Transcription
The ultimateguide to BYOD490 East Middlefield Road, Mountain View, CA 94043Tel: 1.877.819.3451Fax : 1.650.919.8006www.mobileiron.comMKT EN 0219 US V61
INTRODUCTIONBYOD: How to move from zero trust to total trustToday’s working environments are no longer controlled byrigid security perimeters. Enterprise users frequently workanywhere, on any network, often using their own devicesto access business apps and data. The “bring your owndevice” (BYOD) trend has been around for many years, andisn’t going away any time soon. In fact, the BYOD market isexpected to grow to almost 367 billion by 2022, up fromjust 30 billion in 2014.1Here’s what’s also growing: security threats againstenterprise apps and data on unsecured devices, especiallythose owned by employees. As attacks become moresophisticated, security professionals must reconsiderthe best practices on which they’ve previously relied-- especially when it comes to BYOD. Many are alreadystarting to implement (or at least evaluate) solutions thatprovide a secure, contextual connection based on device,app, user, environment, network, and everything else that’sinvolved in accessing their data.1. Forbes, “The Future Of BYOD: Statistics, Predictions And Best Practices To Prep For The Future,” Jan. 21, 2019.Building trust in a zero-trust worldAn enterprise environment based on “zero trust” -- that is,one that treats all endpoints, apps, networks, and clouds tobe compromised and hostile -- has emerged as a successfulsecurity model for protecting company apps and datain a BYOD world. Zero trust assumes that all access tocorporate resources should be restricted until the user hasestablished their identity and access permissions and untilthe device has passed a security profile check.As organizations build and refine their BYOD programs,incorporating zero-trust security should be top of mind.In the following sections, we’ll look at best practices andrecommendations for preparing, building, rolling out, andsustaining a secure and successful BYOD program over thelong term.2
PART I: PREPARE YOUR ORGANIZATIONDetermine your BYOD risk toleranceUnderstanding your company’s risk toleranceis the first step to understanding how BYODcan work in your organization. Your company’sindustry may be the main factor determiningyour risk tolerance. For instance, organizationsin healthcare, biotech, financial services, government, or security services will likely adopta more defensive position toward BYOD thanstartup tech companies.Risk tolerance level and impact on BYOD ssdevice choiceMoredevice choiceEmail/calendaronlyConsumer/corporate appsMore restrictivepoliciesFull helpdesk supportMore openpoliciesUserself-help3
Engage stakeholders early to define program goalsOne of the most important steps to developing a BYOD program is gettingearly buy-in from critical players across the company. While it can bedifficult to align the interests of diverse company leaders from executivemanagement, HR, legal, finance, and IT, their support is critical for buildinga successful program.While the approval of executive-level stakeholders is essential, you alsoneed to ensure the program will meet the needs and expectations of endusers. In general, mobile users expect access to the data they need forboth work and personal business, on their device of choice, wherever they are. AnyBYOD program that fails to meet these requirements will likely be rejected by themajority of users.To avoid this outcome, adding one or two employee representatives to the teamcan help you gain valuable input and feedback on end-user preferences, devicerequirements, support and communication needs, and more. Anticipating these andother common objections to BYOD can also help you facilitate the planning phase.EXECUTIVESPONSORSHIPHUMAN RESOURCESFINANCEIT OPERATIONSWe can’t get executivesupport, but let’s move theBYOD plan forward anyway.The company cannot be held responsible forcompromised personal data on employeeowned devices.We can’t fund a program that doesn’t offerdemonstrated cost savings.We cannot support thehuge variety of apps thatthe business wants onpersonal devices.A BYOD project can easilyWorking together, HR and IT should designMany enterprise workers are already using their devices to accessHaving the ability tosponsorship. Becausepersonal data. Also, your end-user agreementWhen the organization enables secure choice computing, it gives ITupdate security policies,derail without executiveBYOD programs requireparticipation from diversestakeholders, executiveleadership is often necessaryto ensure deadlines andresponsibilities are met.clear boundaries between corporate andshould specify that the company may accesspersonal data if the device is subject to forensicanalysis. Also, upon separation from the company, all attempts will be made to preservepersonal data on the employee’s device, buta full data wipe may be issued if deemednecessary.and share company data, email attachments, and other content.a high level of control over corporate apps and data. Secure BYODalso improves user productivity by preserving the native deviceexperience employees already know and love — which directlytranslates to the bottom line. Specific cost savings can be realizedby reducing support costs through an end user, self-service modelthat leverages self-help tools, user support communities, socialnetworks, and user forums.dynamically modify oruser access, andserver configurations onalready deployed mobileapps will reduce theoperational overhead ofmanaging mobile apps.To help resolve these and other concerns from the start, you should form a BYOD steering committee comprised of representatives from all stakeholderdepartments. A steering committee can help groups with different priorities build consensus and define program goals that all stakeholders agree upon.Documenting these goals will serve as a valuable resource to help all stakeholders stay focused on the overall objectives as the BYOD program evolves.4
Survey and communicate with employeesAfter you have determined your company’s BYOD risk toleranceand stakeholder goals, the next step is to issue a short but specificemployee survey across the company. The greater your risktolerance, the more important it is to tailor the survey to capture userpreferences for devices, apps, communication tools, and tech support.To ensure you gather the information needed to design a successfulBYOD program, your survey should include questions that identify: Which OS/devices do employees currently own and plan topurchase in the future? Which factors would encourage BYOD participation? Which factors would discourage BYOD participation? Which corporate apps are most valuable to users? How comfortable are users with self-service support? What is the impact of BYOD on company perception, productivity,and work/life balance?55
Identify your mobile IT capabilitiesNow that you know your BYOD risk tolerance, program goals, and userpreferences, do you know if you have the right people and resources to buildthe program your company needs and users want? A capability assessmentcan help you determine if you have the right people, processes, andtechnology to enable employees to use their preferred devices, apps, andcloud services.A capability assessment is actually a simple checklist of requirements, thestatus of completion or availability and where the capability or task is in theprocurement process. For example, an IT staffing checklist would include all ofthe resources needed to implement the program, whether those resources arecurrently available or not, and who is responsible for bringing those people onboard. Here’s a snapshot of just a few of the staffing requirements you wouldneed to include in the BYOD capability assessment:Please place an ‘X’ in the appropriate columnSufficient staffingReadyPlannedNoneN/ACommentsIT resourcesDevice expertsAndroid: list name(s) iOS: list name(s) Windows 10: list name(s) Device testingDesign process: list name(s) 6
PART II: BUILD THE PROGRAMEnsure your resourcescan support BYODThe technology skills needed to manage a mobile IT infrastructure differ dramatically from thoseneeded to run a traditional desktop enterprise. Procuring the right expertise is critical to executing asuccessful BYOD program. Here are the recommended roles needed to build and sustain BYOD (keepin mind that one individual can wear many hats; you don’t necessarily need one person for each role).Mobile systems engineerMobile device expertA mobile systems engineer is a subject matterexpert for all aspects of mobile technology. This roleencompasses all hardware, software, and networkingtechnologies required to implement a BYOD program.The mobile systems engineer also provides expertisein integrating mobile technologies with enterprisecomponents such as identity, messaging, security,networking, and database services. Their domain ofexpertise includes:A mobile device expert is a “gadget hound” whostays on top of both existing and future devicesand software releases that can impact the mobileinfrastructure. By staying on top of mobiletechnology trends, the device expert can preparethe environment to either support or restrict theuse of new devices. The device expert is fullyversed in popular platforms and manufacturersincluding: Mobile operating systems, such as iOS,Android, and Windows 10 Android: Samsung, Motorola, HTC, LG, Sony,Huawei, Lenovo, Acer, ASUS Carrier networking technologies, such asGSM/CDMA/LTE and underlying protocols Mobile hardware, software, applications, applicationprogramming interfaces (APIs), and developmenttoolkits iOS and macOS: All Apple devices Windows 10: Lumia, HP, Alcatel77
Ensure your resources can support BYOD, continued.Mobile securityexpertMobile applicationsdeveloperMobile service andsupport resourcesA mobile security expert is responsible forestablishing and updating mobile securitypolicies and controls. The mobile securityexpert also educates users on social andbehavioral security risks, sets appropriate usepolicy, and helps develop strategies for:Regardless of whether your enterprisedevelops its own applications or outsourcesmobile app development, you may needonsite app developers with the followingskills:The accelerated lifecycle of mobile devices and servicesrequires an infrastructure that can quickly adapt toconstantly evolving conditions. To respond effectively, yourenterprise must customize the way services and supportare delivered to mobile users, because they have muchdifferent needs and expectations than PC users. To beeffective, mobile service and support resources must beable to: Mobile security and risk mitigation Mobile data protection Mobile OS platform review and positioning Mobile application threat management Experience with application developmentlifecycles and methodologies Ability to design and develop iOS, macOS,Android, and Windows 10 apps Hands-on experience in Objective-C,Cocoa Touch, iOS SDK, XCode, Developerprograms, Java, Google Play, Android SDKand device manufacturer APIs, .NET, WebServices, XML, and HTML5 Strong object-oriented programming anddesign skills Provide self-service tools to help improve usersatisfaction and reduce costs. Establish a core mobile support group that manages allmobile escalations. Develop and distribute knowledge base articles, supportscripts, and procedures to all users. Share knowledge through social networking and mobilecommunities. Establish clear and regular communication acrossmultiple channels to keep users up to date on servicestatus and changes.8
The eightcomponentsof a successfulBYOD strategySUSTAINABILITYDEVICE SELECTIONMaintain a positive user experience.While cost and security concerns areimportant issues to manage, BYODprogram sustainability depends ondelivering a consistently positive userexperience over the long haul.It’s a popularity contest.Survey employees to determine whichdevices and platforms they currently useand are intending to purchase. Include asmany of these devices as possible when theprogram launches to maximize employeeparticipation.INTERNAL MARKETINGLIABILITYBuild your IT “brand.”Promote your BYODprogram as a corporate effortto support work/life balancethrough increased mobilityand flexibility, and position ITas an ally to the modern,mobile workforce.Protect your companyfrom legal action.Define and implement clearpolicies and procedures thatprotect your company fromthreats ranging from the loss ofintellectual property andconfidential customer data, tolegal action, fines, and damageto reputation resulting fromdata leaks.APP DESIGN ANDGOVERNANCEUSER EXPERIENCEAND PRIVACYEnforce security withoutcompromising the user experience.In a BYOD environment, apps involvesensitive enterprise data, which can easilybe compromised if the device is accidentallylost or targeted by a mobile attack. Yourorganization will therefore want enoughvisibility and control to protect corporate appsand data without monitoring a user’s personalactivity on their own devices.Establish employee trust.Clear communicationregarding privacy, and theestablishment of a socialcontract between thecompany and its employeesthat clearly defines the BYODrelationship, are critical forestablishing employee igate security risks.Building a trust model that identifies how and when adevice falls out of compliance, steps for remediation, andthe extent to which these actions are acceptable to users isabsolutely essential.Control the costs of doing BYOD.Determine how best to structure financialaspects of your BYOD program so thatyour company realizes maximum returnon investment.9
Eight components of a successful BYOD strategy, continued.1Sustainability:2Trust model:Maintain a positive user experienceEstablish mobile-centric, zero trust securityMany companies rush to create BYOD policies and processes thatToday, the average employee uses several devices for work, includingare mainly concerned about implementation costs and security, andsheer number and range of these devices -- whether owned by the employeeare not sustainable over the long term. Understandably, enterprisestend to focus on those issues in the beginning. But without respectfor the user experience, the BYOD program may never even get offthe ground. Here’s why: If BYOD policies are overly restrictive, lackadequate support for employees’ preferred devices or are simply toocomplex and confusing, employees will find a way to either circumventthe policies or end their participation altogether. In both instances, theneeds of the company are not met – either security is compromisedor business value is lost. So while cost and security concerns areimportant issues to manage, BYOD program sustainability dependscompletely on delivering a consistently positive user experience overthe long haul.desktops, laptops, tablets, smartphones, and wearables. Managing theor company -- has introduced extremely dynamic and complex securityissues. A mobile-centric, zero trust approach to security is the best way toprotect company data in an era where IT’s traditional static perimeter hasgiven way to the perimeter-less mobile enterprise. A mobile-centric, zerotrust model enables you to: Provision any device (including BYOD) for a user with the appropriateapps, profiles, and policies.Grant access based on full context (user, device, app, network, threat,time, location, and OS).Protect data at rest and in motion by containerizing and eliminatingthreats on the device.Enforce security policies (user, device, app, network, threat, time,location and OS).10
Eight Components of a Successful BYOD Strategy, continued.3Device selection:It’s a popularity contestBased on feedback from your initial employee survey, you should have agood idea about which devices and platforms employees currently use andare intending to purchase. You should include as many of these devices aspossible when the program launches to maximize employee participation.In addition, your device selection process should include all of the desiredmobile platforms in the program as long as they meet your security andsupport requirements, such as asset management, encryption, passwordpolicy, remote lock/wipe, and email/Wi-Fi/VPN configuration. Without thesebasics, the mobile platform is not viable for the enterprise. Develop a certification plan to ensure that future devices can be quickly andefficiently evaluated for possible inclusion in your program. Clearly identify which devices are allowed (or not) and why, otherwiseemployees may purchase devices your program doesn’t support. Ensure your IT team maintains expertise and knowledge about constantlyevolving mobile devices and operating systems, otherwise your BYODprogram can quickly become obsolete.4Liability:Protect your company from legal actionIntroducing a BYOD program may also introduce new liabilityconcerns to your business. As part of your BYOD program, youneed clear policies and procedures that protect your company fromthreats ranging from the loss of intellectual property and confidentialcustomer data to legal action, fines, and reputation damage resultingfrom data leaks.While every business needs to seek specific legal counsel on BYODliability, your mobile device policy or end-user agreement shouldinclude: Security policies for enterprise data on personal devices (especiallysince different types of security may be required on different devices.For example, more protection against over-privileged consumerapps might be required on Android vs. iOS). Policies for personal web and app usage (during and after businesshours, onsite, and offsite). Clear limitations for company liability due to the device owner’spersonal data loss. Understanding of how BYOD reimbursement (partial stipend vs. fullpayment of service costs) affects company liability.11
Eight Components of a Successful BYOD Strategy, continued.5User experience and privacy:6Economics:Establish employee trustThe cost of doing BYODOptimizing the user experience should be a top priority for your BYODprogram. Clear communication over sensitive topics such as privacy is criticalfor establishing employee trust. Therefore, a social contract that clearly definesthe BYOD relationship must be established between the company and youremployees. The contract is a well-defined agreement that helps:It’s never too early to determine how to structure the financial aspectsof your BYOD program. Key issues to consider include how to: Identify the activities and data that IT will monitor on the device, such as appinventory, to protect against rogue apps that could compromise enterprisedata. Clarify which security actions IT will take in response to certain circumstances. Define granular controls such as activity monitoring, location tracking, andapplication visibility. Critically assess security policies and restrictions to ensure they are not overlyrestrictive. Identify core services, such as email and mission-critical apps, that the companycan deploy to the employee’s device. Pay for devices and service. Determine if the employee will be 100percent responsible for device and service costs, or if the companywill pay a full or partial stipend. Leverage agreements with mobile operators to provide business,concierge, and self-service options to users. Explore existing telecom services and processes and, wherepossible, offer corporate discounts to users, including waivers oftermination fees and early upgrade allowances. Research new carrier services and plans that can improve andenhance the BYOD program. Save money on help-desk resources by implementing self-helpservices. Preserve the native experience so employees can continue to use theirpreferred apps for everyday functions. Communicate when employee devices are out of compliance, the possibleconsequences, and
1 The ultimate guide to BYOD MKT EN 0219 US V6 490 East Middlefield Road, Mountain View, CA 94043 Tel
