machines, and cloud assets. They also gain actionable mobile intelligence to help them better control the network and devices. BYOD: Your Guide to Complete Mobile Security 3

4 Without this level of visibility and actionable intelligence, it can be difficult or even impossible to identify who did what on the network and when. Once the link between personal devices, users and IP activity is in place, control over BYOD can be achieved and internal or external compliance can be easily demonstrated. Network administrators can also make more efficient use of their network infrastructure and wireless resources by: îîlimiting the number of devices a user can register to conserve bandwidth îîinstantly identifying devices on the network and linking these devices back to users îîenabling efficient use of corporate IP addresses and network infrastructure îîtracking all IP addresses used by a particular device as it moves about the network Most organizations have internal security policies that require compliance reporting and auditing. Many industries are also heavily regulated and require auditing to demonstrate compliance with external regulations. The ability to track and audit devices and users on the network is essential in the event of a security incident where reporting and auditing can be used to determine who was responsible for an issue. To address the compliance challenges of BYOD, organizations should consider an MDM solution that: îîrequires BYOD users to first register and enroll their device before they can gain network access îîleverages open-standard directory technology (LDAP) to perform user lookups against well-known and authoritative sources of user data (including Microsoft Active Directory). îîreduces user permission management by eliminating the need to replicate user data to the device registration solution. îîemploys encryption to ensure the authentication process is secure. In addition to ensuring only valid users are allowed to register devices, administrators require the ability to control user/ device interactions, such as: îîpreventing non-compliant devices from accessing corporate data on the network îîlimiting the number of devices a user can register to conserve bandwidth îîblacklisting users for improper conduct or behavior, such as a failure to comply with usage policies or code of conduct îîrapidly removing all device registrations associated with a user in the event of malicious activity The ability to view and track all devices on the network from a single pane of glass brings a host of benefits, including simplifying network management, increasing IT agility, and eliminating gaps in device visibility and control that can put businesses at risk from unmanaged BYOD. 4. Make It Integrated Complete visibility and control of the network and devices can only be achieved when an MDM solution is tightly integrated with IP Address Management (IPAM) and core network services. Earlier, we discussed how a simple BYOD self-service Web portal is a critical component of BYOD. Under the hood, such a portal is anything but simple. The self-service portal must be integrated not only with MDM, but also with a robust, scalable and rock-solid DNS, DHCP and IP Address Management (IPAM) platform. Direct integration with DNS, DHCP and IPAM enables many of the BYOD must-haves outlined above, including: îîrestricted access to the network using core services to prevent unknown and unregistered devices from gaining access to critical resources îîautomatic access to the network once a device has been registered îîas devices are on-boarded via the self-service portal, the IPAM system is automatically populated with all the necessary information to tie a user to a device (or group of devices) and to an IP address (or group of IP addresses) when these are linked, any network traffic, especially DNS queries, can easily be tied back to a user on a given device î î Devices are off-boarded when deemed non-compliant by the MDM BYOD: Your Guide to Complete Mobile Security 4

5 IT also benefits from the integration, as basic network configuration tasks critical to support BYOD can also either be automated or easily executed from a single pane of glass. These include: îîconfiguring and provisioning a new network to support BYOD îîadding a new range of IP addresses to accommodate increased BYOD demand îîlimiting IP consumption by controlling the number of devices per user îîallowing users to self-register their own devices to gain access to the network with zero IT intervention îîdelegating administration and support of BYOD issues to the helpdesk or other groups within your IT organization with full accountability îîeffortlessly creating dedicated environments for the various device types to drive both connectivity (wired, Wi-Fi, etc.) and access (Internet only, corporate servers, etc.) based on the devices capabilities, corporate policies and user profiles îîmonitoring and dynamically adjusting IP address pools to ensure that employee and guest devices can consistently and reliably connect to the infrastructure Integration between MDM and DDI also gives IT access to a rich repository of device and IP data that can be used in a number of different reporting and auditing functions: îîeach user on the network is tracked along with all registered devices associated with that user. This means users are tied to IP addresses to show how each device/ user pair is interacting with the network and which resources are being accessed. îîauditing allows administrators to track IP address, user name, and MAC address for security and compliance. A searchable audit trail enables administrators to quickly and efficiently find offending users or devices to protect the network. Non-compliant devices can be removed or blacklisted with a single click. îîdetailed device information such as device type and operating systems can be captured and used to plan future projects or improve services. Device and usage statistics and trends can be viewed and analyzed through reports. The powerful combination of MDM and DDI provides centralized visibility and control of everything IP including users, devices and IP addresses, delivering rich network and device management capabilities and a complete span of control for the entire BYOD infrastructure. In the next section, we look briefly at how BYODShield provides a comprehensive mobile security and management solution to address BYOD requirements. BYODShield Solution Overview Created and developed by Westcon, BYODShield joins the proven capabilities of BlueCat and MaaS360 by Fiberlink into a single, integrated package that provides both network and device security. The unique solution is built on the foundation of two of Gartner s leading vendors: îîbluecat A leader in IP Address Management, earning the highest Strong Positive rating in the most recent Gartner MarketScope for DNS, DHCP and IP Address Management. îî Fiberlink A Gartner Magic Quadrant leader for Mobile Device Management Software based on completeness of vision and ability to execute. POWERED BY Comprehensive MDM, MAM, & Secure Document Sharing oa BYOD: Your Guide to Complete Mobile Security di r BYOD Customer Devices On-Premise Virtual Appliances Delivery ng MOBILE ASSETS Mobi le Securit y g/o ffb Onboardin BYOD Onboarding & Network Security Devices Docs Apps Cloud-based Delivery 5

6 By integrating the proven capabilities of BlueCat and MaaS360, BYODShield provides both network and device security in a single package available only from Westcon. This makes it possible for businesses to provide scalable, policy-driven network access and protect employee mobile devices from data loss, malware and other threats. By taking a holistic approach to BYOD security, BYODShield covers all key aspects of MDM including: îînetwork security îîmobile device security îîmobile device management îîmobile application management îîsecure document sharing îîmobile expense management BYODShield integrates these solutions together so they can operate as a single, powerful, easily managed security solution for the whole organization. Forrester finds that 48% of today s information workers already buy whatever smartphone they want and use it for work purposes. By 2020, the number of empowered employees will rise as the younger, more tech-savvy Millennial workers become 45% of your business workforce demographic. Forrester Research, Inc. TechRadar for I&O Professionals: IT Service Management Processes, Q1, 2012, February 7, 2012 Key Features of BYODShield BYODShield delivers comprehensive features for protecting the network and securing data and applications on mobile devices, whether company-liable or BYOD. FEATURE Secure Access DESCRIPTION î îensures all mobile devices (BYOD or corporate-owned) are registered and secured before network access is provided. Also, connects mobile devices, applications, virtual environments and clouds to the network securely, reliably and in real-time Network Protection î îrevokes network access for devices that are jail broken, have had their MDM agent/profile removed or have failed to comply with any MDM policy, anywhere at any time. îîprotects the network from devices that are lost or stolen by removing their corporate data and access credentials. Central Visibility î îprovides the ability to centrally view the relationships between all users, their devices and the network addresses that identify those devices within the organization îîcentralizes all auditing relating to change control information for devices that are added to or removed from the network îîsimplifies auditing and compliance reporting for mobile device usage îîprovides easy integration and mandatory self-enrollment of mobile devices Mobile Device Management (MDM) îîcentrally manages mobile devices via a unified console for smartphones and tablets with centralized policy and control across multiple platforms îîproactively secures mobile devices with dynamic security and compliance features to continuously monitor devices and take action if necessary îîenables IT to easily diagnose and resolve device, user or application issues in real time îîmonitors mobile devices using an interactive, graphical summary of your customers operations and compliance and expense management, allowing IT to generate real-time reports BYOD: Your Guide to Complete Mobile Security 6

7 FEATURE DESCRIPTION îîintuitive enterprise application catalog Allows users to instantly view apps available to them, install apps and receive alerts to update apps Mobile Application Deployment & Management îîweb-based management console Provides IT with a secure, web-based console for managing and distributing apps to end users îîmobile app lifecycle management Simplifies lifecycle management of mobile apps via real-time software inventory reports, app distribution and installation tracking, app update publishing and provisioning profile management îîmobile app security & compliance Empowers IT to set app security policies including required (whitelist) and disallowed (blacklist) apps îîsecurely and easily share and manage documents on mobile devices Secure Document Sharing îîprovides document-specific sharing restrictions îîusers are alerted when new or updated content is available îîit can review distribution statistics on any corporate document îîunderstand usage and expenses Mobile Expense Management îîuse multiple policies to handle different types of users îîset usage thresholds and alerts, and proactively take steps to eliminate overage fees îîset in-network vs. roaming policies îîoptimize service plans across carriers BYODShield helps organizations realize the full benefits of BYOD and avoid the risks by making it simple, secure, visible and integrated. The Mobile Movement is Unstoppable The world has gone mobile in a big way, and we ve only seen the beginning. BYOD is rapidly becoming the new standard for business connectivity. To make BYOD work, users must be led through a comfortable, simple process that on-boards them onto the corporate network, while registering and enrolling their device in the MDM. At the same time, administrators must be able to simply and easily view and manage devices and network access. These goals can only be achieved by implementing a complete mobile security solution that is integrated with the organization s existing IP network infrastructure. For a mobile security and management solution to be truly unified, it must be able to control the network and the devices that are used to access it. Westcon has designed BYODShield to protect both the network and the device, ensuring that your customers data and applications are always safe and secure. BYODShield is the only solution of its kind that can do this with simplicity and at a low cost without requiring a network re-architecture. The result is a proven BYOD solution that empowers business users with quick and painless BYOD connectivity, while empowering IT with an automated solution for controlling all devices with minimal effort. BYOD: Your Guide to Complete Mobile Security 7

8 About Westcon Westcon is a premier value-added distributor of category-leading unified communications, network infrastructure, data center and security solutions with a global network of specialty resellers. Our teams create unique programs and provide exceptional support to accelerate our partners business. Strong relationships at every level of the Westcon organization enable our partners to receive support tailored to their precise and evolving needs. About BlueCat BlueCat provides a smarter way to manage BYOD, mobile devices and cloud with unified mobile security, address management, automation and self-service. With powerful IT selfservice, automation and workflow delegation, BlueCat solutions give organizations the power to manage everything IP in their network including devices, users and IP activity from a single pane of glass. The result is a dynamic network that is more resilient, cost effective and easier to manage. Enterprises and government agencies worldwide trust BlueCat to manage millions of devices and solve real business and IT challenges from secure, risk-free BYOD to virtualization and cloud automation. Our innovative solutions and expertise enable organizations to build a network infrastructure that is more scalable, reliable and secure, as well as simplify the transition to next-generation technologies including IPv6, DNSSEC, M2M and SDN. About Fiberlink Fiberlink is the trusted leader in cloud-based enterprise mobility management. Its MaaS360 product simplifies mobile device management (MDM), mobile application management (MAM), and secure document sharing in the BYOD era. Small businesses, government agencies, universities, and large enterprises worldwide rely on MaaS360 to enable mobile policies that boost productivity, protect employee privacy, and secure sensitive data across smartphones, tablets, and laptops. Built on a highly scalable, multitenant architecture, MaaS360 s on-demand mobility management can be deployed in minutes and seamlessly integrates with existing infrastructure, extending enterprise systems to a mobile environment. WESTCON GROUP, WESTCON and COMSTOR, are registered trademarks and trademarks of Westcon Group, Inc. Copyright 2013 Westcon Group, Inc. All Rights Reserved. BYOD: Your Guide to Complete Mobile Security 8