Guidelines for a BYOD Policy

These days, employees want to bring their own devices into the office and use the wireless at a minimum. That is understandable. We are connected to our devices like never before. It’s almost as if they are an extension of our appendages. Unfortunately, this need to have them with us at all times creates a level of complexity for CIOs and CISOs on how to manage these once they connect to company resources. After all, once people leave the office, it’s impossible to know what the users are downloading onto them, what sites they are connecting to, how they are using free WiFi, etc.

To help out, IBM released a list of suggestions to help managers create some guidelines for a BYOD policy at the office.

Establish Rules

Work together with management to create guidelines on how data can be accessed, consumed, and distributed when using the resources available at the office or through the company network. Decide which devices are acceptable and which are not and enforce the rules.

2

Don’t make exceptions. If employees and third parties want to connect to the network, make sure that all devices are accounted for and that none are unknown. Unknown devices create additional risk that isn’t needed or wanted.

2

Add in management apps and software to all devices so that IT can log into them remotely and ensure settings are adequate. Require antivirus and antimalware software on all of them and ensure they are all configured with appropriate security settings. Be sure to add a method for disabling a device remotely in case it is lost or stolen. Adding encryption is also recommended.

2

Tell everyone who wants to access company resources of the policy and get agreement on it. In addition, implement a training and awareness program so that everyone is kept up-to-date on the policies, how to handle sensitive data, proper use of public WiFi, and how to report losses, should one occur.

Allowing employees and others to bring their own devices into the workplace is not necessarily negative. However, it needs to be regulated and managed or the risk of something nefarious impacting the network is significantly increased. No longer do personal mobile phones and laptops affect people only at home. They now can also have a significant impact on your business.