BYOD (Bring Your Own Device)
12. July 2021
BYOD (Bring Your Own Device)
“Bring Your Own Device” is a highly topical issue in our working world. The pandemic has forced many companies to send employees to home office, although the infrastructure was not ready for this and in many cases still is not. Since many employees did not have a laptop, a VPN connection was installed on the private devices in order to then connect them to the company network: Emails on the cell phone, documents on the tablet, and the “family PC” in the company network. All of this can have serious consequences for a company.
Anyone who wants to implement BYOD securely in their company must first analyze exactly which services and data are necessary for the respective employees. It is important to consider which employees have access to what in which areas and in which they do not. In any case, this plan should be discussed with an IT expert and implemented if necessary.
Untrained staff
Untrained staff is the most common cause of a security incident in a company. Employees are often unable to recognize threats in time and respond appropriately. Therefore, it is important to create IT awareness and provide ALL employees with a basic understanding of this issue. Most security incidents do not occur deliberately or with malicious intent, but simply because employees do not know what to look out for. Of course, it is irrelevant whether the employees are in home office or sitting at their workstation in the office.
Central points of awareness training:
- Dealing with passwords
- How do I recognize a (spear) phishing e-mail?
- What is CEO Fraud?
- How do I deal with USB sticks?
- etc…
Home Office
Basically, it is clear that an unprotected end device is not connected in the company – but what is the difference if a “stranger” is allowed to connect to the company network or a “private” PC is connected with VPN?
A corporate device is subject to all security policies, such as endpoint security, password policy, update policy, etc… Private computers, on the other hand, are not. Devices that are not protected and may even have already been infiltrated naturally carry high risk and, in the worst cases, lead to the encryption of a company and/or the loss of data.
Therefore, it is important to connect only those devices to the corporate network that also comply with the company’s security policies and to provide employees with such a device. If clients are located in a foreign network, it is even more important to protect them with a “Next Generation Endpoint”. Traditional virus scanners have long been outdated and offer little protection.
Dealing with smartphones
When installing an app, it is important to ensure that it comes from a trustworthy publisher. It does not matter whether it is Android or iOS.
Use the lock function
Whether using a PIN or a biometric function such as facial recognition or a fingerprint, it is important to use the lock function on your own device. In case of loss or theft, the data cannot be read from the device without unlocking it first.
Features and benefits:
- Unlocking mobile devices
- Payment in the app store
- The sensor is integrated directly into the operating system
- Data is stored on a separate chip and is protected against attacks
Access authorization of the apps
After installing an app, every access to the apps should not be allowed carelessly. In some cases, the app wants to access contacts or photos but has nothing to do with them in any way. Example: Why should a weather app be allowed to access contacts? Why would a delivery service’s app need access to the camera or microphone? These are all issues that app users should think about.
Get more info from:
Stefan Reisinger
IT Consultant
+43 50 756 336
s.reisinger@delta.at
