Bring your own device - ey.com

1 Insights on governance, risk and complianceBring your own deviceSecurity and risk considerations for your mobile device programSeptember 2013 ContentsIntroduction .. 1 Defining the BYOD risk .. 31. Securing mobile devices .. 42. Addressing app risk .. 63. Managing the mobile environment .. 7 Addressing governance and compliance issues .. 9 Conclusion .. 11 Eight steps to secure and improve your BYOD program .. 12 Issues to consider in your BYOD deployment .. 21 Insights on governance, risk and compliance September 2013 |Estimates suggest that in about five years, the number of mobile devices will be about 10 billion for every man, woman and child on the planet. With mobile devices increasingly embedded into all parts of our personal lives, organizations are finding that their employees increasingly want to use their own personal mobile devices to conduct work (often alongside corporate-provided devices ), and many are reaching out to corporate IT to support this.

2 Employers have concluded that they can t physically stop the use of mobile devices for both work and personal agendas, but they need to know how to control it. In the current economic environment, companies are demanding that employees be more productive: having a robust mobile program that allows personal devices to be used safely in a work capacity can raise employee productivity and be a significant competitive advantage; it can even yield higher recruiting acceptance rates. An employee IT ownership model, typically called Bring your own device (BYOD), presents an attractive option to organizations. BYOD significantly impacts the traditional security model of protecting the perimeter of the IT organization by blurring the definition of that perimeter, both in terms of physical location and in asset ownership.

3 With personal devices now being used to access corporate email, calendars, applications and data; many organizations are struggling with how to fully define the impact to their security posture and establish acceptable procedures and support models that balance both their employees needs and their security concerns. In this report, you will discover what the main risks of BYOD are when considering your mobile device program, and we will propose potential steps to address these risks based on your organization s current and most urgent challenges. IntroductionThe old world:Corporate-owned deviceThe new world:Personal-owned device interfacing with corporate devicesB Y O D2| Insights on governance, risk and compliance September 20132| Insights on governance, risk and compliance September 2013 Issues to consider in your BYOD deploymentThe risk landscape of a BYOD mobile device deployment is largely dependent on these key factors: The organization s risk profile As for all information security risks, how the organization defines and treats risk plays a key role in choosing the type of security controls the organization should employ.

4 Current (and future) mobile use cases Organizations should take into consideration the types of data and functionality that are exposed through the deployment. For instance, a retail deployment that allows credit card processing on personal devices would require PCI-DSS compliance on the devices which includes stronger and more rigorous controls than on non-PCI devices . There is no one size fits all use case. The geographic deployment of the devices International deployments increase risk levels not only because of the geographic distribution of the devices , but also as a function of unclear and regionally applicable legislation in certain geographic areas. Areas with rigorous privacy legislation such as the EU and Brazil also affect the legal workload and nature of the security controls needed to stay these factors at an early stage in the BYOD planning process is key for a secure and successful rollout.

5 Challenges or barriers facing BYOD deployment65%Mobile device security59%Data breach security55%Mobile data security50%Mobile application security26%Integration with back-end corporate systems25%Controlling employee use of mobile apps22%Executive sponsorship18%Cost of help desk support17%Country-speci c regulations17%Expense of implementing applications15%Ind us try-speci c regulatory reiuirements15%ROI f o r BYOD9%Cost of training7%Mobile app development costsThe top concerns for BYOD are related to there are various costs incurred on BYOD, they are not seen as major barriers for : Forrester, Key strategies to capture and measure the value of consumerization of IT, July 20123 Insights on governance, risk and compliance September 2013 |As BYOD introduces risk to the organization, a holistic and methodical approach should be used to define this risk and help to ensure that controls exist to maintain both the security and usability of the devices in the the BYOD risk3 Insights on governance, risk and compliance September 2013 |4| Insights on governance, risk and compliance September 2013 With the issues of risk profile, usage and geography to consider, an organization can begin to define the BYOD risks and what impact they would have.

6 What is often found is that the risks generally remain the same. The risk introduced by BYOD tends to be an expansion of the current risk landscape rather than introducing completely new risks, it has the potential to amplify and increase certain risk. Here, we have divided the risk landscape into three areas:Defining the BYOD riskIn the former single-phone corporate environment, mobile devices were relatively straightforward to manage and secure as they consisted of a uniform distribution of device types, often from a single manufacturer or brand, that had limited or no access to corporate data. This allowed the organization to consistently apply security policy controls, often through a unified management interface supplied by the manufacturer.

7 BYOD fundamentally changes this architecture as users Bring in their own devices of various makes and models. These devices are often designed to exist in their own walled gardens with little seamless interaction with an enterprise environment and management risk expansion happens both on the basis of a more diverse device portfolio, and as a function of the number of devices . As a BYOD deployment invariably will include a wider range of device types, the same security controls that before were applied to a singular device type now have to be applied to a multitude of hardware and operating system combinations, often with differing levels of effectiveness. In addition, end users often have more than one device and would like to connect multiple devices to the organization s infrastructure, which increases the net number of devices that must be a result, basic security controls may not be consistently and effectively implemented across the collection of devices .

8 This may occur even when a functional mobile device management (MDM) product is in place, as operating system or app-specific vulnerabilities may be able to circumvent existing controls on the organizations, the principal goal of technology is to drive and deliver business value. While locking down mobile devices and prohibiting the use of personal devices may mitigate some security risks, policies that are too restrictive will drive down adoption or encourage workarounds. In time, they may also drive employees to use unsafe alternatives to obtain the flexibility and access they have already experienced and now expect. In these instances, neither the policy nor the program will be sustainable. When it comes to mobile devices , well-developed programs should be based on an understanding of different user types and a clearly defined set of user segments.

9 For example, international organizations should consider the impact of regional device availability, usage habits and cellular network provider capabilities and data plan costs. A clearly articulated set of usage cases should drive the development of experience, as a poor user experience will lead to fast failure. Ultimately, understanding your users and how the technology and product offerings can enable their daily tasks will drive user and awareness of these challenges will help organizations and their employees understand the critical areas which can help secure their mobile devices , thereby promoting enhanced information security. Risks relating to securing mobile devices are categorized into five basic concerns: Lost and stolen devices Physical access The role of end user device ownership Always on with increased data access Lack of awarenessLost and stolen devicesMillions of cell phones and smartphones are lost or stolen every year.

10 It is thought that approximately 22% of the total number of mobile devices produced will be lost or stolen during their lifetime, and over 50% of these will never be recovered. Most devices are stolen for the value of the hardware on the second-hand market; however, a growing amount of lost and stolen phones have their content accessed by someone other than their owners. This highlights the importance of basic security features such as password protection, encryption and robust procedures to wipe the device once Securing mobile devices1 Securing mobile devices23 Addressing app riskManaging the mobile environment5 Insights on governance, risk and compliance September 2013 |Physical accessThe high number of stolen and lost devices also means that attackers may have physical access to the actual device hardware.