The BYOD Survival Guide 5tips for Practicing Safe Mobile Collaboration
Personal mobile devices have infiltrated enterprise organizations all over the world, enabling everyone to work from everywhere. Industry surveys indicate that the number of employees who routinely use their personal mobile devices to share information range from 70 to 80%. BYOD (bring your own device) is real, and it is here to stay. With a mobile device in-hand, employees are breaking down the barriers between their workplace, home and travel destinations, while collaborating and sharing information. In theory, many enterprises are embracing and supporting BYOD, however, there is a lot more involved than simply just allowing employees to bring devices to work. BYOD s Achilles Heel: Security Breaches, Leaks and Attacks The flip-side to BYOD is data protection, and ensuring that as employees bring devices toand-from the workplace, confidential corporate data is adequately protected while remaining easily accessible. An important component of data protection, often not addressed by BYOD strategies, includes ensuring that information and records comply with privacy laws like the Health Insurance Portability and Accountability Act (HIPAA) and Sarbanes-Oxley (SOX), as well as specific industry and regional privacy regulations. Source: Acronis 2013 Dynamic Data Index, Global Trends in BYOD, Cloud, Hybrid Environments and Virtualization 2
Meet NewCo NewCo is a thriving technology company with more than 2,500 employees that prides itself on embracing the latest IT trends and happenings. The employees are bright, motivated, innovative and mobile. Collaboration is key and BYOD is widely accepted and used across the organization. But NewCo does not have a mobile device policy in place and employees are not educated on their responsibility to protect corporate data. That means there are 2,500 employees with an estimated one to three personal devices accessing and exposing company data at all times putting sensitive financial information, confidential customer information, employee files and other vital corporate data at risk. NewCo learned its lesson the hard and costly way when a data breach shut down its networks for nearly seven hours. As a result of the breach, customer data was leaked, tarnishing NewCo s once trusted brand. And the hours of downtime cost nearly one million dollars in revenue. 3
FACT: System downtime costs enterprises approximately 2.1 million USD every year. 4
How much does system downtime cost you every year? 25% 20% 21% 22% 20% 15% 10% 9% 10% 11% 8% 5% 0% < $100,000 $100,001 to $500,000 $500,000 to $1,000,00 $1,000,001 to $2,500,000 $2,501,001 to $5,000,000 $500,001 + Cannot determine Converted to US$Extrapolated value ($1,000,000 omitted) $2.1 NewCo is not alone in its reckless BYOD practice. 58% of enterprises do not have a mobile device policy in place. 5
Does your organization have a policy that specifies how employees may use their own devices in the workplace? 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% Yes 41% No, but we are planning to write a BYOD Policy 17% No 41% 1% Don t know On the other end of the spectrum, 31% of enterprises strictly forbid the use of personally-owned devices to access corporate networks. This is not realistically sustainable, and will force employees to work around corporate policies and rules. Not good. 6
If yes, what does the BYOD policy require? 43% 31% 23% 3% Only companysanctioned personal devices are allowed to access the organization s networks It strictly forbids the use of any personally-owned device to access the organization s networks All personally ownded devices are allowed to access the organization s networks Other It is obvious that enterprises need a little help understanding the full implications of BYOD while keeping IT in control of corporate networks. By following some easy practices, NewCo and other organizations across the globe, can practice safe BYOD. 7
The BYOD Survival Guide 5 Tips to Practice Safe BYOD in Your Organization 5tips 8
survival tip 1 Create a Mobile Device Security Policy Creating a mobile device security policy need not be a complicated, drawn out effort. Data can be protected easily by requiring users to key-lock their devices with password protection. It really is that simple. The majority of enterprises that have BYOD security policies in place are way overcomplicating things: 68% use VPN or secure gateway connections across networks and systems. That works, but protecting corporate data can be as easy as mandating device passwords and key locks on all personally-owned devices that access corporate networks a practice that only 31% of enterprises are enforcing. Whether you opt for VPN security, key locks, Active Directory Monitoring or endpoint security, the choice is yours. But it is time to make a policy and stand by it. Part of creating and enforcing an effective mobile device security policy is accounting for personally-owned devices entering and leaving the workplace, a movement called take-your-own-device (TYOD). If not properly managed through processes like remote wipe, TYOD could cause major data leakage. Only 21% of enterprises perform remote device wipe when employees leave the organization. Bonus Tip: Include remote wipe in your policy. 9
Create a Mobile Device Security Policy If personally-owned devices are allowed in the workplace, how is BYOD security enforced? More than one response permitted 68% VPN or secure gateway connection to access the network and enterprise systems 52% Use of Active Directory and/or LDAP to monitor user access and activiy at the device level 36% Endpoint security application installed on the device 31% Devices password or key locks 21% Remote wipe calapbility to minimize data loss 3% Other 0% 10% 20% 30% 40% 50% 60% 70% 80% 10
survival tip 2 Stop Making Exceptions to Your Policy We all know that rules are not meant to be broken; so why aren t enterprises taking their own mobile device policies seriously? 41% of enterprises do have a BYOD policy in place. Kudos to you. But nearly 25% make exceptions to policy rules. Worse, these exceptions apply to executives. Get it? Those with access to presumably the most sensitive data in the organization are allowed to break the rules. Does your CEO know that his tablet could crush his business? Are there exceptions to the BYOD policy? 80% 70% 60% 50% 40% 30% 73% 20% 10% 0% 16% 8% 3% No, it applies to everyone equally Yes, executives are allowed to use their own devices in the workplace Yes, executives and other privileged users are allowed to use their own devices in the workplace Unsure 11
survival tip 3 Make Safe BYOD Everyone s Responsibility Let s go back to the BYOD spectrum for a minute. Some of you allow employees to bring smartphones, tablets and even their own Macs into the office. You know this improves productivity and increases collaboration and sharing. Then there are those of you who are on complete BYOD lockdown. Either way, a little bit of education can go a long way. If employees understand the privacy risks involved with BYOD, maybe your data could be a little bit safer and maybe you would feel more comfortable loosening the reigns. FACT: 80% of enterprises have not trained employees to understand BYOD privacy risks. 12
Make Safe BYOD Everyone s Responsibility Has your organization trained employees to understand BYOD privacy risks? 90% 80% 77% 70% 60% 50% 40% 30% 20% 21% 10% 0% 2% Yes No Unsure 13
survival tip 4 Prepare for the Coming of Apple Nowadays, people rarely leave home without their iphone and ipad some even without their Mac laptop. This means Apple devices are inundating the enterprise: You can run from Mac integration, but you definitely cannot hide. 65% of enterprises will support Macs in the next 10 months and 75% in the next two years. If you fall off the bandwagon or never get on it in the first place you run the risk of driving away a desirable pool of employees, not to mention, you could miss out on exciting new technology and applications. The 57% of enterprises that state compatibility and interoperability issues as roadblocks to Mac integration no longer have a valid argument there are solutions out there to help solve these challenges. Does your organization support the Apple Mac in addition to Windows or Linux platforms? 40% 35% 30% 25% 20% 15% 10% 5% 0% 38% 27% 10% 25% Yes No, but we plan to within the next 12 months No, but we plan to more than 12 months from now No 14
survival tip 5 Don t Underestimate the Dangers of Public Clouds When it comes to data protection, you have to worry about more than just devices. Everyone, at some point, has been guilty of saving corporate presentations or other files and documents in free public clouds, like DropBox and Google Drive. It s convenient instant access, right? True, but public clouds are not secure, and leave data constantly vulnerable in the digital ether. Plus, public cloud application environments are often incompatible, causing business processes to become disjointed, and employee productivity to slow down. IT departments are well aware of the threats associated with using public cloud environments, so why aren t they mandating policies around bring-yourown-cloud (BYOC)? 67% of enterprises do not have a policy in place that specifies sharing corporate files in a public cloud. Does your organization have a policy that specifies permission to share business files in a public cloud environment? 27% 20% 47% 6% Yes No No, but we are planning to write an acceptable use policy Don t know 15
The Bottom Line: It is time to stop sugar coating (or ignoring) the risks and challenges that accompany BYOD bliss. Decide which end of the spectrum you fall on, and find a solution that enables secure mobile file access and management, and Mac integration. No more excuses. You are now equipped with tips to start practicing safe BYOD and ensuring adequate data protection across the many devices that pass through your organization. Jumpstart your survival with Acronis:» Test drive: ExtremeZ-IP» Test drive: activecho» Test drive: mobileecho» Test drive: Acronis Backup & Recovery for Mac Source: Acronis 2013 Dynamic Data Index, Global Trends in BYOD, Cloud, Hybrid Environments and Virtualization 16
300 TradeCenter, Suite 6700 Woburn, MA 01801 USA +1 781 782-9000 info@acronis.com www.acronis.com