BYOD - perhaps we should call it "Bring Your Own Disaster!"
There have been lots of good reasons for not letting people connect what ever they like to the enterprise network. These have not changed, in fact there are more threats to the corporate computing environment than ever before with ever simpler attack vectors. However the BYOD brigade have charged on. Want an iPad for email, fine, sign off the risk, non-corporate laptop, sign here ______. What concerns me is not executives signing off risk, that of course is their decision, its whether they understand the risk in the first instance.
It seems strange at a time when information security is apparently so high on the corporate agenda that BYOD has as much traction has it does. Does this show us that perhaps the non- infosec executive management still have the "attacks come from the outside" mind set? Successful breaches almost always seem to include some form of end user device being used to attack the rest of the network. They can be an easy target, and one authorised to access other services. Why try to attack the data at rest when you can attack a vulnerable PC/user and steal the authorised credentials. This can happen even without BYOD policies!
Who's asset is it anyway?
The question of who owns the underlying asset is a really important one. If an employee owns that device the enterprise can't really tell them what to do with it. This will make data management policies almost impossible to police. The data belongs to the enterprise, the device to the staff member, the staff member is almost certainly going to be able to do whatever they like with that device. If devices get lost / stolen then the data compromised and used fraudulently I can't see too many judges looking fondly on. "So, you let them copy this information on to their personal tablet/laptop/smartphone". I'm not a lawyer but I could see this being a legal mine field around duty of care.
No real cost saving.
As IBM have discovered their BYOD initiative hasn't seen the cost savings expected. I suspect this is down to the well known fact that the cost of tin is always out weighed by support costs. Non-standard builds, non-standard software / hardware is a support teams worst nightmare.
If you add to this security requirements, suddenly network architecture has to be much more defensive from scratch. Really, all endpoint devices should be considered untrusted, perhaps even the network itself can't be trusted so more and more checks and policy must be applied. IT and Infosec can't even assume that they'll be able to install product on the devices so have to look for more and more agent-less technologies, endpoint analysis is required to see what on earth has been plugged in, network access control will have to be deployed to do quarantining of unknown / suspicious devices, all internal systems will require additional hardening and firewalling, multiple patch regimes to adhere too, and on, and on, and on.
To have a successful BYOD roll out requires an incredibly well locked down, hardened architecture with extensive internal firewalling the like that many organisations don't operate at the moment. This sort of approach slows down delivery of services to "the business" because it simply takes longer. Not helpful when the IT function is still trying to prove it is relevant as senior execs hear they can just move everything to the cloud.
Imagine malware that can detect whether it is plugged into the home network or the office one and operates intelligently based on that decision. Whilst at work, it sniffs credentials, hoovers up data and does as much as it can with as much stealth as it can muster. When it realises it has been plugged into the home network with a nice big internet connection and no real firewall / IDS it starts to transfer that data to the criminals unbeknown to the entity it stole it from...
The BYOD culture reminds me of those days in primary schools where the kids all bring a toy in to play with. Everyone is impressed by the cool toys on display, and the older kids get to show off their latest action figures and video games but not a great deal of work gets done by anyone.
BYOD - here to stay but probably for all the wrong reasons.
Hey mate, I think you've hit the nail on the head - there is indeed a march forward with BOYD that baffles the initiated because it is known that it will not save costs but rather raise costs. Then, why this march?
ReplyDeleteMy answer is that capitalism is relentless and short-sighted http://nontechietalk.blogspot.ca/2012/08/boyd-consistent-expression-of.html?m=1
IT people see this in terms of technological, proprietary and legal risk, but take direction from above (upper management) who are acting in other terms. If we step back and stop thinking about the problem in IT terms, it's less baffling.
A scorpion was looking for a ride across a river and asked a turtle, who politely declined, explaining his logic: "We'll get to the middle of the river, you'll sting me and we'll both drown." The scorpion said "I want to get across, I don't want to drown." So the turtle let the scorpion climb onto his back and into the river they went.
Halfway across, the turtle felt a sting in his neck. As he began to lose control of his motor functions, he had to ask the scorpion "Why did you do that?!" The scorpion could only answer "I'm a scorpion."
And they both drowned.