UK Cabinet Office Mobility Rules: Advice on Implementation of BYOD

Transcription

1 Advisory Notice UK Cabinet Office Mobility Rules: Advice on Implementation of BYOD UK Government Regulations There are a number of online documents discussed in this document that define regulations and give advice on mobility in UK government organisations. Cabinet Office Action Notice: e/230041/action_notice_unmanaged _end_user_devices.pdf Draft Architectural Advice: e/230043/unmanaged_end_user_device s_access_for_local_authorities_draft.p df FAQ for above: e/229393/unmanaged_end- user_devices_faqs_v2.pdf ICO Guidance on BYOD: /data_protection/topic_guides/online/b yod CESG Home Page: ge.aspx PSN: services- network Introduction On August 6th 2013, the UK Cabinet Office issued an action notice to Local Authorities (LAs) raising concerns over the number of unmanaged mobile devices accessing the Public Services Network (PSN). Local authorities must stop unmanaged devices from accessing the PSN. Here we provide an introduction to that action guide and advice on how to deploy BYOD schemes that comply with the regulations. The Action Notice The notice stated that: Exposing internal Government services to access from unmanaged end-user devices is not compliant with PSN Information Assurance Conditions, guidance from CESG or the HMG End User Device strategy, so Local Authorities must ensure that the risk to information received through the PSN is minimised. In coordination with CESG, Her Majesty s Government (HMG) laid out what it called a proportionate response, with the aim of minimising these devices and the threat that they pose to the PSN. The action notice and accompanying Draft Architectural Advice document put forward a strategy and timeframe in order to ensure PSN compliance. Short-term changes include implementing a mediation zone to act as a proxy between non-managed devices and PSN data; allowing the device access to lowimpact information and applications. In the longer term (within 12 months), HMG is insisting on a total segregation of networks, keeping PSN and non-psn services in separate network zones. Contact MobileIron 415 East Middlefield Road Mountain View, CA USA Tel Fax info@mobileiron.com LAs that do not bring their architecture in line with the new compliance standards are likely to have their connectivity suspended to protect the interests of the wider community. What does this mean for BYOD? This notice will undoubtedly leave many LAs confounded. Increasingly, IT leaders are beginning to see the advantages of bringing personal devices into the corporate

2 ecosystem. The benefits are plenty; productivity and morale are boosted amongst employees, while the spend on corporate hardware is reduced. Why then, when BYOD policies are such a potential asset to LAs, is the government appearing to be taking steps to stifle the use of personal devices? The truth is the action notice is not targeting all employee-owned devices. While on first read it may appear that the notice is specifically addressing the issue of employee-owned devices accessing the PSN, it is in fact referring to unmanaged devices, regardless of where ownership lies. The action notice states that: Personally owned end-user devices - which an LA wipes, provisions, fully manages and maintains for their life according to CESG s issued configuration and risk management guidance for that platform - are acceptable to be used for access to PSN data. An evolving landscape that is difficult to navigate Navigating the laws, best practices and guidance around data protection, BYOD and mobility is a constant challenge as the regulations change or are clarified. The problem is that the mobile landscape is a rapidly evolving one, with the role that these devices play in the government environment growing on a daily basis. Therefore, rolling out a BYOD program that is compliant with HMG standards might seem more hassle than it is worth. This is simply not the case. The fact is that by ensuring the following requirements are met, LAs can push forward with their plans to implement BYOD and do so safe in the knowledge that they are meeting their compliance obligations. How to ensure BYOD programs remain compliant Remote selective wipe In order to comply with central government s End User Device Strategy, managed devices must be able to remotely wipe data from the device should a device be lost, stolen or compromised or if an employee leaves the LA. However, this in itself is not enough. The Information Commissioner s Office has issued guidance which highlights the need to ensure that organisations remain compliant with the Data Protection Act Principle 7 of the Data Protection Act states: Appropriate technical and organisational measures should be taken against unauthorised or unlawful processing, accidental loss or destruction of, or damage to, personal data. So while in order to comply with the new guidance, LAs must be able to remotely wipe employer-owned data, it is also essential that they comply with Principle 7 of the DPA, by ensuring personal data is separated off from company data and immune from remote access or erasure, so you need to deploy selective wipe policies. p. 2

3 Take action if devices are jailbroken or rooted Elevating privileges on a device beyond that which the manufacturer intended (otherwise known as jailbreaking or rooting ) poses a serious security threat to LAs. The very act of rooting a device means that critical security controls are circumvented, allowing potentially malicious applications to access data, which would have not been otherwise able to do so. Although it is largely impossible to stop the rooting of personal devices, in order to be able to comply with risk management guidance, LAs must be able to quickly identify these devices and address the issue. Jailbroken devices can have their employer data wiped, can have further access to and data restricted as well as messages informing the user of the breach. Of course, jailbroken devices must be blocked from access to the PSN. Provisioning of devices The LA needs to be able to push IT policies to devices, example could be setting rules on data access based on employee credentials, setting minimum PIN or password policies, installing security and business apps and flagging those devices that are non-compliant. Prevent data loss and leaks Undoubtedly one of the biggest perceived risks that mobile technology increases is the potential for data leaks. From loss of devices to simple human error, such as sending an to the wrong address, data leaks can take on many forms - sometimes with devastating consequences. From a mobile perspective, attachments and remote files could be leaked. This potential is even more acute in a BYOD environment, wherein devices are likely to be handling both personal and corporate . Devices now integrate with cloud storage solutions and social networks as standard, so the potential to move sensitive data outside the scope of the LA s security perimeter is straightforward. It is therefore essential that LAs implement training of employees and a data loss prevention solution such as one which will containerise corporate information and restrict elements of copy/paste from secured and trusted documents and apps to untrusted ones, while leaving personal information untouched. Many devices, a few operating systems, one interface Individually, these requirements might seem complicated or even impossible to enforce. The process of manually tracking each personal device, ensuring it is up to date and fully compliant would negate any of the benefits that a BYOD program could bring. The answer to this conundrum comes in the form of enterprise mobility management (EMM) platforms. EMM solutions essentially act as the technical enforcer of security policies as well as providing mobility roll-outs at scale and app and data distribution methods. By implementing a robust mobile management solution, LAs can quickly meet the guidelines set out by HMG and CESG and at the same time, streamline their IT workloads by condensing all their mobile management processes into a single, cross-platform system. BYOD policies, used in conjunction with EMM software, not only bring all smart devices into the fold of the compliance guidelines, but provide a host of other benefits. p. 3

4 A positive impact on the bottom line ICT departments in both the private and public sectors are increasingly being asked to do more with less; a by-product of the current economic situation. IT leaders in the public sector may feel as though they are fighting an uphill battle. The always on, always connected end-user demands more than ever from IT, while the budget afforded to the department is continuously under threat. Therefore, anything which can have a positive effect on either capital expenditure (CaPex) or operating expenditure (OpEx) will come as welcome news to IT decision makers. As is often the case, technology has provided a solution to a problem of its own making. EMM solutions have an impact on costs in a variety of ways. First there are the obvious savings from being able to implement a secure and manageable BYOD model. As previously mentioned, CapEx can be immediately reduced by allowing personal devices into the LA environment. Then there are the less obvious savings. The overwhelming majority of research confirms that productivity increases with BYOD. A recent Cisco report found that BYOD-enabled employees gain an average 37 minutes of productive time per week and implementation of BYOD programs generated $350 ( 224) of value per employee. For organisations that deployed comprehensive BYOD strategies, this figure jumped dramatically to $1,650 ( 1,000) per employee. While users can see a boost in productivity, IT can also benefit. With a single interface which gives both top level views and granular control of the entire mobile estate, it becomes infinitely easier to manage all devices. Rather than spending countless hours chasing employees to update operating systems or listen to complaints about legacy technology, IT can force updates or send messages directly to the devices and focus their time on areas that might otherwise be neglected. It is this reallocation of resources which is allowing IT departments to once again become innovative, agile and effective. EMM software is capable of separating personal and corporate data, including applications. Selective remote wiping allows the IT department to wipe corporate data from lost, stolen or compromised devices, leaving the user s data intact and untouched. This not only ensures DPA compliance, but gives end users peace of mind - which is key to a successful BYOD roll-out. Improve morale and effect change from the ground up BYOD programmes generally have a positive impact on morale from day one. MDM solutions allow devices to retain native functionality, meaning that end users can continue to use their device in a way that is intuitive and comfortable to them. Users are empowered to choose their own device, rather than simply making do with ageing hardware. This in itself is generally a massive boost to morale and productivity, as users are suddenly incentivised to use their devices. This form of empowerment can be carried through into corporate applications too. Rather than relying on IT to deliver the device with the correct applications, users can download and install software from an enterprise app store. This not only removes the burden from IT departments, but enables employees to retain a sense of ownership over their device. p. 4

5 Case Study: Leeds City Council When Leeds City Council made the decision to implement a BYOD strategy, it had over 1,000 corporate Windows Mobile 6.5 devices in use. The fleet of devices were manually managed by the IT department and users were growing increasingly frustrated by the lack of capabilities when compared to newer-generation smart devices. Coupled with the dwindling support for the operating system, this prompted the council to implement an enterprise mobility management solution. This allowed Leeds Council to not only manage its legacy devices until phones were retired, but it meant that it could introduce new platforms into the environment. Android was selected for future devices and for users who wanted to use ios, a BYOD policy was introduced. The EMM platform allowed the council to run a truly agnostic mobile environment; one in which all devices could be managed from a single interface, regardless of platform. Discussions are underway to expand the program across all educational establishments in the area. Conclusion The public sector is on the precipice of monumental change. Fuelled in part by the consumerisation of IT and in equal measure by the budgetary constraints of austerity, BYOD is an inevitable step in the evolution of corporate mobility. However, very few CIOs would be so negligent to wander down this path without fully addressing the security concerns that arise out of such policies. Those concerns will undoubtedly have been compounded by the Cabinet s recent action notice. Yet, it is important to realise that the Cabinet s focus here is not on the prospect of personal devices being introduced to the PSN, but rather on the number of unmanaged devices. As is made clear by the Cabinet s FAQ documentation: The key thing is to ensure is that corporate security policies are applied as necessary to the [BYOD] device. By implementing a full mobile management solution, LAs can push forward with BYOD and begin to reap the many rewards that it has to offer. About MobileIron The leader in security and management for mobile apps, documents, and devices, MobileIron's mission is to enable global companies to become Mobile First organizations, embracing mobility as their primary IT platform in order to transform their businesses and increase their competitiveness. MobileIron provides the scalable architecture, rapid innovation, and best practices for global companies to transform into Mobile First organizations. Leading global companies use MobileIron as the foundation for their Mobile First initiatives, including 8 of the top 10 automotive manufacturers, 7 of the top 10 pharmaceutical companies, 5 of the top 10 banks, 5 of the top 10 law firms, and 4 of the top 10 retailers. For more information, please visit MobileIron. All rights reserved. MobileIron, MyPhone@Work and Connected Cloud are registered trademarks of MobileIron. All other product or company names may be trademarks and/or registered trademarks of their respective owners. While every effort is made to ensure the information given is accurate, MobileIron does not accept liability for any errors or mistakes which may arise. Specifications and other information in this document may be subject to change without notice. p. 5