HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY

Transcription

1 HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY

2 MINIMIZE BYOA RISKS INTRODUCTION 2 What is BYOD? Why is BYOD a Good Thing? What is BYOA? THE DANGERS OF BYOA 4 How to Control BYOA The BYOA Policy Conclusion BIBLIOGRAPHY 8 HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 1

3 INTRODUCTION BYOD policies are becoming increasingly more common. According to a survey performed by TechPro, over 75 percent of companies surveyed already have or were planning to implement a BYOD policy.1 And for companies that haven t, it s only a matter of time. Employees have been using their own devices for years, and it s actually become riskier to not have a BYOD policy in place. WHAT IS BYOD? BYOD stands for Bring Your Own Device, when a company allows employees to use their personal devices for work purposes. These devices can be smartphones, tablets, laptops, or any other company-sanctioned device. They can be used with businessowned devices interchangeably. WHY IS BYOD A GOOD THING? While going BYOD brings their own challenges, the benefits definitely outweigh drawbacks. The most obvious benefit is the cost. When employees bring their own devices, employers do not have to pay for that device. While some companies do choose to reimburse employees, either fully or partially, most do not. Allowing employees to use their own devices helps the bottom line. As many businesses move to more flexible schedules, BYOD policies will become more important than ever. That s because flexibility is another benefit BYOD offers. Because employees are so comfortable using their own devices, having the ability to work from them with well-crafted BYOD policies means they are able to work productively outside of the office. Thus employees can work effectively wherever they are, be it a vacation in the Bahamas or in their living room with a sick child. That flexibility often means employees are putting in more hours than they realize. One study found that employees that work for companies with BYOD policies put in an average of two additional hours a day.2 Finally, most employees are happier using their own devices. They re familiar with their own devices, so they know exactly where to find everything and how to use it. This is especially true when companies use PCs and employees prefer Apple products. Allowing employees to use their own devices tends to increase employees satisfaction with their jobs and the company. With BYOD becoming more popular than ever, BYOA, or Bring Your Own App, is bringing with it its own challenges and benefits. WHAT IS BYOA? BYOA stands for Bring Your Own App. Like BYOD, it developed organically within companies thanks to employees going outside HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 2

4 the company sanctioned applications and software to find solutions that met their technology needs. If employees need to share files and the company doesn t have a dedicated app for it, employees will inevitably turn to apps like Dropbox and Google Docs. If they want to communicate outside of formal company channels they ll turn to apps like WhatsApp or even SnapChat. These employees believe (and often rightly so) that the company s IT structure has fallen behind, and they would rather use outside applications than deal with the company s technologically delayed solutions. In a 2014 Stratecast and McAfee study, more than 80 percent of those surveyed admitted they had used some form of SaaS not sanctioned by their company.3 It s important to realize that even if it isn t being talked about, it s happening in companies of all sizes. HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 3

5 THE DANGERS OF BYOA BYOA allows employees to pick and choose what apps work best for them, which can make them more productive than if they had to rely on outdated company technology. Unfortunately, there are many dangers associated with BYOA. And unlike BYOD policies, the dangers may outweigh the benefits. The most obvious danger BYOA brings to the table is an increased security risk. BYOD already introduces security challenges, but when those devices are using an even more varied system of applications to access, share, and save company data the risk is exponential. Spyware, malware, and viruses are always possible, but even more so when unmonitored apps are in use. Even the most reputable SaaS is vulnerable. In 2014 Salesforce. com was hit by malware.4 This malware was designed to bypass security and steal the login credentials for SaaS users, which could then be used to access and steal sensitive information. While people tend to think of malware getting into their organization through phishing s, it can actually be downloaded without users even knowing it. If large and very credible companies like Salesforce.com can come under attack, any company can. And with each app employees are downloading and using to handle company data, they are opening the company to new risks and dangers. It s also possible for information to be accessed by outside parties without malicious intent like malware and viruses. Employee error is actually one of the most common causes for data breaches according to a 2015 report.6 Not because the employee intended to cause harm, but because they allowed someone outside the company to have access to sensitive data. Since applications are managed by users, it s difficult to ensure the information stays secure. Employees can create folders and files and share them with anyone they want simply by sharing a link. Of course, this issue isn t solely an application problem. Employee error was the cause of the data breach at the Department of Veteran Affairs.7 A laptop and external hard drive containing an unencrypted database with sensitive data for 26.5 million veterans, active-duty military personnel and spouses were stolen from a VA analyst's Maryland home. The devices were later recovered, but it s still an example of how dangerous employee error can be. Another danger is the lack of centralization. When different departments and even different employees in the same department are using different apps to store and share data, the odds of miscommunication are high. And if employees are storing important data on apps of their choosing, there is nothing that can be done if that employee decides to leave the HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 4

6 company. When data is stored elsewhere and is not monitored by the company, the employee can do whatever they want with it. And that includes choosing to not ensure all information and data gets back to the company before they leave. On the other hand, there s also risk when former employees retain access to company data after they are no longer with the company. While most employees will never do anything with that data, a study revealed one in sixteen former employees actually shared data with others after they left the company.5 Unfortunately, some employees don t wait until they ve left the company to misuse company data. Microsoft faced this problem in 2012 when an employee leaked Windows updates and software.8 The employee used and Skydrive (now called Microsoft OneDrive) to share trade secrets with a French blogger. HOW TO CONTROL BYOA Before BYOA can be controlled, it must be understood. Companies should strive to understand what apps their employees are turning to and why. It s likely that employees think the company s solutions are outdated. One study shows that 76 percent of IT workers acknowledge their company offers only outdated tools and that employees needs are not being met.9 And more than half of those workers know and understand why employees are going outside approved applications to find solutions that work for them, even though the information security risks of those applications are much higher than the company approved tools. The general reason employees are using outside apps may be that internal technology, but companies must delve further into why employees are choosing each individual app. Conducting a survey about what specific apps employees are using and why they chose that particular app will help companies understand exactly where they are falling behind. While there will likely be a wide variety of apps reported, most companies will see a pattern and be able to determine where exactly the gaps in their current IT infrastructure lie. The next step is to determine what to do next. If nearly every employee is using the same application, it s time to explore that app. Clearly it has become an essential part of daily work for most employees, and it s time to weigh the risk that comes with using it and the risk of taking it away from employees. Depending on the size of the company, it might be useful to talk to the app vendor. Some small-to-medium size businesses may benefit from a formal relationship with the vendor of a popular app. It might be possible to implement more security features to allow employees to keep using it safely. Employees are already familiar with the app, the data is already out there, and it can be a very affordable solution. Of course, not all applications offer additional security features and even those that do may not offer enough additional protection, so this isn t an option for every app or every business. Whether a company formalizes a relationship with vendors or not, it s crucial to formalize a BYOA policy. HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 5

7 THE BYOA POLICY Once a company understands what their IT infrastructure is lacking, what apps are currently being used, and what the risks and benefits of each app are, it can determine what apps will be officially approved and set a policy for the use of additional apps in the future. It would be virtually impossible to enforce a strict no BYOA policy, so it s important to strictly define what apps are company approved but also what can be done with those apps. If a file sharing app is something a company deems necessary, there should be specific rules for using the app. Clearly define and list what is and what is not allowed to be stored in that app. It s crucial to strike the right balance between employee productive and information security. Some things like Social Security Numbers or credit card information may need to be expressly forbidden from being anywhere in the data stored in the now-approved external app because security of that information is more important than employee productivity. Once the approved apps and approved uses have been detailed, a good BYOA policy should make it clear that any other apps are prohibited. It would also be a good idea to include a method for employees to submit apps for consideration in the future. There are always new apps being introduced, and one might be a good fit for your business. But with a BYOA policy in place, IT should be brought in to evaluate the app before it is approved. HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 6

8 An in-house directory will allow employees to see what apps are allowed. Some companies are going as far as creating their own app store to make it as easy as possible for employees to find company-approved apps. As many as twenty-five percent of companies will have this kind of store in place by 2017 to keep employees as productive as possible and to keep company data as secure as possible.10 To ensure employees abide by the new BYOA policy, it s important to educate them on the security risks associated with using unapproved apps. It s hard to believe, but many employees don t understand or worse, don t care about the risks associated with BYOA and BYOD policies. Employers must impress upon employees how serious the risks are and enforce the policies company wide. While employees should face consequences for not complying, companies shouldn t go overboard with punishment. Disgruntled employees can actually be a huge security risk unto themselves.11 company data. At Beekeeper we re mindful of security issues like encryption, storage, and third-party access when designing our product. For example, Beekeeper doesn t scrape our user s third-party contacts from their address book, staying clear of data privacy issues. In fact, a phone number or address isn t even required to login to our application. Instead, companies can onboard employees simply by assigning them an employee ID. Additionally, we give our customers the option to choose where to store their data: the US, Switzerland, Germany, or Ireland. So EU-based companies data can be guaranteed to be stored in the EU, ensuring compliance with the regulations in each company s country. Enterprise solutions like Beekeeper were specifically designed to work for companies, and are much better suited for regular business use than apps like WhatsApp that were designed for personal use. CONCLUSION When implemented correctly, there is no need to fear BYOD. It s still unclear exactly how safe BYOA is, though. If a company isn t willing to risk the safety of their data by using third-party apps, there is another way. Finding a secure enterprise solution that will replicate the function of apps being used by rogue employees is the answer. Employees will be able to have their IT needs met and keep up their productivity, and the company will be comfortable with the higher level of security and control of all HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 7

9 BIBLIOGRAPHY 1 Wearables, BYOD and IoT: Current and future plans in the enterprise - Tech Pro Research. (2015, January). Retrieved June 08, 2016, from downloads/wearables-byod-and-iot-current-and-futureplans-in-the-enterprise/ 2 Kaneshige, T. (2014, August 18). BYOD Twists and Turns Keep CIOs Off-Balance. Retrieved June 08, 2016, from cio.com/article/ /byod/byod-twists-and-turns-keepcios-off-balance.html 3 Frost & Sullivan, & Stratecast. (2013, November). The Hidden Truth Behind Shadow IT [An Executive Brief Sponsored by McAfee]. 4 Narayan, K. (2014, September 12). Dyre Straits: Why This Cloud Attack's Different - InformationWeek. Retrieved June 08, 2016, from software-as-a-service/dyre-straits-why-this-cloud-attacksdifferent/a/d-id/ Oysterman Research Inc. (2014, August). Do Ex-Employees Still Have Access to Your Corporate Data? [An Osterman Research White Paper]. 6 Association of Corporate Counsel. (2015, December 9). ACC Foundation: The State of Cybersecurity Report. acc.com/legalresources/resource.cfm?show= Peters, C. (2014, March 20). Ex-Microsoft employee charged with leaking trade secrets to blogger. Retrieved June 08, 2016, from 8 Mosquera, M. (2012, May 24). 6 lasting effects of 2006 VA data breach on privacy, security. Retrieved June 08, 2016, from va-data-breach-privacy-security 9 Kaneshige, T. (2014, August 19). Workers Going Rogue With BYOD (and BYOA). Retrieved June 08, 2016, from cio.com/article/ /byod/workers-going-rogue-withbyod-and-byoa.html 10 Gartner. (2013, February 12). Gartner Says That by 2017, 25 Percent of Enterprises Will Have an Enterprise App Store [Press release]. Gartner. Retrieved June 8, 2016, from HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 8

10 11 Kaneshige, T. (2014, April 25). CIOs Face BYOD Hard Reality: Employees Don't Care. Retrieved June 08, 2016, from HOW TO MINIMIZE BYOA RISKS WHEN ROLLING OUT YOUR BYOD POLICY 9

11 615 Battery St. 6th Floor San Francisco, CA United States 1855beekeeper START FREE TRIAL Hönggerstrasse Zurich Switzerland