A bring your own device (BYOD) policy can help a company save money while bringing the business into 21st century. But just because employees purchase and use their own devices doesn’t mean that your company has no control over them. It is not only possible, but necessary to create a secure BYOD policy to protect your enterprise and its confidential information. Here are five steps to help your company create a secure BYOD policy.
Just because you allow employees to purchase their own devices, does not mean your company has to allow them to purchase any device they desire. Create a policy that specifies purchasing devices that support encryption and management to help protect your company’s data when employees are accessing information via the Internet.
An MDM, or mobile device management tool, can help your company maintain vital control over devices. While a company may have certain security policies in place, it is not always possible to monitor employees to make sure that they comply with these policies. A MDM allows the company’s tech support department to create a system that will enforce security policies and only allow employees and their devices to access certain areas or specific mobile apps.
There are many fantastic third party applications available for mobile phones. These third-party applications, however, can also make a mobile device vulnerable to a hacker attack. Create custom applications for the standard functions that employees will have to perform for the business. This means that they will not have to resort to consumer apps for business applications. You can make sure that this policy is enforced by utilizing MDM tools.
Institute Data Wipe Protocols
One downside of a BYOD policy is that the company can be made vulnerable if an employee loses their mobile device. Institute a remote data wipe policy, performed through MDM tools, in order to ensure that a lost device does not give a stranger access to sensitive company information.
Create Access Levels
It is important to create access levels for employees so that they can’t enter all areas of a company intranet via a mobile device. Just as a business have access levels and security measures for sensitive areas of an intranet in-house, it is important to make sure employees have restricted access while on the go. Not only does this prevent employees from entering areas that contain sensitive information, it also reduces the risk of a hacker accessing this information if the security of a mobile device has been breached.
It is possible to have a secure BYOD policy. Businesses need to determine why they want employees to be able to use their own mobile devices for business purposes. Then they need to look at a list of the possible risks that are involved with this type of policy. Finally they need to manage the devices the employees’ purchase and use mobile device management tools, restricted device purchases, data wipes and mobile apps to help reduce some of the vulnerabilities that can occur with multiple devices being able to access the company’s intranet system.
This was first published on my Web2 and More blog: Fergal Glynn is the Director of Product Marketing at Veracode.com, an award-winning application security company specializing in secure SDLC and other security breaches with effective risk assessment tools