Developing BYOD policy

Having established BYOD objectives, user needs, and the level of risk an enterprise is willing to take, the next step is developing the policy. A policy is essential to outline the responsibilities of the enterprise and its employees in regard of BYOD.

Policy Goals

The policy should cover the following areas:

1. Define the scope of tasks employees will be allowed to perform from their devices.
2. Define the tasks employees will not be permitted to perform from their devices.
3. Establish what services and what type of data within these services will be exposed to personal device users.
4. Establish how much control will the employees be willing to grant over their devices, and how much control the enterprise requires.

Any policy is only as good as the degree to which it adheres. Hence part of any policy should define actions triggered in case users do not follow the steps outlined therein.

Policy Technical Controls

Most likely technical controls will have to be developed as part of efficient policy implementation, such as:

1. Type of permitted client access
2. Minimum standards for hardware and software version
3. Types of policies enforced and methods of enforcing them.
   – For example minimum passcode length and preventing copy and paste between work and personal apps. And whether these policies will apply at the device or application level, or both.
4. Establishing a method used to remove access and corporate data in case an employee changes their device, or role or leaves the organisation.
5. Type of service access policies in place.
   – Such as compliance policies and strong authentication (such as MFA) to verify devices before they are allowed access to BYOD-approved enterprise services.
6. Strict data access rules on individual services (only access to data in line with the enterprise’s risk policy).
7. Point and type of policy enforcement (at an authentication service, network firewall, or perimeter of specific services).
8. Method of enforcing separation between business and personal application to, for example, prevent corporate data from being opened or moved to personal applications.
9. Appropriate security incident handling.
10. Defining type (desktop, laptop, smartphone, tablet) and the number of devices allowed.
11. Place of use of BYOD devices
    – Will BYOD devices be used from a remote location only or will they be brought into office spaces and connected to ‘trusted’ networks? Will use abroad be permitted?
12. Controls are in place to prevent unauthorised devices from accessing sensitive information.
13. Ways to encourage users to adopt the policies.

How will the BYOD policies be communicated to users and what ways of encouraging users to follow them.

In next week’s blog, we will look at good practices for BYOD.

About this article

This post is based on an article from the NCSC UK. To read the full version of this article click here.

Related posts

Add a comment