BYOD Policy Implementation Guide. February 2016 March 2016

Transcription

1 BYOD Policy Implementation Guide February 2016 March 2016

2 Table of Contents Step One: Evaluate Devices... 3 Step Two: Refine Network Accessibility... 4 Step Three: Determine Appropriate Management Policies... 6 Step Four: Create an Employee Agreement... 6 Step Five: Choosing the Right Enterprise Mobility... 7 Conclusion HEAT software. All Rights Reserved. PG 2

3 A little over ten years ago, mobile device management really only meant one thing: BlackBerry Enterprise Server. In many ways, that pioneering system still sets expectations for management capabilities of the ever-widening array of mobile devices available to today s workers. Yet, unlike those early Blackberry s, today s smartphones and tablets offer far more than a portable PIM, and pose greater potential risks to data security. Beyond that, the now-established trend of employee-owned devices in the enterprise means that IT departments tasked with supporting those devices have far less control than they had in older, closed systems yet they still have the same responsibility for ensuring security of company resources and data. This paper outlines the steps in a best practices approach to establishing a company BYOD program. Step One: Evaluate Devices When the idea of supporting employee-owned devices in the enterprise first began to arise, it was driven largely by higher-ranking employees, such as CEOs, who wished to use their own ipads and other mobile devices at work. Because of that, IT often felt pressure to support whatever device that executive had chosen. As BYOD trickled down to the rest of the company, this wide open adoption pattern persisted, leaving IT administrators at the mercy of hundreds of employee preferences, yet still responsible for ensuring the security of the company data and resources being accessed from this wide array of mobile devices. As a result, they often sought EMM software evaluations based on an unrealistic expectation that the management software could remediate the situation, applying standardized policies to whatever devices and operating systems happened to walk in the door. Unfortunately, no such EMM software exists. For organizations just beginning to embark on a BYOD program, then, the first step is to determine exactly what devices will be allowed to access company resources and data. This assessment will vary depending on various company and regulatory requirements specific to each organization, but should include consideration of the following: Security. Does the device have built-in encryption? Can jailbreaking/rooting be detected or prevented? Can passwords be enforced? Can the device be geolocated? Can it be remotely locked and/or wiped? Manageability. Does the device allow for management? As an example, before the release of ios 4, Apple mobile devices were essentially unmanageable, except via a tethered connection to itunes. Now, ios includes a robust EMM API. Android has evolved similarly, but manageability varies between hardware vendors, many of whom offer their own, extended management APIs. At a minimum, does it support Exchange ActiveSync policies or at least a large enough subset of those policies to comply with company standards? Apps. Are there apps available to offer the kind of productivity you hope for employees to realize with the devices? Do you have internal resources who can develop your own apps for the device? Does the device allow for in-house apps? Is there a program for the company to purchase third party app licenses and provision to employee-owned devices? 2016 HEAT software. All Rights Reserved. PG 3

4 Step Two: Refine Network Accessibility An easily overlooked aspect of BYOD is the relatively open nature of company WiFi networks. While access is often controlled by either AD credentials or standard security such as WPA, employees can often configure their own devices to get onto the network. In the past, with only company-owned devices using WiFi, this method saved a lot of help desk tickets. Today, though, it opens up the network to an unlimited number of devices that may pose great risks to the company. Completely locking down the network may be necessary for certain companies. For most, there is a simpler solution for mobile devices. If you don t already have one, set up a guest wireless network, walled off from the internal network. This will also serve as the enrollment network for employee-owned mobile devices. Once a device is enrolled, it should be automatically evaluated and assigned privileges and restrictions accordingly. Alternatively, a Network Access Control (NAC) solution can identify noncompliant (unmanaged) devices and redirect them to enrollment. The most basic privileges to assign will be provisioning of company , company WiFi and VPN configurations. All should be tied to a security policy, specifying that only devices that meet the company standard will receive access. For example, devices should not be jailbroken, or rooted. This is the single biggest security risk posed by mobile devices. In addition, you may have an app blacklist, and block access to devices with those apps installed. Provisioning access through EMM offers benefits to both the company and the employee. Employees receive access immediately IT does not need to manually provision devices Employees do not actually see the WiFi passwords, so the company retains access control By tying access to security policies, remediation of future violations will be automatic The now-established trend of employeeowned devices in the enterprise means that IT departments tasked with supporting those devices have far less control than they had in older, closed systems yet they still have the same responsibility for ensuring security of company resources and data HEAT software. All Rights Reserved. PG 4

5 Step Three: Determine Appropriate Management Policies Now that you ve determined what devices you ll support, and the degree of manageability those devices allow, it s time to think through how you will apply the privileges and restrictions to BYOD devices. Policy-based management. The last thing you want is to have to figure out the rules for each device, one at a time. The good news is that your company s employees are likely already organized within directory systems such as Active Directory or Open Directory, which list departments, geographies and job titles. Basing your device policies on these groupings saves you a lot of time. Beyond that, certain device characteristics may be relevant to management decisions. OS and hardware type are obvious ones. Finally, you may have needs for both management and reporting based on other data. Setting up policy groupings is essential to efficient management. Security. As discussed in Step Two above, certain policies must be established as umbrella policies to cover all devices. A baseline security policy that enables automatic remediation when devices fall out of compliance is essential. Additionally, certain configurations should be enforced, such as company password standards or app blacklists. Mobile Content Management. Many people rely on or consumer services such as icloud or Dropbox to transfer documents to mobile devices. Neither of these options properly secure sensitive information that is owned by the company; to the contrary, it deliberately moves the documents well outside of company control. However, the only way to ensure that employees will not resort to these tools is to make it easier for them to access the documents they need. A centrally administered document repository, making files available by policies, but allowing IT to delete those documents if necessary, is the only way to secure company data while respecting device ownership and user experience. Distilling these trade-offs into a clearly articulated, written policy is a necessary prerequisite to managing employee-owned devices. This agreement may be on paper, or it may be displayed electronically as part of the device enrollment process. Either way, it is important that employees understand and agree to company BYOD policies. Step Four: Create an Employee Agreement Both the company and its employees benefit from BYOD. Employees can choose devices that better fit their personal work and lifestyle, which results in greater productivity for the company. At the same time, both must accept certain trade-between privacy and control. The employee needs to understand that accessing company networks and resources with a personally owned device necessarily means ceding a certain amount of control over the device s settings; for example, violating company policies may mean loss of access. In highly-regulated industries, it may also mean that employees agree to allow the company to completely wipe the device in certain circumstances. The company needs to understand that management no longer means control, as the device s owner will always be able to claim ultimate control of the device and its functionality. Distilling these trade-offs into a clearly articulated, written policy is a necessary prerequisite to managing employee-owned devices. This agreement may be on paper, or it may be displayed electronically as part of the device enrollment process. Either way, it is important that employees understand and agree to company BYOD policies HEAT software. All Rights Reserved. PG 5

6 Step Five: Choosing the Right EMM Solution The most important consideration in evaluating automated management tools is whether those tools will support the policies and devices you have already decided on, including some of the recommendations and example already discussed. Remember, you are not looking for a set of features you are describing a set of problems you need to solve. Let the software vendors show you how they address the issues. Below are a few more specific considerations: Platform flexibility. The endpoints you manage may be changing rapidly, but the servers and networks most likely are not. Can the tool be installed in your existing environment? Does it leverage the infrastructure you already have in place, such as your NAC and Active Directory, or will it require you to adapt to the tool? Unified management platform. Chances are, responsibility for EMM has been assigned to the same IT group that currently manages desktops and laptops. If you do not already have a tool for client management, or if you are considering replacing the one you have, you should consider a tool that will manage all endpoint platforms. It will save on infrastructure overhead and staff training. Role-based administration. Particularly in a BYOD environment, it is vital to be able to assign technicians to specific devices or groups of devices, as well as to restrict management privileges. For example, the ability to lock or wipe devices owned by c-level executives should probably be restricted only to certain individuals in IT. Just as you need to select a tool that adapts to your technical infrastructure, you need one that adapts to your organizational infrastructure. Jailbreak detection. The single biggest security risk posed by mobile devices is jailbreaking, or rooting, which opens up a back door to company resources and data. Any EMM tool which cannot detect jailbroken devices should be eliminated from consideration. Beyond that, ask how jailbroken devices are remediated. If you have to read reports, or wait for alerts in order to take action, that increases your risk. Look for automated remediation. App management. Depending on your own app needs, you ll need to find a tool that can distribute in-house apps, as well as provide a method for managing commercial apps. Both the Android Market and itunes App Store contain hundreds of thousands of apps. Self-service may be the norm on mobile devices, but you need to make it easier for them by deploying the apps, publishing them to an in-house store, or both. If you purchase apps via Apple s ASVPP program, you ll need to automate that process, as well. Secure content management. Ultimately, you can never secure the actual, physical device, but you must be able to secure company data. A Mobile Content Management functionality is a vital part of EMM in a BYOD environment. Conclusion The steps are numbered, but it should be clear by now that they also overlap. For example, it will be difficult to determine your desired policies without understanding the manageability options of the devices you choose to support, and you cannot establish the enrollment process on your segmented network until you ve selected an EMM tool. Software vendors can be helpful advisors during your internal planning, and you should begin to talk to them early in the process. Ultimately, though, it s the company standards that come first, the management tools and processes second, and only then should those employeeowned devices start coming through the door. HEAT Software USA Inc. 490 N. McCarthy Blvd. Milpitas, CA USA P or HEAT software. All Rights Reserved. PG 6