Bawa Perangkat Anda Sendiri: Tindakan Keamanan untuk Perangkat Pribadi di Tempat Kerja

Praktik Terbaik Keamanan BYOD

Setiap kebijakan BYOD yang efektif akan mencakup beberapa elemen ini:

• Jenis perangkat yang diizinkan
• Penggunaan yang dapat diterima: apa saja aplikasi dan aset yang boleh diakses oleh karyawan dari perangkatnya?
• Persyaratan minimum untuk kontrol keamanan perangkat: apa saja langkah keamanan yang akan diwajibkan oleh perusahaan bagi perangkat BYOD?
• Komponen yang disediakan perusahaan: misalnya, sertifikat SSL untuk autentikasi perangkat
• Hak perusahaan menyangkut modifikasi perangkat: misalnya, penghapusan dari jarak jauh dalam hal pencurian atau kehilangan perangkat.
• Apa yang terjadi pada data perusahaan di perangkat karyawan yang keluar dari perusahaan?
• Siapa yang memiliki aplikasi dan data pada perangkat? Apakah staf akan mendapatkan penggantian pembayaran dari perusahaan untuk biaya aplikasi atau bulanan?
• Dukungan apa yang akan diberikan oleh TI kepada pemilik perangkat?

The following provisions will need to be considered by policymakers so that the best options can be delivered:

• Common sense rules: a limit to personal calls and video at work, no use when driving
• Maintenance and upgrades: any finalized policy should ensure that employees reliably keep devices and apps up to date
• Data transfer provisions: company data should be encrypted, and password protected, and only transferred on company-mandated applications
• Password provisions: password use is obviously non-negotiable in protecting sensitive information; two factor authentication may also be required

Privacy provisions: how can companies balance data protection and employee privacy with BYOD?

BYOD Security Policy

How best to go about devising coherent and secure BYOD practices? Any policy drafting of this scale should involve both employees and stakeholders. Employee input can be obtained through a survey, a great basis for planning policy. Execs, HR, IT operations, finance, and security should all be looped in and represented in a BYOD project management team. These departments have contributions to make.

Once a survey has been sent out and responses received, beneficial analyses to make include which data and apps are needed on employee devices. After introducing the completed policy, training is a vital stage of the process. Employees at all levels must be instructed on data handling protocol, device troubleshooting, procedure for lost or stolen devices, which apps to use, and anti-phishing measures, as well as broader instruction in vigilance against cyber threats.

It is widely believed that employees untrained in cybersecurity are the greatest hazard to organizational data integrity. In 2014, 87% of IT managers believed that the biggest threat to organizations were mobile devices used by careless employees. In 2020, a startling 96% of attacks on mobile devices used apps as a vector. This is because a supermajority of apps, nearly 4 in 5, embed third-party libraries that can create vulnerabilities.

Which apps should a company implementing a strong BYOD policy use? A study found that employees use five or more apps every day. Organizations should include a dedicated secure messaging platform, email, CRM, and whichever other apps they feel their employees will need. Make sure that apps which could be liabilities are explicitly off-limits.

Organizations should also have specific procedures in place for employees that leave the company, for whatever reason. When an employee leaves, an organization must ensure that all data is taken off their devices, and any access to company apps is similarly withdrawn. However, this duty presents many difficulties and is often considered reason enough to abandon BYOD policies and provide their own devices.

A policy is only as strong as the ability of a company to enforce it, which unfortunately requires that there be consequences for those who cannot abide by the policy. Any policy should have specific details concerning the tracking, measurement, and enforcement of accountability distributed so that all team members are aware. Lack of oversight is one of the major issues for BYOD implementation. Companies need enough IT support staff to get employees set up, with ongoing support and monitoring.

After systems and protocols have been secured, organizations should prioritize education for employees. If a BYOD is to succeed, impressing the importance of acceptable use and basic data security hygiene upon employees is essential.