BYOD in case you didn’t already know stands for Bring Your Own Device. There are lots of benefits to implementing a BYOD policy: improved productivity, cost-reduction, improves employee satisfaction but poorly thought-through BYOD policies are a growing concern for organisations. If you’re not managing your organisation’s BYOD/remote working policy properly, it can pose a host of security risks to your company. Employees often bring their personal devices wherever they go. This means there’s a higher chance of devices, as well as the data stored in them, being lost or stolen. BYOD also increases the potential for man-in-the-middle (MITM) attacks. Cybercriminals can intercept information transmitted from employees’ devices if these are connected to poorly secured public Wi-Fi networks. Allowing employees to use their own devices also risks employees using jailbroken devices. Jailbreaking is the process of removing the restrictions imposed by the manufacturer of a device, typically to allow the installation of unauthorized third-party software. This increases the risk of an employee inadvertently installing malicious software on a personal device. If employees have outdated operating systems and software on their devices, cybercriminals can exploit unpatched vulnerabilities to gain unfettered access to company systems. Furthermore, a personal device that has been infected with malware can spread that malware to other devices that are connected to the company network and cause data loss and downtime. Employees connecting their devices to home and public WiFi networks while working remotely puts company data at risk. Without a secure network with a firewall as you should have at the workplace, your data is free for anyone to access.
To mitigate these risks, it is strongly advised that you devise a BYOD and remote working security policy that works for the needs of your organisation as well as the needs of your employees.
Here are some tips to help get you started:
Set Passwords on All BYOD / Remote Working Devices
Prevent unauthorized access to company data by enforcing the use of passwords on all employee devices and accounts. Passwords should be unique; contain letters, numbers, and symbols; and are at least 12 characters long. It’s also a good idea to implement multifactor authentication to add another method of identity verification such as fingerprint scans or temporary passcodes sent via email.
Restrict Data Access
Adopt the principle of least privilege on both BYOD and company devices. This means that a user is able to access only the data and software required to do their job. This can reduce the effects of certain types of malware and limit the fallout in the event of a data breach.
Blacklist Unsanctioned Applications
Blacklisting involves prohibiting the installation of certain applications on BYOD devices that are used for work purposes. This includes applications like games, social networking apps, and third-party file sharing platforms. The simplest way to blacklist applications is through a mobile device management platform that enables IT administrators to secure and enforce policies on enrolled devices.
Invest in Anti-Malware Software
Anti-malware software identifies and removes malware before they cause irreparable harm to a device. The best anti-malware programs are often backed by the latest threat intelligence databases and use behaviour-based detection techniques to pick up any traces of malware.
Back Up Device Data
A well-thought-out remote working policy can go a long way toward minimizing the risk of a security breach, but if something manages to slip past your defences, you need to have backups prepared. Back up your data in off-site servers and in the cloud to ensure that any data stored locally on a device can be quickly recovered.
Educate Your Staff About Security
The vast majority of BYOD and remote working related security risks involve human error. Therefore, you should educate your employees about proper mobile safety. Train them on spotting apps that could contain malware, sharing security threat updates, and securing their devices beyond enabling default security settings.
Need any more assistance with cyber security for your business? Or any area of managed IT for that matter. Let us give you the helping hand you’re looking for. Spire is a professional managed IT services provider with decades of experience so don’t hesitate to get in touch. Give us a call on 0330 205 0250 or check out our contact page.
