BYOD (Bring Your Own Device) isn’t just a fad, it’s here and now and it’s not going anywhere. That’s why it is important to put BYOD policies into place as soon as possible. A secure BYOD policy is essential to making sure that questions of privacy, security and expectations are addressed in a manner that is acceptable to both employer and employee.
The details of any bring your own device (BYOD) policy will be specific to a given organization, but most policies cover many of the same basic questions. Use these tips as guidelines in creating your BYOD policy.
1) Determine the Goals of your BYOD Policy
- Figure out your objectives and explain why you feel BYOD is a good fit for your organization. Some employees may need convincing and this is a good place to start.
2) Review your Current Web Application Security Policies
- For example: portals, email, CRM, VPN, and remote access.
- Make sure to especially take mobile devices into consideration. Most of these will apply to mobile devices as well.
3) Make a Determination About What Devices to Support and What Not to Support
- Survey employees and see what devices and applications they are currently using.
- State which devices, versions, and operating systems will be supported based on what they need to do their jobs.
4) Establish User Roles and Rules
- Not everyone needs access to the same applications.
- For example: Marketing may need access to social media while accounting does not.
5) Whitelisting and Blacklisting Apps
- Explain that IT has the authority to prohibit the use of certain apps.
- Provide users with clear lists of what apps are allowed and which ones are prohibited.
6) Explain Exactly What Charges the Organization Will and Won’t Reimburse
- Some organizations choose to pay for the users’ device, cover a percentage of their monthly bill, or nothing at all. The important thing is to state this is the policy.
7) Define Levels of Support
- Will your IT staff provide support to these devices?
8) Collaboration is Key
- Creating this policy is no the job of just one or two people.
- You should build a team including HR, IT Support, IT Security, legal, and other stakeholders.
9) Don’t Try to Force-Fit a Policy
- There’s no one-size-fits-all solution for something like this.
10) Make Sure You are Protected Legally
- Include a liability clause for damage, data deletion, and corruption.
11) Have Every Mobile Device User Sign a Written Agreement
-This will not only protect your organization but also prevent misunderstandings about the BYOD policy and expectations.
- When changes to the BYOD policy do occur, because chances are they will, be sure to have employees sign an agreement to the changes.
12) Consider Anti-Virus and Anti-Malware Installations, Encryption Installation, Updates and Patches
-You must have consistency in security software and applications installed on all personal and corporate devices.
13) Make a Personal Identification Number (PIN) Mandatory for All Devices
-Yes, you actually have to tell people to do this even though they should be doing so already.
14) Regular Reviews of Policies and Agreements are Essential
-Working on your BYOD policy is not a one-time thing and then you’re done. As time goes by, amendments will need to be made.
- Plan on reviewing your policy at least once a year.
15) Make Centralized Management, Reporting, and Auditability in Mobile Apps Required
16) Create Consequences for Noncompliance
- Consider denying the user access to the network, excluding them from the BYOD program, or even termination in a severe enough case.
17) Define Ownership of Information
- Consider who owns the data that may be held on the employee’s device and whether the company has the right to access it directly from the device.
18) Determine an Employee Exit Plan
- Many companies disable emails or synchronization access before the employee exits, or even a mandatory wipe of the device.
- It’s important to make sure this is clearly stated in the BYOD policy so employees are fully aware ahead of time.
19) Encrypt Sensitive Data Stored on Personal Devices with Strong Encryption
-Lay out fully your enforcement of encrypted data and block devices that do not have encryption enabled from the network.
20) Create a Strategy Dealing with Sold, Recycled, Lost, or Stolen Devices
- A common strategy is to enable remote wiping of the device's data.
- Make sure this is also clearly stated and required for everyone participating in the BYOD program.
Research has shown BYOD will only continue its rapid proliferation. It’s not going anywhere whether you like it or not. Employees will only continue to bring more and more devices into the workplace. So, get smart and start building your BYOD policy and prepare and secure your wireless network appropriately.
If you need have any questions about BYOD or where to begin we can help. Here at SecurEdge Networks, we specialize in building completely secure wireless networking solutions and always plan for the future of mobile devices. Contact us here with any questions about BYOD or for a free consultation. Our goal is to be a resource for you!
