SlideShare a Scribd company logo
BYOD:
Bring your own demons?
ÁNGEL L. TRINIDAD RIGAU
C|HFI, CFE, CISA, MCTS, MCITP, MCSA, MCT, CICA
Agenda
 Introduction
 Benefits
 Cons
 BYOD and Regulations
 Hostile Environment - Threats
 Security Enhancement
 Legal Matters
 Final Thoughts
 Questions
Introduction
 Bring your own devices (BYOD), it’s a new trend
of permitting that employees can bring
personally owned mobile devices (smartphones,
tablets and laptops) to the workplace and use
those devices to access, store or create
company information.
 The rapid rise of mobile devices and the
introduction of them to the workplace bring new
security and operational issues to companies.
Benefits
 More productive employees
 24/7 access to the company’s email and information
stored in the company’s servers.
 Higher morale among employees because they can
use the technology that they want and not what the
company provide.
 Low or no cost to the company
 Hardware is bought and maintained by the employee
 Sometimes, carrier calls and internet cost also are
paid by the employees
 Advantage of new technology
Cons
 Less security
 Administrative cost
 Software acquisition to manage mobile devices
 Develop policies and procedures
 Management issues
 Infrastructure costs
 Service (Carriers) cost
 Not full control of the device
BYOD and Regulations
 HIPAA
 Protect private data
 Encrypt emails and data
 On the device
 On the transmission
 Remote management of devices
 Controls to access data and
applications
 Monitoring
 Malware and threats protection
 Compliance reporting
 PCI/DSS
 Explicit approval of authorization to use the
device
 Authentication (two factor authentication)
 Comprehensive list of devices (make and
model) and OS (iOS, Android, Windows, RIM)
 List of personnel with access to this devices
 Labeling of devices with owner information
 Device encryption
 Transmission security (SSL/TLS, IPsec)
Mobile Devices and personal/confidential data are heavily regulated in some industries.
Not recommended or have a lot of aspirins at hand. A violation of any regulation carried
a fine. (up to 1.5 Millions per violation on HIPAA) (Other Regulations: GLBA, HITECH, SOX)
Hostile Environment-Threats
 Lost or stolen devices
 The very best advantage of mobile devices is It’s
worst enemy. Mobile devices are small, compact and
…. Yes, MOBILE. Lost or stolen devices are the
pinnacle of BYOD threats.
 Attack surface
 Rogue apps can extract contact information and
data from mobile devices.
 Even if you only allow authorized app, a scan of a QR
code can download an app.
Hostile Environment-Threats
 Attack vector
 Attackers can connect mobile devices to open
wireless access points and start scanning your
network.
 Backtrack (and now KALI) have ARM versions that
can be installed and be used in mobile devices.
 Rogue Apps
 Apps should be sandboxed. Only allow authorized
applications on devices with company’s data stored.
 Rogue apps are entryways of malware infections.
Hostile Environment-Threats
 Jailbrake/ Rooted Devices
People tend to crave for power and control.
One thing they do first with mobile devices is
jailbrake or root it. This open a new window of
threats. Access of rogue applications (and
users!) to the root account could be
dangerous to the company’s data.
Security Enhancement
 Management
 A plethora of mobile devices exist with different models, OS’s, that a possible
chaos could erupt at any moment.
 List of all devices allowed access to the company and prepare a periodical
reports.
 Look for unauthorized devices on you network
 Mobile Device Management
 Mobile expense control (downloads, roaming and international costs)
 Remotely locate, lock and wipe lost devices
 Security control checks
 Anti-virus
 Lock mechanism
 Apps
 Jailbreak/root
 Automatically wipe company data
Security Enhancement
 OS Update
 Look for solutions that include different os.
 Notification to users
 SMS before wiping, exceeding data or service plan limit
 Personal data segregation
 Photos, email, calendar, call logs, voicemail, texts
 Protect entryways to Corporation
 Firewall rules checked and double checked!
 Secure wireless access points
 Single recurrent error
 VPN
 Quarantine unauthorized devices
 Enrollment
 Bulk enrollment or single enrollment
 Authentication with Active Directory
 Policy
 Reason for authorization
 Devises allowed on company infrastructure
 Data services or personal plan (Stipend)
 Security
 Applications Authorized
Security Enhancement
 Cont. Policy
 Services Provided
 What data the employee can access with the device
 Help desk services to personal device
 Agreement between employee and company
 Personal data
 Education of employees of the risk associated with BYOD
 Training of encryption application and communication
 Not every “C” level employees knows about encryptions and
safe communications
Security Enhancement
Legal Matters
 First thing first- I'm NOT a Lawyer
 Legal issues may arise
 If the employee Is a suspect in an internal
investigation, can I take possession of the mobile
device for analysis?
 The employee may be accountable for any access
from the mobile device if he/she lost it?
 Privacy?
Final Thoughts
 BYOD is here to stay
 Prepare an analysis of the pros and cons of the
implementation of BYOD in your company
 Regulate the use of BYOD
Policies anyone?
Training programs for employees
Questions?
Ángel L. Trinidad
787-461-8111
atrinidad.mct@outlook.com

More Related Content

What's hot

MIS 21 Security and Ethical Challenges
MIS 21 Security and Ethical ChallengesMIS 21 Security and Ethical Challenges
MIS 21 Security and Ethical Challenges
Tushar B Kute
 
Implementing an Information Security Program
Implementing an Information Security ProgramImplementing an Information Security Program
Implementing an Information Security Program
Raymond Cunningham
 
Security & ethical challenges
Security & ethical challengesSecurity & ethical challenges
Security & ethical challenges
Louie Medinaceli
 
Information Security
Information SecurityInformation Security
Information Security
steffiann88
 
Isa Prog Need L
Isa Prog Need LIsa Prog Need L
Isa Prog Need L
R_Yanus
 
Securing information systems
Securing information systemsSecuring information systems
Securing information systems
Prof. Othman Alsalloum
 
8 - Securing Info Systems
8 - Securing Info Systems8 - Securing Info Systems
8 - Securing Info Systems
Hemant Nagwekar
 
information security technology
information security technologyinformation security technology
information security technology
garimasagar
 
"Case Studies from the Field: Putting Cyber Security Strategies into Action" ...
"Case Studies from the Field: Putting Cyber Security Strategies into Action" ..."Case Studies from the Field: Putting Cyber Security Strategies into Action" ...
"Case Studies from the Field: Putting Cyber Security Strategies into Action" ...
Health IT Conference – iHT2
 
Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001
Donald E. Hester
 
needforsecurity
needforsecurityneedforsecurity
Ethics and information security 2
Ethics and information security 2Ethics and information security 2
Ethics and information security 2
PT Bank Syariah Mandiri
 
Security Awareness Training by HIMSS Louisiana Chapter
Security Awareness Training by HIMSS Louisiana ChapterSecurity Awareness Training by HIMSS Louisiana Chapter
Security Awareness Training by HIMSS Louisiana Chapter
Atlantic Training, LLC.
 
Chapter 8 securing information systems MIS
Chapter 8 securing information systems MISChapter 8 securing information systems MIS
Chapter 8 securing information systems MIS
Amirul Shafiq Ahmad Zuperi
 
INFORMATION SECURITY
INFORMATION SECURITYINFORMATION SECURITY
INFORMATION SECURITY
Ahmed Moussa
 
Information security in todays world
Information security in todays worldInformation security in todays world
Information security in todays world
Sibghatullah Khattak
 
MIS-CH08: Securing Information Systems
MIS-CH08: Securing Information SystemsMIS-CH08: Securing Information Systems
MIS-CH08: Securing Information Systems
Sukanya Ben
 
Session#7; securing information systems
Session#7;  securing information systemsSession#7;  securing information systems
Session#7; securing information systems
Omid Aminzadeh Gohari
 
Uit9 ppt ch09_au_rev
Uit9 ppt ch09_au_revUit9 ppt ch09_au_rev
Uit9 ppt ch09_au_rev
idrissss dddd
 

What's hot (19)

MIS 21 Security and Ethical Challenges
MIS 21 Security and Ethical ChallengesMIS 21 Security and Ethical Challenges
MIS 21 Security and Ethical Challenges
 
Implementing an Information Security Program
Implementing an Information Security ProgramImplementing an Information Security Program
Implementing an Information Security Program
 
Security & ethical challenges
Security & ethical challengesSecurity & ethical challenges
Security & ethical challenges
 
Information Security
Information SecurityInformation Security
Information Security
 
Isa Prog Need L
Isa Prog Need LIsa Prog Need L
Isa Prog Need L
 
Securing information systems
Securing information systemsSecuring information systems
Securing information systems
 
8 - Securing Info Systems
8 - Securing Info Systems8 - Securing Info Systems
8 - Securing Info Systems
 
information security technology
information security technologyinformation security technology
information security technology
 
"Case Studies from the Field: Putting Cyber Security Strategies into Action" ...
"Case Studies from the Field: Putting Cyber Security Strategies into Action" ..."Case Studies from the Field: Putting Cyber Security Strategies into Action" ...
"Case Studies from the Field: Putting Cyber Security Strategies into Action" ...
 
Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001
 
needforsecurity
needforsecurityneedforsecurity
needforsecurity
 
Ethics and information security 2
Ethics and information security 2Ethics and information security 2
Ethics and information security 2
 
Security Awareness Training by HIMSS Louisiana Chapter
Security Awareness Training by HIMSS Louisiana ChapterSecurity Awareness Training by HIMSS Louisiana Chapter
Security Awareness Training by HIMSS Louisiana Chapter
 
Chapter 8 securing information systems MIS
Chapter 8 securing information systems MISChapter 8 securing information systems MIS
Chapter 8 securing information systems MIS
 
INFORMATION SECURITY
INFORMATION SECURITYINFORMATION SECURITY
INFORMATION SECURITY
 
Information security in todays world
Information security in todays worldInformation security in todays world
Information security in todays world
 
MIS-CH08: Securing Information Systems
MIS-CH08: Securing Information SystemsMIS-CH08: Securing Information Systems
MIS-CH08: Securing Information Systems
 
Session#7; securing information systems
Session#7;  securing information systemsSession#7;  securing information systems
Session#7; securing information systems
 
Uit9 ppt ch09_au_rev
Uit9 ppt ch09_au_revUit9 ppt ch09_au_rev
Uit9 ppt ch09_au_rev
 

Viewers also liked

What next for Recruitment in a digitally exploding world
What next for Recruitment in a digitally exploding worldWhat next for Recruitment in a digitally exploding world
What next for Recruitment in a digitally exploding world
Gary Fay
 
Hudson cv and interview guide
Hudson cv and interview guide Hudson cv and interview guide
Hudson cv and interview guide
Gary Fay
 
Presentation on GSM(2G & GPRS)
Presentation on GSM(2G & GPRS)Presentation on GSM(2G & GPRS)
Presentation on GSM(2G & GPRS)
Brijesh Kaushik
 
Hiring for success-uk-web
Hiring for success-uk-webHiring for success-uk-web
Hiring for success-uk-web
Gary Fay
 
Προώθηση καλλιτεχνών
Προώθηση καλλιτεχνώνΠροώθηση καλλιτεχνών
Προώθηση καλλιτεχνών
Paris Platanias
 
Cyber&digital forensics report
Cyber&digital forensics reportCyber&digital forensics report
Cyber&digital forensics report
yash sawarkar
 
Nydia's Baby Shower
Nydia's Baby ShowerNydia's Baby Shower
Nydia's Baby Shower
cristinab32
 
Knihovny a neslysici ctenari koutska
Knihovny a neslysici ctenari   koutskaKnihovny a neslysici ctenari   koutska
Knihovny a neslysici ctenari koutskaMichala Sošková
 
Abstract1
Abstract1Abstract1
Plaut mi & perfect plant
Plaut mi & perfect plantPlaut mi & perfect plant
Plaut mi & perfect plant
ManUnplugged
 
TVin_Marketing_Research_Folio
TVin_Marketing_Research_FolioTVin_Marketing_Research_Folio
TVin_Marketing_Research_Folio
Tha Vin
 
Abstract1
Abstract1Abstract1
Energy harvesting from piezoelectric material - a part of nanotechnology
Energy harvesting from piezoelectric material - a part of nanotechnologyEnergy harvesting from piezoelectric material - a part of nanotechnology
Energy harvesting from piezoelectric material - a part of nanotechnology
yash sawarkar
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
yash sawarkar
 
Crystal oscillator
Crystal oscillatorCrystal oscillator
Crystal oscillator
yash sawarkar
 
Orchestration for the rest of us
Orchestration for the rest of usOrchestration for the rest of us
Orchestration for the rest of us
Jérôme Petazzoni
 

Viewers also liked (16)

What next for Recruitment in a digitally exploding world
What next for Recruitment in a digitally exploding worldWhat next for Recruitment in a digitally exploding world
What next for Recruitment in a digitally exploding world
 
Hudson cv and interview guide
Hudson cv and interview guide Hudson cv and interview guide
Hudson cv and interview guide
 
Presentation on GSM(2G & GPRS)
Presentation on GSM(2G & GPRS)Presentation on GSM(2G & GPRS)
Presentation on GSM(2G & GPRS)
 
Hiring for success-uk-web
Hiring for success-uk-webHiring for success-uk-web
Hiring for success-uk-web
 
Προώθηση καλλιτεχνών
Προώθηση καλλιτεχνώνΠροώθηση καλλιτεχνών
Προώθηση καλλιτεχνών
 
Cyber&digital forensics report
Cyber&digital forensics reportCyber&digital forensics report
Cyber&digital forensics report
 
Nydia's Baby Shower
Nydia's Baby ShowerNydia's Baby Shower
Nydia's Baby Shower
 
Knihovny a neslysici ctenari koutska
Knihovny a neslysici ctenari   koutskaKnihovny a neslysici ctenari   koutska
Knihovny a neslysici ctenari koutska
 
Abstract1
Abstract1Abstract1
Abstract1
 
Plaut mi & perfect plant
Plaut mi & perfect plantPlaut mi & perfect plant
Plaut mi & perfect plant
 
TVin_Marketing_Research_Folio
TVin_Marketing_Research_FolioTVin_Marketing_Research_Folio
TVin_Marketing_Research_Folio
 
Abstract1
Abstract1Abstract1
Abstract1
 
Energy harvesting from piezoelectric material - a part of nanotechnology
Energy harvesting from piezoelectric material - a part of nanotechnologyEnergy harvesting from piezoelectric material - a part of nanotechnology
Energy harvesting from piezoelectric material - a part of nanotechnology
 
Digital forensics
Digital forensicsDigital forensics
Digital forensics
 
Crystal oscillator
Crystal oscillatorCrystal oscillator
Crystal oscillator
 
Orchestration for the rest of us
Orchestration for the rest of usOrchestration for the rest of us
Orchestration for the rest of us
 

Similar to Byod

Mobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk ManagementMobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk Management
DMIMarketing
 
Control Issues and Mobile Devices
Control Issues and Mobile DevicesControl Issues and Mobile Devices
Control Issues and Mobile Devices
sunnay
 
Two Peas in a Pod: Cloud Security and Mobile Security
Two Peas in a Pod: Cloud Security and Mobile Security Two Peas in a Pod: Cloud Security and Mobile Security
Two Peas in a Pod: Cloud Security and Mobile Security
Omar Khawaja
 
5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management
DMIMarketing
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
cuddietheresa
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
salmonpybus
 
What every executive needs to know about information technology security
What every executive needs to know about information technology securityWhat every executive needs to know about information technology security
What every executive needs to know about information technology security
Legal Services National Technology Assistance Project (LSNTAP)
 
Summarize the process of constructing security training inside an orga.docx
Summarize the process of constructing security training inside an orga.docxSummarize the process of constructing security training inside an orga.docx
Summarize the process of constructing security training inside an orga.docx
esally
 
Ensuring Mobile Device Security
Ensuring Mobile Device SecurityEnsuring Mobile Device Security
Ensuring Mobile Device Security
Quick Heal Technologies Ltd.
 
Guide Preview: Ensuring your enterprise image-viewer if fully secure
Guide Preview: Ensuring your enterprise image-viewer if fully secureGuide Preview: Ensuring your enterprise image-viewer if fully secure
Guide Preview: Ensuring your enterprise image-viewer if fully secure
Calgary Scientific Inc.
 
Mobile Device Management Service: Yamana
Mobile Device Management Service: YamanaMobile Device Management Service: Yamana
Mobile Device Management Service: Yamana
Softweb Solutions
 
CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf
 CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf
CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf
sattarali527
 
Secure Mobile Working 1.0
Secure Mobile Working 1.0Secure Mobile Working 1.0
Secure Mobile Working 1.0
Jon Collins
 
Mobile Apps and Security Attacks: An Introduction
Mobile Apps and Security Attacks: An IntroductionMobile Apps and Security Attacks: An Introduction
Mobile Apps and Security Attacks: An Introduction
Nagarro
 
CASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdf
CASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdfCASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdf
CASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdf
kostikjaylonshaewe47
 
Cn35499502
Cn35499502Cn35499502
Cn35499502
IJERA Editor
 
What are the essential outcomes of secure system retirement- Justify y.docx
What are the essential outcomes of secure system retirement- Justify y.docxWhat are the essential outcomes of secure system retirement- Justify y.docx
What are the essential outcomes of secure system retirement- Justify y.docx
loisj1
 
Task 3
Task 3Task 3
CS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptxCS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptx
GaytriDhingra1
 
Data Security in Healthcare
Data Security in HealthcareData Security in Healthcare
Data Security in Healthcare
Quick Heal Technologies Ltd.
 

Similar to Byod (20)

Mobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk ManagementMobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk Management
 
Control Issues and Mobile Devices
Control Issues and Mobile DevicesControl Issues and Mobile Devices
Control Issues and Mobile Devices
 
Two Peas in a Pod: Cloud Security and Mobile Security
Two Peas in a Pod: Cloud Security and Mobile Security Two Peas in a Pod: Cloud Security and Mobile Security
Two Peas in a Pod: Cloud Security and Mobile Security
 
5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
 
What every executive needs to know about information technology security
What every executive needs to know about information technology securityWhat every executive needs to know about information technology security
What every executive needs to know about information technology security
 
Summarize the process of constructing security training inside an orga.docx
Summarize the process of constructing security training inside an orga.docxSummarize the process of constructing security training inside an orga.docx
Summarize the process of constructing security training inside an orga.docx
 
Ensuring Mobile Device Security
Ensuring Mobile Device SecurityEnsuring Mobile Device Security
Ensuring Mobile Device Security
 
Guide Preview: Ensuring your enterprise image-viewer if fully secure
Guide Preview: Ensuring your enterprise image-viewer if fully secureGuide Preview: Ensuring your enterprise image-viewer if fully secure
Guide Preview: Ensuring your enterprise image-viewer if fully secure
 
Mobile Device Management Service: Yamana
Mobile Device Management Service: YamanaMobile Device Management Service: Yamana
Mobile Device Management Service: Yamana
 
CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf
 CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf
CASE STUDY There is a new phenomenon in the cybersecurity domain cal.pdf
 
Secure Mobile Working 1.0
Secure Mobile Working 1.0Secure Mobile Working 1.0
Secure Mobile Working 1.0
 
Mobile Apps and Security Attacks: An Introduction
Mobile Apps and Security Attacks: An IntroductionMobile Apps and Security Attacks: An Introduction
Mobile Apps and Security Attacks: An Introduction
 
CASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdf
CASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdfCASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdf
CASE STUDY There is a new phenomenon in the cybersecurity domain ca.pdf
 
Cn35499502
Cn35499502Cn35499502
Cn35499502
 
What are the essential outcomes of secure system retirement- Justify y.docx
What are the essential outcomes of secure system retirement- Justify y.docxWhat are the essential outcomes of secure system retirement- Justify y.docx
What are the essential outcomes of secure system retirement- Justify y.docx
 
Task 3
Task 3Task 3
Task 3
 
CS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptxCS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptx
 
Data Security in Healthcare
Data Security in HealthcareData Security in Healthcare
Data Security in Healthcare
 

Recently uploaded

Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
Aftab Hussain
 
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
名前 です男
 
Presentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of GermanyPresentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of Germany
innovationoecd
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
DianaGray10
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
danishmna97
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
SOFTTECHHUB
 
Building RAG with self-deployed Milvus vector database and Snowpark Container...
Building RAG with self-deployed Milvus vector database and Snowpark Container...Building RAG with self-deployed Milvus vector database and Snowpark Container...
Building RAG with self-deployed Milvus vector database and Snowpark Container...
Zilliz
 
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfObservability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Paige Cruz
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems S.M.S.A.
 
20240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 202420240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 2024
Matthew Sinclair
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
Zilliz
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
Uni Systems S.M.S.A.
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
Alpen-Adria-Universität
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
Neo4j
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
Neo4j
 
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AIEnchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Vladimir Iglovikov, Ph.D.
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
DianaGray10
 
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy SurveyTrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc
 
Large Language Model (LLM) and it’s Geospatial Applications
Large Language Model (LLM) and it’s Geospatial ApplicationsLarge Language Model (LLM) and it’s Geospatial Applications
Large Language Model (LLM) and it’s Geospatial Applications
Rohit Gautam
 

Recently uploaded (20)

Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
 
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
 
Presentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of GermanyPresentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of Germany
 
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
 
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptxHow to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
 
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
 
Building RAG with self-deployed Milvus vector database and Snowpark Container...
Building RAG with self-deployed Milvus vector database and Snowpark Container...Building RAG with self-deployed Milvus vector database and Snowpark Container...
Building RAG with self-deployed Milvus vector database and Snowpark Container...
 
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdfObservability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf
 
Uni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdfUni Systems Copilot event_05062024_C.Vlachos.pdf
Uni Systems Copilot event_05062024_C.Vlachos.pdf
 
20240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 202420240607 QFM018 Elixir Reading List May 2024
20240607 QFM018 Elixir Reading List May 2024
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
GraphSummit Singapore | The Future of Agility: Supercharging Digital Transfor...
 
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AIEnchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
 
TrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy SurveyTrustArc Webinar - 2024 Global Privacy Survey
TrustArc Webinar - 2024 Global Privacy Survey
 
Large Language Model (LLM) and it’s Geospatial Applications
Large Language Model (LLM) and it’s Geospatial ApplicationsLarge Language Model (LLM) and it’s Geospatial Applications
Large Language Model (LLM) and it’s Geospatial Applications
 

Byod

  • 1. BYOD: Bring your own demons? ÁNGEL L. TRINIDAD RIGAU C|HFI, CFE, CISA, MCTS, MCITP, MCSA, MCT, CICA
  • 2. Agenda  Introduction  Benefits  Cons  BYOD and Regulations  Hostile Environment - Threats  Security Enhancement  Legal Matters  Final Thoughts  Questions
  • 3. Introduction  Bring your own devices (BYOD), it’s a new trend of permitting that employees can bring personally owned mobile devices (smartphones, tablets and laptops) to the workplace and use those devices to access, store or create company information.  The rapid rise of mobile devices and the introduction of them to the workplace bring new security and operational issues to companies.
  • 4. Benefits  More productive employees  24/7 access to the company’s email and information stored in the company’s servers.  Higher morale among employees because they can use the technology that they want and not what the company provide.  Low or no cost to the company  Hardware is bought and maintained by the employee  Sometimes, carrier calls and internet cost also are paid by the employees  Advantage of new technology
  • 5. Cons  Less security  Administrative cost  Software acquisition to manage mobile devices  Develop policies and procedures  Management issues  Infrastructure costs  Service (Carriers) cost  Not full control of the device
  • 6. BYOD and Regulations  HIPAA  Protect private data  Encrypt emails and data  On the device  On the transmission  Remote management of devices  Controls to access data and applications  Monitoring  Malware and threats protection  Compliance reporting  PCI/DSS  Explicit approval of authorization to use the device  Authentication (two factor authentication)  Comprehensive list of devices (make and model) and OS (iOS, Android, Windows, RIM)  List of personnel with access to this devices  Labeling of devices with owner information  Device encryption  Transmission security (SSL/TLS, IPsec) Mobile Devices and personal/confidential data are heavily regulated in some industries. Not recommended or have a lot of aspirins at hand. A violation of any regulation carried a fine. (up to 1.5 Millions per violation on HIPAA) (Other Regulations: GLBA, HITECH, SOX)
  • 7. Hostile Environment-Threats  Lost or stolen devices  The very best advantage of mobile devices is It’s worst enemy. Mobile devices are small, compact and …. Yes, MOBILE. Lost or stolen devices are the pinnacle of BYOD threats.  Attack surface  Rogue apps can extract contact information and data from mobile devices.  Even if you only allow authorized app, a scan of a QR code can download an app.
  • 8. Hostile Environment-Threats  Attack vector  Attackers can connect mobile devices to open wireless access points and start scanning your network.  Backtrack (and now KALI) have ARM versions that can be installed and be used in mobile devices.  Rogue Apps  Apps should be sandboxed. Only allow authorized applications on devices with company’s data stored.  Rogue apps are entryways of malware infections.
  • 9. Hostile Environment-Threats  Jailbrake/ Rooted Devices People tend to crave for power and control. One thing they do first with mobile devices is jailbrake or root it. This open a new window of threats. Access of rogue applications (and users!) to the root account could be dangerous to the company’s data.
  • 10. Security Enhancement  Management  A plethora of mobile devices exist with different models, OS’s, that a possible chaos could erupt at any moment.  List of all devices allowed access to the company and prepare a periodical reports.  Look for unauthorized devices on you network  Mobile Device Management  Mobile expense control (downloads, roaming and international costs)  Remotely locate, lock and wipe lost devices  Security control checks  Anti-virus  Lock mechanism  Apps  Jailbreak/root  Automatically wipe company data
  • 11. Security Enhancement  OS Update  Look for solutions that include different os.  Notification to users  SMS before wiping, exceeding data or service plan limit  Personal data segregation  Photos, email, calendar, call logs, voicemail, texts  Protect entryways to Corporation  Firewall rules checked and double checked!  Secure wireless access points  Single recurrent error  VPN  Quarantine unauthorized devices
  • 12.  Enrollment  Bulk enrollment or single enrollment  Authentication with Active Directory  Policy  Reason for authorization  Devises allowed on company infrastructure  Data services or personal plan (Stipend)  Security  Applications Authorized Security Enhancement
  • 13.  Cont. Policy  Services Provided  What data the employee can access with the device  Help desk services to personal device  Agreement between employee and company  Personal data  Education of employees of the risk associated with BYOD  Training of encryption application and communication  Not every “C” level employees knows about encryptions and safe communications Security Enhancement
  • 14. Legal Matters  First thing first- I'm NOT a Lawyer  Legal issues may arise  If the employee Is a suspect in an internal investigation, can I take possession of the mobile device for analysis?  The employee may be accountable for any access from the mobile device if he/she lost it?  Privacy?
  • 15. Final Thoughts  BYOD is here to stay  Prepare an analysis of the pros and cons of the implementation of BYOD in your company  Regulate the use of BYOD Policies anyone? Training programs for employees