BYOD Policy: Getting it Right

What is a BYOD Policy?

A bring your own device (BYOD) policy is a set of guidelines that define proper work and use of employee-owned devices, such as personal computers (PCs), laptops, smartphones, and tablets. The goal of a BYOD is to ensure that corporate assets, including networks, systems, and data, are protected against shadow IT threats.

A BYOD policy is created according to the unique and agile needs of the organization, which is why the policy is highly flexible and varies between organizations and industries. For example, one organization might opt to allow BYOD laptops but prohibit mobile devices, while another might agree to support mobile devices.

Why is BYOD Policy Important?

A BYOD policy can help employees understand when and how they can use their own devices for work purposes and access company data. Here are key advantages of adopting a formal BYOD policy:

• Reduce costs— According to Cisco, a BYOD policy can help organizations save an average of $350 per employee, annually.
• Improve productivity—a study found that a BYOD policy can help employees become more productive. People are often happier and more comfortable when they can use their own, familiar devices, instead of having to switch between personal and company devices.
• Better security—a BYOD policy defines exactly how and when and what devices should be used for work. BYOD security guidelines should help employees understand their rights as well as their responsibilities. This information helps protect corporate assets from exposure to shadow IT threats.

However, informal BYOD practices can introduce significant risks, especially for organizations handling sensitive information.

If, for example, employees are not informed about proper BYOD guidelines, and are allowed to store and transfer sensitive information. Or if they download any 3rd party content that could be risky. In addition, if the IT team does not have complete visibility over these processes, then information could be leaked or compromised.

What Should a BYOD Policy Template Include?

A BYOD policy should be the result of a collaboration between all relevant departments, including HR, IT, and legal. Here are key aspects to consider when creating a BYOD policy template:

• Authorized devices—define whether employees are allowed to use any available device or only certain devices.
• Shared costs—employees working from home may consume more resources than they normally would for personal use. In this case, organizations might decide to offer a stipend to cover the costs.
• Passwords—if the employee-owned device is used to handle important business information, organizations can define proper security requirements, such as multi-factor authentication and strong passwords.
• Network security—organizations should define several network security aspects. For example, prohibiting the transmission of important information via public networks, clearly defining which networks are appropriate for BYOD use, and providing a virtual private network (VPN) as needed.
• Data storage—a BYOD should clearly explain what types of corporate data they can store on their personal devices. Organizations should also prohibit data storage of any confidential or financial information on BYOD that are not encrypted.
• Authorized use—a BYOD policy should clearly let employees know whether or not they are allowed to share the use of devices with friends or family.
• Banned applications—employee-owned devices typically have a range of installed applications, some of which are not related to work purposes. Organizations might reserve the right to request the deletion of certain applications to prevent the malware infections.
• Lost or stolen devices—a BYOD policy should inform employees as to proper conduct during security events, including the loss or theft of their device. For example, when the device is lost or stolen, the employee should immediately respond by remotely wiping out the data stored on the device.
• Onboarding and offboarding employees—when employees leave the company, the organization might request to wipe out the device, or at the very least check it. Even though the device is personal, it was still used for work purposes and should be monitored during onboarding and offboarding, to prevent future issues.

Key Considerations for a Successful BYOD Policy

Make Compliance Clear

A BYOD policy should not contain languages or jargon the majority of employees are not familiar with. If this happens, employees might not be able to understand and comply. To prevent this, the organization should simplify the BYOD policy and clearly outline the responsibilities of employees and the efforts of the organization. To ensure employees know why they should comply, the organization should explain the importance of compliance.

Make Help Available

Policies should help support the efforts of the employees, providing clear guidelines, just like any regular FAQ document. Additionally, the organization should include information about the support available in cases of technical problems. Including this information in the BYOD policy can help provide quick references when employees experience technical issues.

Mandatory Security Policies

A BYOD should provide guidelines that help employees understand and implement proper security measures. For example, installing only trustworthy software and prohibiting the use of public WiFi networks. Organizations should also consider enforcing penalties for policy violations.

BYOD Policy with Perception Point

With Perception Point, employees can work using their own devices and in their native browser of choice without IT administrators worrying about potential malware.

Perception Point Advanced Browser Security adds enterprise-grade security to standard browsers like Chrome, Edge, and Safari. The solution fuses advanced threat detection with browser-level governance and DLP controls providing organizations of all sizes with unprecedented ability to detect, prevent and remediate web threats including sophisticated phishing attacks, ransomware, exploits, Zero-Days, and more.

By transforming the organizational browser into a protected work environment, the access to sensitive corporate infrastructure and SaaS applications is secure from data loss and insider threats. The solution is seamlessly deployed on the endpoints via a browser extension and is managed centrally from a cloud-based console. There is no need to tunnel/proxy traffic through Perception Point.

An all-included managed Incident Response service is available for all customers 24/7. Perception Point’s team of cybersecurity experts will manage incidents, provide analysis and reporting, and optimize detection on-the-fly. The service drastically minimizes the need for internal IT or SOC team resources, reducing the time required to react and mitigate web-borne attacks by up to 75%.

Customers deploying the solution will experience fewer breaches, while providing their users with a better experience as they have the freedom to browse the web, use SaaS applications that they require, and access privileged corporate data, confidently, securely, and without added latency.

Contact us for a demo of our Advanced Browser Security solution, today. 

---