BYOD Policy. Handout

Transcription

1 Handout 1 Identify What Mobile Devices Are Allowed It s important that this list is as detailed as necessary, including types of smart phones and/or tablets, operating systems, models, etc. Also identify which company owned devices you will or won t continue to deploy. 2 1

2 Determine a strict security policy Make complex passwords mandatory at all times if users want to use their devices with corporate systems. Enforce automatic prevention of downloading, installing, and using any app that does not appear on the company s list of approved apps. Implement automatic enforcement of employees limited access to company data passed on user defined profile set by IT. Make mandatory remote wiping if the device is lost or IT detects a data or policy breach, a virus or related threat to the security of the company s data. 3 Define What Issues IT Will Support Consider things like: 1. Connectivity issues 2. Broken device protocol 3. Helpdesk limits 4. Loaner devices while devices are being serviced 5. Access to apps, etc. 4 2

3 Clarify Reimbursement If Any Decide what your company will or will not reimburse the employee for if anything. Also consider besides just the reimbursement dollar amounts or percentages is stating whether or not those amounts will cover extra charges like overages and roaming charges that can pile up quickly. 5 Select Which Apps You Will Allow Or Ban The question here is whether users can download, install and use an application that presents security or legal risk on devices that have free access to sensitive corporate resources. Key concerns typically include applications for social media browsing, replacement applications, and VPNs or other remote-access software. 6 3

4 Incorporate Your With Your Acceptable Use Policy Integrate your BYOD policy with your acceptable use policy already in place and add on from there. You need to be protected from users who may have, for example, illicit materials on their mobile devices. Also think about what monitoring strategies and tools are available to enforce such policies. 7 Determine A Plan For When Employees Leave Your Company What will happen when employees with devices on your BYOD platform leave the company? A device that is loaded with company data and s is very dangerous if it were to fall into the wrong hands. Consider disabling s or synchronization access before the employee exits, or implement a mandatory wipe prior to the release (funds transfer) of the employee s final pay check. 8 4

5 OS Versions and Device Platforms Consider what device platforms and OS versions you want to support. You need to make sure the mobile devices you are allowing are equipped with the features you require. In your BYOD policy you should clearly state which mobile device platforms and OS versions you will support. 9 Device Enrollment Process Consider on what factors you will block devices from connecting to your network. Make sure it is clearly stated in your policy that mobile devices must be registered and authenticated before they connect to the company network. This allows network administrators to detect unauthorized devices on the network. 10 5

6 Passcodes Consider how complex passcodes should be and how often you should force users to change their passcodes. Passcodes should be enforces for all mobile devices accessing your network so in your BYOD policy the required passcode length, complexity, required frequency of change, failed attempts consequences, and penalties of not following these regulations. 11 WLAN Access Think about whether you will enforce company WLAN access when on-site. Doing so can save data cost and device battery, as well as speed up network access. There s also the benefit of added security and authentication. In your policy set and specify enforcement of your organizations WLAN access. 12 6

7 Confidential Content Will you be distributing sensitive content to your users on their mobile devices? Consider whether you will let your users save, print, , etc. certain kinds of content. You want to set mobile data leakage prevention policies and monitor your users compliance. Requiring the use of a secure content container on mobile devices, for example. 13 Lost Devices And Theft Lay out a process in your policy for users to follow if they lose their device or it s stolen. Users need to be aware that they are required to notify IT when this happens so the device passwords can be remotely reset or wiped. You can even have an auto-wipe of certain apps after a certain number of failed login attempts. 14 7

8 Encryption Of Data Encrypt sensitive data stored on personal devices with strong encryption. Full device encryption is best, but if that isn't feasible, all sensitive data should be stored in encrypted folders on the device. Lay out fully your enforcement of encrypted data and block devices that do not have encryption enabled from the network. 15 User Agreement Users need to be aware of everything in the policy and sign an agreement of their acknowledgement of the terms before their enrollment into BYOD. Apply this process consistently for BYOD all devices. 16 8

9 Mobile Forensic Investigation Include a stipulation in the mobile policy that gives the corporate security/info sec function the right to examine an employee's mobile device whether the device is corporate-owned or brought from home. Ensure the organization has the right authority to be able to examine any device that is brought into the corporate environment. Subject to compliance with regulations like PCI-DSS or HIPAA? The organization could find itself in trouble if it can't get its hands on s and SMS messages during an e-discovery process. 17 Mobile Device Procurement, Support, and Usage Policy 2 Options: Company assigned or BYOD 1. Applies to phones and tablets 2. Both require substantial business need and management approval 3. Funded from business unit operating funds 18 9

10 Mobile Device Procurement, Support, and Usage Policy 2 Support Levels Full Support : IT Assigned IT selects and issues device annually Standard device, standard setup Concierge Level Support: BYOD Use personally owned device Individual fully responsible for maintenance and security IT provides settings for access to , wireless only 19 Mobile Device Procurement, Support, and Usage Policy Summary of Charges 1. Allowances and charges reviewed annually 2. Cell phones and Smart phones Company issued or non-taxable allowance for BYOD. $75 per month for voice/text, $135 per month voice/text/data 3. Tablets Company issued($500 per year charge) or BYOD. Note: Both require registration in a mobile device management service for remote wipe in the event device is lost or stolen

11 Guidelines for Managing and Securing Mobile Devices in the Enterprise (SP Rev. 1) This revision is intended to supplement federal government security controls specified in NIST's fundamental IT security document, Recommended Security Controls for Federal Information Systems and Organizations (Special Publication )