How to Manage Employees Devices Properly: Employee Device Management

If you and your stakeholders are aware of the risks above, then you’ve already begun your mobile security risk assessment. 

Awareness is both the first and last step of evaluating and managing the risks that may affect your mobile workforce. We also recommend identifying company assets and planning for exits and crises. 

Improve mobile security awareness. Security Awareness Training (SAT) starts with you. If you’re reading this, you’re probably responsible for the information security at your company. Don’t keep that responsibility to yourself; share. 

• Share research on the latest threats.
• Share tips on reducing risk.
• Share your organization’s security policies – regularly.

If you don’t have the time or resources for in-house training, many online cybersecurity awareness training courses cover mobile security – and offer a certificate to show completion (so you know your staff is taking this seriously). 

Mobile security awareness training, coupled with MDM technology, is your greatest defense against risk. We’ll cover MDM later. 

Identify company assets. A data breach could cost your company $3.86 million on average, according to the Ponemon Institute’s 2018 study – and much much more if it’s a mega breach involving 50 million records which might cost $350 million (or billions if you’re Equifax). 

The threat is real and stakes are high. 

Interestingly enough, Ponemon notes you’re more likely to experience a data breach of at least 10,000 records than you are to catch the winter flu (which is good news in the days of Corona). 

Securing your digital assets from mobile data leaks and other mobile security threats involves a little stock taking.

• What is considered sensitive data?
• How do you collect, store and transfer data?
• Who has access to your data?
• Do mobile devices have access to your data?
• Where does sensitive data change hands?
• Can a lost or stolen device compromise your data?
• What are the consequences of a data breach?

“Analyzing how mobility could lead to data loss feels like a shot in the dark. At a moving target, with a blindfold on.” - Michael Davis, CISO, CTO, Author

But an assessment may indicate the risk is lower or different than you might expect, as in Davis’ case when he realized mobile phones couldn’t reach his company’s accounting software, but employees could share financial data via email.

Plan for exits and crises. You probably have an onboarding plan, but do you have an offboarding and WTSHTF plan?

What happens when you fire a disgruntled employee who has access to your entire database? What happens when your developer leaves? HR? Sales?

• How long do you wait to wipe devices and change passwords?
• Do you know what devices were being used?
• Were they approved devices?
• Were they BYOD or company-issued?
• What applications were they using?
• What level of access did they have?
• Where did they store data?
• Who owns the data on their phones?
• Can you legally wipe their phones?

You need a plan, not only for fires, but also for your run-of-the-mill “I found the job of my dreams” exits. Because you never know. Though this article is about threats to mobile devices, people are your greatest security threats – often unwittingly.  

A recent white paper found 87% of employees surveyed admitted they took data they created upon leaving a company.

What if they use that data maliciously or they are hit by a phishing scam such as the Coronavirus fake-map scam that infects devices with information-stealing malware?

You need to prepare – for anything.

Exits

• Ensure HR and IT are on the same page.
• Review non-disclosure agreements and security policies.
• Retrieve company-issued devices.
• Wipe corporate apps and data.
• Disable company email.
• Revoke access to systems and applications.
• Change passwords to company accounts.
• Monitor suspicious activity.

Crisis

• Document your risks and assets.
• Build and train an incident response team.
• Create an incident report system.
• Prepare an incident notification list.
• Backup critical data.
• Ensure incidents can be handled remotely.
• Practice incident response.

It’s getting tougher and tougher to stay ahead of threats, but a little planning will help you offboard employees with minimal risk and shorten the duration of any crisis.

Key Takeaway:

The rise in mobility and cloud computing creates favorable conditions for cyber attacks just as dynamic as the devices they attack. Your initial assessment is just the beginning. It’s part of an on-going strategy to understand your risks, educate your staff and plan your defense.

“For Health and Safety Reasons“, by Paul Noth, is licensed under CC By 4.0

2. Implement a BYOD & remote access policy

In a short time, working from home (WFH) has grown from 5.2% of workers (in the U.S.) to most people working from home. This is meant to keep them safe from the Coronavirus outbreak. They know what to do. The internet is flooded with tips on personal hygiene.  

• Stay inside.
• Wash your hands.
• Don’t touch your face.
• Sneeze into your elbow.
• Wear a mask.
• Keep your distance.

But what about cyber hygiene?

Most people are willing to change their habits and routines during this challenging time, but they aren’t willing to give up their personal devices. 61% of Gen Y and 50% of 30+ workers believe BYOD tools make them more productive. 

This opens up a can of worms for employers and employees alike, warns QUT researcher, Dr. Kenan Degirmenci. BYOD and, more broadly speaking, mobile access to enterprise systems, presents unique security challenges that cannot be ignored. 

“Organizations aren’t moving quickly enough on cybersecurity threats linked to the drive toward using personal mobile devices in the workplace.”

- Dr. Kenan Degirmenci, Researcher, QUT (Paraphrased)

The time to act is now. 

While the world is suffering from a public health crisis, you can prevent an organizational cyber crisis by laying out some ground rules. You don’t want to assume your employees are obtuse, but you also didn’t want to tell them to wash their hands.

A BYOD and remote access policy can safeguard your company – and your employees – against mobile security threats. 

We suggest covering the following:

• Allowable Devices & Applications
• Mobile App Vetting & App Stores
• Secure Configuration
• Acceptable Use & Misuse
• Authentication & Password Management
• Access Privileges & Permissions
• Social Media & Email Safety
• Browser & Web Application Security
• Encryption & Secure Connection Methods
• Privacy, Compliance & Confidentiality
• Separation of Personal & Corporate Data
• Data Loss Prevention (DLP) Strategies
• Security Patches & Software Updates

Your BYOD and remote access policy should cover a range of endpoint, network and cloud security guidelines – ranging from what might seem like common sense tips to technical configurations meant to reduce exposure to hackers.

"Whether an employee intends to or not, their device may introduce cyber threats to the network that are difficult to control, as the device is not managed."

- Nilly Assia, CMO, Portnox

If you want to ensure your employees’ devices are compliant with your policies, a Mobile Device Management solution is worth trying. You might also benefit from a network visibility and control solution that quarantines devices that do not meet your mobile security requirements. No pun intended. 

Key Takeaway:

The sudden exodus of workers from offices to their homes – and in many cases from company-owned devices to BYOD – is a great time to create a mobile device policy and exercise a little control. That said: you should be realistic about what your IT department can realistically handle, where you must turn over control to your employees and how you can all work together to mitigate your risk.

Video: BYOD - bring your own device policy

All solutions have slightly different features, but most platforms allow you to:

• Control Access
• Manage Apps
• Enforce Policy
• Update Over-the-Air (OTA)
• Troubleshoot Devices
• Track Devices
• Remote Wipe

MDM is essentially about control and insight – getting a grip on what a user can do with a device and what happens to corporate data on a device – while also understanding how devices are used to access corporate networks.

The best results are obtained with a thoughtfully considered MDM implementation – rather than simply putting in place an off the shelf MDM solution. 

Your MDM solution will be most successful if you:

Maximize self-service and autonomy. Employees enjoy the flexibility of BYOD. Reducing these flexibilities too much should be avoided; it can backfire. Moreover, MDM that delivers user autonomy can reduce the strain on IT support staff – giving the ability to reset passwords, tracking lost devices, etc, to the end user.

Keep end-user privacy. Your employees may be using their devices for a mix of personal and business use. While MDM can gain control over these devices, it should not be at the expense of user privacy – and you don’t want to find yourself in a legal battle over lost personal data.   

Consider your policies. The out-of-the-box policies of most MDM platforms can provide a solid start, but don’t skimp on refining these policies for the purposes of your organization. MDM policies can be incredibly granular – twisting and shaping to match your organizational requirements.

Require updates. Across the board, your MDM strategy should involve frequent updating – refreshing the MDM software in use, ensuring that devices are running the latest OS – and also running the latest versions of apps. Doing so will minimize the security holes that are common with unpatched software.

Key Takeaway:

MDM is essential to mitigating the risks posed by BYOD and mobile devices, but a watertight security approach involves a broad approach. Yes, MDM will give you the initial insight and control, but you must also practice mobile-first security thinking – considering how mobile and remote use benefits your employees as well as affects security parameters.

Final Words

The way people work is changing and remote and mobile work is not going away. The challenges associated with mobile working and personal devices are unique and, in some ways, still being assessed. 

But your security partner can help you understand your risks and choose the best mobile device security solutions for your needs. Assessing your risks, implementing a BYOD and remote access policy and choosing an MDM solution is an excellent starting point.