Protecting Enterprise Data in BYOD Scenarios

How do you protect corporate data when you don't own or manage the device that is used to access and store it? How do you deal with devices used by business partners, contractors, and visitors who have a legitimate need to collaborate with your teams and access your resources, but you cannot enforce device management policies or deploy agents onto them?

In this chapter, we will explore the risks and impact of personally owned or unmanaged devices on information security and the practical steps you can take to ensure the appropriate protection is applied. We will discuss the key considerations for device choice, ownership, and management. We will also look at the various options available to protect your sensitive data across all device types. We will discuss the following topics specifically:

• Bring Your Own Device:
  • What is BYOD...

Bring Your Own Device

In this section, we will explore the use of devices that do not conform to standard company regulations, such as consumer-grade hardware, personally owned devices, and devices used to access company resources that are not managed by the IT department.

What is BYOD?

This term came about as part of the consumerization of IT, the desire to use the latest technologies to achieve an increase in mobility and productivity. No longer controlled by the limited choice of devices provisioned by company IT departments, users found their own technology solutions to suit their specific work environment and tasks; if they can check their email on a phone or tablet while at home, why not while traveling or with customers...

Protection options

There are multiple options available to provide appropriate security controls for BYOD scenarios. The best way to explain these options is to take a layered approach; you can then identify which combination of options is required for your specific business requirements, technical capabilities, and end user scenarios.

The following topics will be covered in this section, specifically those related to BYOD and CYOD scenarios:

• Identity and access management
• Device configuration
• Application management
• Information protection

Identity and access management

In a scenario where the device is joined to the company's AD domain and managed by Group Policy and Configuration Manager, identity and access management...

Alternative options

So far, we have discussed protecting company data on devices by managing the identity, device, and applications that are used as well as protecting the content itself in case it is shared via an unsecure platform. If these options do not provide enough protection and you are still concerned about the integrity and confidentiality of your company data, then you have a few other options to consider.

Enable remote/virtual desktops - RDS/VDI

This solution has been around for several years now and is the most popular option for allowing remote workers to gain access to internal resources. The solution can be configured to prevent the user downloading any documents, ensuring all data remains within the controlled...

Summary

In this chapter, we covered the key considerations for deciding which types of devices can be used by your users, along with the risks and benefits of each option. Whether you decide to enforce MDM to manage external devices or you choose to opt for an MAM-only option, there are plenty of choices for securing access to resources and preventing the unauthorized distribution of sensitive data, while enabling collaboration between internal and external teams.

In the next chapter we will explore the new hardware and software based security options that are available in Windows 10 to further protect your information, credentials, and other assets.