The practice of BYOD (Bring Your Own Device) was already common even before it received this designation. Its use consists of increasing mobility in the corporate environment, granting professionals the freedom to use their own devices — smartphones, tablets, laptops — during work hours to access information on company systems.
The concept emerged in 2009 to promote interaction among teams and increase satisfaction in the organizational environment, allowing each employee to choose the device with which they would perform their duties. But BYOD gained momentum with the expansion of mobile behavior, and therefore it has been adopted in the corporate environment as a way to optimize IT infrastructure management.
In this article, we will present considerations regarding this development and implementation methods that ensure the security of company data. Check it out!
1. Include BYOD in internal policies
Corporate BYOD adoption rates vary by region and industry. But, according to analyst estimates, these rates have reached between 40% and 75% — driven mainly by smartphones and tablets.
For the implementation of this strategy to succeed, it is necessary to establish a strict Information Security Policy (ISP), with reinforcement at all levels. It must cover everything from data collection to its transmission, processing, storage, and use.
This process also requires best practices. This means incorporating security routines into employees’ daily lives and training programs, prioritizing awareness of responsibility as a factor in workplace safety.
Digital accident rates compromise the reliability levels of the entire company. Therefore, incorporate points regarding concern for data security into each employee’s performance evaluation.
2. Structure a security architecture
The implementation process must consider factors related to GRC (Governance, Risk, and Compliance), which clarifies issues such as approach methods, control of information security requirements, device maintenance costs, and time restrictions for accessing the organizational system.
To establish strict policies and reduce IT incidents, it is necessary to structure a security architecture based on recognized methodologies. One example is the ISO 27002 Standard, which describes best practices for information security management.
Thus, it is possible to enjoy the advantages of the strategy without compromising the criticality level of the systems. Vulnerabilities must not be allowed to affect the performance of the IT infrastructure and users — the main permissive agents of intrusions such as email phishing attacks, for example.
According to the Cyber Incident and Risk Trends Report, more than 350,000 IT incidents were recorded in 2017. Of these, 93% could have been avoided with updates, email blocking, and employee training.
3. Establish rules for using corporate email on personal devices
The confidentiality of corporate emails is guaranteed by jurisprudence (Art. 932 of the Civil Code). This article establishes company liability for the address it owns, including its content, with all users being subject to monitoring.
This is no longer the case with personal email, a medium that has privacy protection. For this reason, it is necessary to establish rules that ensure information security according to the type of access.
4. Institute compliance
For BYOD to be successful, employees must be aware of their responsibilities regarding the content accessed. However, this requires legal support, reaffirmed in security procedures. Therefore:
- Collect signatures on liability terms;
- Institute the use of personal passwords for automatic device locking;
- Install the same operating systems and protection systems (antivirus and firewall) used by the company on the devices;
- Require periodic cloud backups.
As we can see, the biggest challenge in introducing BYOD to the organizational culture is ensuring the preservation of shared information. This process can be facilitated with a proper usage policy, access controls, and the restructuring of Virtual Private Networks (VPNs).
Now that you know how to ensure information security with BYOD, follow our social media profiles and stay updated on market news. We are on LinkedIn, Facebook, Twitter and Instagram!
