Data Breach Scenario: BYOD

Companies around the globe have identified the convenience of employees bringing their own device to work. In fact, 82% of companies allow the use of personal devices for work, but out of those companies, which support BYOD, 50% were breached through an employee’s personal device.

The Verizon RISK Team outlined a typical scenario of how an unregulated BYOD culture can become a grave concern. In its report, it identified an instance where a customer was locked out of his account and getting an error message. An investigation revealed no suspicious activity within the servers, and anti-virus scans came back clean. Furthermore, there were no signs of malware within the local area network (LAN).

It wasn’t until investigators looked into the BYOD network that it found their culprit. A faculty member’s personal laptop was infected with a virus at home; and the virus later spread to the company network when the device was connected at the office.

A further review revealed that the BYOD and guest networks shared the same network equipment and Network Address Translation (NAT) with the corporate traffic. This made the company network vulnerable to malware from infected personal devices that are able to make their way past the firewall.

Common BYOD Risks

Common mobile malware includes trojanized apps and malicious links, both of which try to trick users into downloading harmful code to their devices. Third-party app stores, in fact, often contain malware-laced applications that can infect devices and gain access to their sensitive data.

Without a stringent BYOD protocol, company networks become vulnerable the minute an infected device is hooked up at the workplace.

BYOD Security

Public IP addresses should never be shared with unknown devices. Company networks need to be configured so that traffic from personal devices is sent out through a separate interface. BYOD security also comes down to best safety practices within the staff. All employees should be trained on how to handle their own personal devices, including:

Avoid accessing company data by connecting via over-the-air Wi-Fi networks
Avoid jailbreaking devices. Jailbreaking practice leaves devices more vulnerable to malicious applications.
Keeping all operating systems up to date
Encrypting personal devices and implementing strong passwords for both the device and SIM card

Only installing apps from trusted stores, such as the Apple Store and Google Play

Data Breach Scenario: Weak Configuration

Data breach Scenario: Malicious Software

Criteria for Evaluating EMM/MDM Solutions