The Guide to Implementing a BYOD Policy at Your Company An ebook by Your Friends at UTG

Transcription

1 The Guide to Implementing a BYOD Policy at Your Company An ebook by Your Friends at UTG

2 Did you know that 70% of smartphone users have accessed corporate data using a personal device, and 21% of those who purchase tablets plan to use them for work? That s a lot of corporate data being accessed by unprotected devices. That is, unless IT can implement a policy covering personal devices used at work. The concept behind Bring Your Own Device (BYOD) is not a new one. Personal devices have been in the workplace in some capacity for at least fifteen years. But it is becoming an essential part of a company s IT security strategy. As consumers are exposed to more and more available devices, those devices will become more and more present in the workplace. These devices can be used to access highly sensitive information, so if you don t have a policy in place to regulate personal devices being used for work-related purposes, your company could be exposed to some serious security risks. In other words, not having a BYOD policy is no longer an option.

3 But what should your policy look like? Simply put, a BYOD policy is a set of regulations designed to protect a company s network and information. The strategy designates a program to be implemented on the personal devices of that company s employees and monitored regularly. It should be able to allow access to company systems via a wide variety of devices and operating systems while being smart enough to keep out hackers. Implementation of a BYOD strategy brings with it benefits beyond just additional security. Not only does it protect information and networks for companies, but it also adds to employee satisfaction. Employees are allowed to use their most beloved devices freely at work rather than trying to be inconspicuous. Also, the IT department looks like the hero because it is enabling rather than inhibiting, and IT staff can now help solve problems on devices previously not covered in company policy. How to implement a BYOD policy There are a few simple steps in the process of setting up a BYOD policy. These include the integration of your company s various departments, selection of your management suite, and education of employees. Ready to take a dive into BYOD? Then follow these four tips to ensure that your BYOD strategy is successful: 1. Involve your entire company in the process. Creating an effective BYOD policy is a team effort. Get these key players involved to set up your strategy for success: Legal: Your BYOD policies will need to be robust and comprehensive. They should also have legitimate consequences associated with breaking them so that employees will take them seriously. To properly do this, you ll need to involve your company s legal department. These folks can also help you identify what records you should be keeping that auditors may want to see.

4 CFO: You may decide that providing compensation for employee devices, service plans, or other charges is the right way to go to help control the types of devices being used. If this is the case, the cost will likely exceed that for which the IT budget allows. In this case, you will want to involve your CFO. Human Resources: Throughout the duration of your BYOD policy, you ll inevitably have employees leave and join the team. If you work for a large company, IT is not likely to hear about every staffing change. Teaming up with HR ensures that you will receive notice about each new employee (so you can integrate his or her devices with your policies) and each team member who leaves (so you can clear his or her devices of any sensitive data or programs). 2. Choose a comprehensive Mobile Device Management (MDM) suite. There are several factors involved in choosing an MDM suite, but there are some non-negotiable elements that should be included. Here is a list of some features that should definitely be available within your suite, broken down by category: Device management: Requires device passwords of a certain difficulty and the frequent renewal of those passwords Encrypts all corporate data on devices Allows for remote locking and wiping of lost or stolen devices Has location tracking capabilities Can access and disable device hardware (camera, Bluetooth, etc.) as needed Supports active directory synchronization, which integrates MDM policies with existing IT management infrastructures Supports all major operating systems Allows the capability to block certain functions based on context (time, place, network, etc.) Application management: Provides inventory of all applications running and installed on all devices

5 Assesses security risk involved with each app Has the option for an enterprise-approved app store Creates a blacklist of unapproved or dangerous apps and blocks their use Has containerization capabilities (provides separate connections for important or sensitive apps) Network management: Does not allow unknown, unauthorized, or jailbroken devices to access the network Controls network access or unknown apps until they can be approved by the application management features Integrates easily with your existing network Data management: Sanctions certain apps for use of corporate data and blocks others from accessing the same information Interfaces with document repositories and collaboration tools Note: Data management capabilities are not always included with MDM suites and can be purchased and integrated separately via third-party vendors. 3. Educate each employee. With a BYOD policy, it can be easy for certain policies, especially concerning contexts for accessing certain data, to fall through the cracks. Don t let I didn t know be a valid excuse for any of your employees. Here are some tips for making sure everyone is on the same page: Keep your IT crew up-to-date on new devices. Technology advances every single say, and each new advancement seems to bring a new product with it. Make sure your IT staff is well educated in the workings of each device your employees could be considering so that they can address any problem that may arise. Provide one-on-one setup sessions. This way your IT staff can individually and personally answer any particular questions your employees may have during setup. This helps develop a positive and

6 personal rapport between IT staff and other employees, which will be a positive thing when that same device malfunctions later on. Create video tutorials or how-to posts that are distributed regularly to your employees. This could include tips for increasing the security of your smartphone, how to test the security of a wireless network, etc. Mobile virtualization: a possible alternative If purchasing an MDM suite isn t for you, another option is mobile virtualization. This type of system separates each device into two different devices, one for personal use and one for work. This option requires larger storage capacity on devices, extensive on-premise infrastructure, and deep IT management expertise, but it is an effective and secure way to separate work from play on the same device. Now you re ready to implement your new strategy! Once you have all hands on deck, you ve selected an MDM suite, and you have a plan for employee education in place, you re ready to get started. BYOD is a great opportunity to improve morale and the relationship between IT and other employees. It also allows you to have a better handle on access to and distribution of corporate data, meaning a more secure enterprise and, consequentially, happier clients and superiors. About UTG United Technology Group (UTG) is a Managed Services Provider that takes the burden of IT management off of its clients shoulders so that they can focus on more important issues. UTG works with corporations throughout the region and specializes in creating and maintaining computer networks that are secure, robust and worry-free. For more information on how UTG can keep your IT infrastructure running smoothly, contact Brian Miller at corporate headquarters at