BYOD - Challenges of protecting data - Part 2

[#1]

Fair warning! This post is a little ...lengthy, or as I like to think of it - "complete".

Welcome to part 2 of a 4-part series on Bring Your Own Device (BYOD).  The previous post provided some background on the subject, and gave some setup for the series.  In this second part of the series I will address one of the key points that proponents of BYOD use to make their case - employee productivity.  Productivity appears as one of the focal points of many discussions around BYOD so in order to understand the implications we must first understand the full scope of the point.

Just last April a CIO.com article titled "Are BYOD Workers More Productive?"  The author, Tom Kaneshige, comes to the conclusion that BYOD workers are indeed more productive with this conclusion- "The silver lining, though, is that BYOD really does lead to net worker productivity gains."

CIO's are a generally smart bunch, and won't just accept this as truth without some proof, as he goes on to elaborate: "But CIOs prefer quantitative metrics over qualitative hearsay, and clear-cut BYOD performance gains are somewhat elusive."  Herein lies the rub, as they say.  You see, there are some subtle things going on here that are only obvious if you've gone through one of these programs, or are in the process of bringing your own device into the office - with or without corporate IT's blessing.

After I wrote the previous post I had some fantastic reactions from folks who are either living this today, or have some other experience in the matter.  One comment caught me particularly at attention, from someone claiming to be "slightly anon" .  Read this comment and notice the touch on productivity...  My reader uncovers a negative aspect of BYOD which is a little scary for some folks - the part where your device is compromised.  Productivity is nice to talk about when you can sit at home and read your corporate email on your tablet, or mobile phone - but what if that device is ridden with malware, or hijacked to be part of a botnet... there are very serious security and productivity implications there!  Great point, let's expand on this just a bit.

So who supports this 'broken' BYOD device anyway?

Think about it, what happens when your user's laptop isn't quite working to spec today?  Odds are the user calls IT support.  As much as we all like to complain about how poor support is in many organizations, it's one of those things that we complain about until we have to do without.  Your employees may think your IT support is the worst in the world, until they have to call the store they bought their mobile phone at, or the manufacturer, or worse some 3rd party - because their device isn't getting corporate email.  When there is a clear ownership of the device (corporate owned device, corporate problem, right?) the support call is clear - but when the corporate email simply "won't work" on, say, an Android device - who gets the call?  I can just hear the string of "well, that's an issue with your corporate email, call your provider" calls, and finger-pointing endlessly from carrier, to hardware provider, to corporate IT ... where does it end?  Who ultimately takes responsibility for the support?

Making a clear distinction is hard, because if it's a personal device you can't expect your IT organization to support every mobile device out there, can you?  It would be insane to think your corporate IT support people would handle Apple, Samsung, HTC, Motorola, LG and countless other devices each with their own operating system, nuanced applications and carrier issues potentially.  Yikes!  Think about this when you talk about increased productivity gains ... how fast can your corporate support team offer support for a thing they own end-to-end, versus having to share responsibility and potentially finger-point with other vendors' support organizations?

On the other hand ... this could be a very nice thing for your IT support organization.  Not having to have a fully fledged support department that supports cell phone carriers, operating systems, applications, corporate connectivity and everything else lets you focus on the things that really matter to your company.  Your corporate applications matter because you support those - why not outsource the support of everything else to the experts?

I think I have a "virus"

I can hear the support calls in the queue right now.  "I think I have a virus", my BYOD laptop/tablet/handset isn't working right."  Even if, and I'm not willing to take this as a given yet, productivity due to improved support is a reality as a result of BYOD, what happens when security issues start to get in the way.  Productivity is hampered by malicious software (malware) and other unfortunate surprises all the time in corporate IT land.  I know my laptop's been nuked a few times over the years not because I browse the dark recesses of the Internet, but because I hit sites like BusinessWeek.  If legitimate sites can't keep from being hit and spreading malware ...what hope does the average business user have?  Now ask yourself how careful you are with your "work" laptop versus your "home" computer ... if you're honest I bet you're willing to click on, or go to, a lot more risky content from a computer you know corporate isn't monitoring you from, right?

So as the commenter brought up - there are serious roadblocks to productivity when your personal gadgets are malware-ridden!  Oh, and let's not forget the liability issues now.  Remember how when you went through new employee training they told you that surfing "questionable content" was something that could result in you being written up, or even losing your job?  What happens when you bring your personal laptop into the office which is infected with some piece of malware, and that laptop starts to open up pop-ups of a ...shall we say ... questionable taste when other co-workers are around?  What does HR have to say about this whole mess?  When your workstation was corporate-managed you could just blame it on corporate IT's inability to keep malware off your system ...but now that responsibility is yours right?

What if your machine attacks another organization from within the corporate perimeter, as part of a BYOD-approved work agreement?  Who's liable for the attack?  Is it you the individual, or the employer that gets the suit filed against them?  I'm not trying to be funny here, this is serious business.  I suspect most folks who think about BYOD and start thinking about all the money they're going to save on devices rarely think about the liability they're accepting, or pushing off on their users... are we going to get a piece of paper to sign that transfers liability to the user from the corporation?  I wouldn't sign it ...would you?

It's not all that gloomy

OK, I admit, for someone who's generally upbeat about bringing your own device into the corporate environment, this post has turned particularly negative.  Looking deeper into the issue is troubling, and I definitely think there are serious challenges.  However, all is not lost.

Where corporate IT had the ability to push those 10 "agents" to all of your corporate-owned laptops before - you know... full-disk encryption, anti-virus, anti-malware, identity-control, personal firewall, personal IPS, policy-enforcement - now you don't have that ability.  Well, maybe...

There are two camps out there of thinking - some organizations make provisions to push items out to their clients, while others simply monitor for the presence of such.  I can tell you that at my old job, we allowed people to plug in non-corporate-owned assets onto the network with a few conditions.  When you popped your system onto the network you would eventually be presented with the 'captive portal' which told you of all the rules and regulations of being on the network.  You could choose to simply have Internet access (which was via a GRE tunnel to the outside of the corporate firewall) or you could install the corporate package to bring your machine up to compliance, if it wasn't already, with standards.  These standards included things like a complete, managed, anti-virus package and personal firewall along with an identity management agent... and the ability to poll your machine to enumerate running applications and to determine the general health of your PC.  Once you passed the 'check', you would be allowed onto the network and have access to corporate resources.

How many of us today would be comfortable with this?  Maybe you are OK with it, maybe you're not - but to maintain the security of the network (integrity, really) this was necessary.  Also, there was no self-destruct so once you jumped into the network once and installed the bits they were on your machine until you forcibly removed them manually.  Most people wouldn't know how to do that by themselves... Then there's the issue of how easy it was to 'fake' the installation of the corporate package.  Our red team exercise determined that with a few manually entered registry keys, a few 'faked' replies on specific ports via a script, and you're off to the races without having to actually install anything.  This begs the question of how much security was really being offered!

The other approach I'm seeing and hearing about is the governance/monitoring approach.  It's quite possible to allow your device to be enumerated by the corporate 'checker' as in the example above, to make sure you've got up-to-date anti-malware and are up on your patches and application tweaks.  If you are not you can simply be denied access with recommendations, rather than force-feeding you binaries and corporate stuffs.

Even though there are ways to 'trick' your way onto the corporate perimeter, there are even more options for maintaining the integrity of the network.  As one of my colleagues, @JadedSecurity, says - consider everything on the network hostile and work from that premise.  This means that you'll need more IPS, more firewalls, more VPNs and generally more 'stuff' to make sure that your network doesn't flood up with nastiness.  You could always harden your applications, tighten access to critical files and systems, and manage identities better ... but you would have already gotten that right by now.

The final analysis

So ... does BYOD help productivity?  I don't know, maybe.  I guess I started this post out with the intention of extolling the virtues of having a more productive workforce - but now I'm not so sure.  Having a background in information security - I just think maintaining integrity of your corporate space gets that much harder and depends that much more on the fundamentals we're all failing at... Seriously.

Is it possible to maintain the integrity and security of your corporate network if you implement BYOD?  Absolutely.  Is it more difficult to do when you don't directly own and control the device?  Research would point to yes, absolutely.

As always, your mileage may vary depending on what the state of your IT affairs is right now, before BYOD.  Things could be better, and in some cases this is possible, but unlikely.  The security of your organization could also take a serious turn for the worse ...but you know what, it still all comes down to doing your fundamentals right.

Secure your applications.

Manage your identities.

Tighten control over access to critical systems and data.

If you do all those, BYOD can be a good thing.

[#2]

From someone with a background in infrastructure and support, I am leery of this BYOD = increased productivity theory.  From the user end, the malware bit alone would be a serious factor.  Think about the last time your family helpdesk line was called with "that annoying pop-up" or "I think my system is infected, its running slow." Now multiply that call by the average number of calls you receive on your corporate helpdesk for the day-to-day low priority stuff.  In this idea alone you are now upping the workload of the current helpdesk and desktop support teams.  But what about the user, well of course now they are probably down because the system needs to have a couple full scans done to see if there is malware on the system.  If there is, that is probably the easy part.  If there is not, well now the teams need to troubleshoot.  Is it software?  Hardware? An advanced attacker hiding from your scans?  That last one keeps me up at night.  So now the person's system is down for additional troubleshooting.  Do they have a loaner system?  Probably not, because we are BYOD we don't need to have our corporate systems any longer right?  

I am in an environment now that if my current standard image system croaks or needs to be re-imaged, I can get a loaner until my main system is back up and running.  The standard image has all the software I need to do the basics of my job.  At most I will not have my more advanced apps (nmap, powershell, etc...) for a day.  But I will have my email, access to intranet sites and my data which is currently stored on network shares.

Now my first thought does not take in the facts that the organization would have all the proper mitigating factors in place;  Network Access Control systems, pre-checks and such.  The argument is will the users be OK with that?  Well this is where legal needs to be involved because you are riding that fine line of privacy concerns.  I am from the old school where if you use the company resources on the company's network, then you, your system and your data are subject to review at any time.  With BYOD, you are now opting to make your personal device subject to the same review.  If a user is not OK with that then they could simply opt out of BYOD and use a standard issue device.  Why is that so hard to grasp?  

Now back to the possible infection by an unknown piece of malware by an unknown attacker...  So many advanced attackers will target specific users.  Add BYOD into the mix now they can target them at home on much less secure networks.  They can compromise the system there and build their recon info on what software is added to the system when it was allowed onto the network.  They can further compromise the device and get screen capturing and keylogging tools on it.  Like you mentioned, data is all things.  A screenshot of IP/PCI/HIPAA related data could be just as good as the documents themselves.  In any case they have a nice system they can tailgate on to get to the internal network.  

[#3]

Forgot to add something... So I fail to see where the productivity increase comes in?  Even if all things are perfect and the user has a clean system.  How is that any different than having a corporate issued standard image?  What do you do about any possible productivity killers on the device such as games or even personal projects the user may be working on?  If they get bored they may fire up a game and play, probably more so for people with offices or cubicles with high walls.  Or they are doing side work and now they start working on that at the office on company time.  How do you prevent that?

[#4]

Dewser,

Great points and a very mature and developed perspective.  I really hope this BYOD is just a passing fad idea.  It might work just fine for certain organizations, but I think medium and large organizations should stay away from this at all cost.  You make a great point in mentioning the legal side of it.  It might cause issues with privacy laws.  Has "reasonable expectation of privacy" been fully qualified in the law for BYOD-type circumstances?  If I get a device to troubleshoot it and then user then complains that I rummaged through their system - how do I protect myself and the organization from that?  Don't we already have enough frivolous lawsuits?

Maybe I'm just oldschool and more stuck in my ways, but I see this as a push against the ever-tightening restrictions of infosec (which is a direct reaction to more crackers with higher levels of skill).  Of course we will always have the executives who will want to have their own devices on the network and we will have to support those, but that is an obvious exception and just a security risk that has to be managed by many IT departments every day around the world.  Giving every employee "executive" priviledge to bring in their own device simply doesn't make sense.

I am really confused as to exactly who can possibly arrive at the concept of greater productivity from BYOD.  It goes against everything I've seen in the field.  Organizations already have to lock down their internet because employees can't seem to stay off Facebook for more than 10 seconds.  When stripped down it all comes back to access control - which is the most basic and fundamental foundation of security.  If you destroy or circumvent that - then why even bother having any security at all?  I'm appalled at the attitudes of so many toward security when we are seeing breaches more and more often with greater sophistication.  Now is the time for the community to be working hard to continue to stay up to date with the hacking landscape - not for us to throw caution to the wind and let every swinging joe with an electronic device connect to multi-million dollar systems.

I echo your concerns about targeted attacks.  I give all threats their due concern, but there really isn't much that can be done against a talented, experienced, and well-equipped cracker who has time and the element of surprise on his/her side (worst-case scenario).  BYOD seems to me as if it would only compound this issue and make it easier for less skilled crackers (of which there are far more to worry about) a back door into the company.  At some point I feel like throwing up my hands and saying, "OK, but don't say I didn't warn you", but that would be irresponsible of me and go against my own morals and personal and professional code of ethics.  I will harp on it till the very end.  BYOD should realistially cause any risk matrix result to go off the charts.  It should set off the klaxons and warning bells, but it doesn't seem to be and this dangerous fad actually seems to somehow be gaining momentum (much to my chagrin).  Thanks for a great post, Dewser.  I appreciate that there are others out there who are pushing back against this as well. 

[#5]

I think I want to frame the BYOD debate with a scenario so we can get at heart of the implementation issues. I manage information security for a midsized services company (2K plus users) about ¼ of those are software developers. These guys are power users and are the vocal majority pushing the BYOD initiative. In the software dev world companies live or die by innovation and creativity, they need to attract the brightest and the best and they need to let that innovation and creativity thrive. BYOD seems poised to enable just this, it’s a major selling point for recruitment and it allows freedom to use the tools our teams want to use. For this to work we need to scratch the idea of bring your own hardware (corporate supply the OS) in favor of true BYO-anything (software, hardware, cloud etc.)  I in this scenario also want to address data loss as a threat. Data loss is not a factor. We use VDI and all sensitive assets live in the VDI realm. Yes it’s a dream scenario but I don’t want an endless debate on this, there are excellent ways to prevent data loss if your business is behind you. So with the scenario laid out lets address some un- tackled issues (this will mainly be a recap of the @wh1t3rabbit post). What do we do when something goes wrong with a user owned device? ·         Malware impacting user productivity? Let me count the ways: DNS re-director, ransom ware, file erasing worm, etc. ·         Regular maintenance issues impacting productivity? A personal example: third party driver updated creates a sad Mac of death. In these scenarios an IT support group who has been absolved of responsibility for the BYODs is not going to be of assistance to the end user and the company is going to be losing productivity with no estimated time to resolve, and no clear escalation path. In the best case the end user is also a competent administrator and is spending their time fixing issues that were previously dealt with by a tier-1 support technician. This is not a good use of your (highly paid) developer’s time. If we take the other approach and the IT support group is expected to support the BYODs (in some hybrid fashion) then the impact is going to be felt by your support group. IT support is already strained with a single OS and patch level adding more to the mix is just asking to grind your support shop to a halt and guarantees poor service for the end user. How is your IT support group supposed to help fix a kernel panic on a Linux box? Suddenly your teir-1 endpoint support became a teir-3 Linux admin and your user is down until the issue is fixed because you don’t have a loaner Linux box running Mint. Any way you cut it list is lose-lose for the business. The only gain would be if the productivity gained by BYOD outweighed the downtime/wasted time of your users and your IT support shop. Now lets tackle the liability issues facing user owned devices in the enterprise. What happens in the company is the company. ·         Malware impacting other parties outside the organization originating from your domain? ·         Software piracy from your domain? ·         Licensing liability for consumer software licenses being used to support/develop your company’s product? These issues seem easier to deal with on the surface (user agreements that shift liability to the end user) but in reality this is a last defense. By the time a domain blacklisting goes to court your company has already faced countless service interruptions, impact on customer relations and reputation, not to mention legal fees. So what is your first line of defense? Installing agents on endpoints and terminating network service upon malware or non-compliance detection? OK what happens when you disconnect the network? Who remedies the issue? For the answer see the paragraph above regarding wasted (high paid) user time and impact on IT support. Not to mention the strain placed on your IT support shop when you ask them to maintain a list of agents (antivirus, VDI terminal, software enumeration agent) for all BYOD OS’s (Windows, OSX, (hundreds?) of Linux variants). In this scenario I have conceded two very debatable points in favor of BYOD (do users need it and what about data loss) and we still don’t have a workable solution. Being one of those security folk whose job depends on enabling our business (of which productivity is a large part) I would really like to debate some solutions. I do not think these issues close the door on BYOD but they are far too large to be overlooked. I’m hoping that someone who has taken the plunge can add a voice to this debate.

[#6]

Slightly anon,

I could understand BYOD if the organization employed people who use this stuff for a living.  For example, I would be far more accepting of BYOD at a company which employed a large number of IT consultants / programmers (or pentesters whathaveyou).  But, in an average situation where the vast majority of the employees have little tech knowledge - how am I supposed to just trust that they won't unintentionally allow an attack?  I think that Mr. Los really hit the nail on the head when he mentioned that the industry is failing at the basics right now.  I think that BYOD could most certainly be a fine solution, but, as I mentioned before, security as a standard just isn't good enough even if the industry as a whole was on top of the problem.  I also would absolutely love to hear from someone who has implemented this and get some feedback there.  However, I suspect that most anyone who has mainly employees that are high value and tech related or dependant positions would have greater success than an organization with high turnover rates and minimum wage positions that cycle every month.

I would also feel better about it if it was already integrated from the beginning of the analysis, architecture, and design phase (whether that be at startup or reboot).  The tools, processes, and policies of the IT department would definitely need to be closely tailored to this system to be effective.  I don't want to toss up another really long post, so just to say, I would be for it if I felt that the risks were mitigated and the creativity and productivity were measurable.  I would feel even better if an implementation plan across iterations toward the long-term target were clearly defined, functional areas were adjusted to suit the new architecture, and processes were clearly and concisely mapped and evaluated before-hand.

I guess my biggest fear from an administrative position is that organizations will try to jump on board this fad without realizing the incredible work that it would take to keep the user hierarchy in some semblence of organization without introducing too many more diversity levels.  It just seems to me that preferred paths would become extinct and non-optimized paths would quickly replace them - making load balancing and projection harder from the admins standpoint.  From the infosec standpoint - that of a hacker - oh I would love to pentest a BYOD company.  A target-rich environment with minimal standardized access control with disparate systems and silos is very tempting.

[#7]

As an IT guy for over five years, and now in the hiring process to become a pentester, I see a lot of challenges for a BYOD environment.

For a large enterprise organization, I really see the potential for it becoming a "land of confusion" in the IT dept. I would hope that there would be some standards and procedures set in place by the organization along with serious considerations as to "what if" scenarios.

For a smaller company(5-30 people), I don't see it being as such a pain in the jaw as it would be for a larger place. Chances are a smaller company either has a managed services provider to handle their needs, one IT person, or someone that kinda switches hats between IT and say.... sales/payroll/whatever their main job is.

My main gripe with larger organizations doing BYOD is there could be a total lack of standardization, with hardware, software, licensing, and ability to train end users how to use their technology well and efficiently.

When an organization uses a large manufacturer to purchase large amounts of equipment from, they are generally able to get large numbers of the same computer model, or one very close to it at any given point. Having desktop/laptop/tablets that are all the same make to issues to employees makes the PC procurement process much quicker when it comes to imaging, or even creating an image to use enterprise-wide.

On the support side of things, many devices have their own unique quirks, known hardware issues, software incompatibilities, etc. A helpdesk or support group would be able to rectify any issues a user has much quicker if there is documentation and knowledge on issues.

I suppose one of my big fears is say a disgruntled employee looks up some youtube videos, blogs or whatever to learn about privilege escalation, hacking, or anyway to bypass security measures to maybe steal confidential information or just to cause a headache within the organization. It may be a long shot suggesting that but, I see that as a potential attack vector and lets face it; weirder stuff has happened.

Might add more to this later, all I have for now.

[#8]

I hadn't thought about the software licensing issue before reading this post and its comments, but just to bring it home, suppose one of your users has installed an "unofficial" copy of XYZ Tool that was downloaded from Big Pirate Site, then uses the XYZ Tool from his own device to produce something for your company, which also does not have any XYZ Tool licenses.  Your company releases this with great public fanfare.  XYZ Company notices this, and knows you do not have any XYZ Tool licenses.  The individual user may not have been worth going after, but you are.  Do you think your agreement with the user that the user is responsible for the device is going to fix this?

[#9]

While I agree that there are several InfoSec policy and IT support questions to work out, I think many of you are blaming BYOD for issues that exist in many corporate environments without it. 1 - Data loss: Many companies allow computers to connect to foreign wireless networks. Once I'm on my own network I can copy pretty much anything I want from my laptop, whether BYOC or corporate, without InfoSec knowing about it. Perhaps you've deployed DLP in a way that would help with this risk, but I bet few have. 2 - Software licensing: Many companies make their developers admins on their company laptop. At this point the developers can install third-party software and use it to my hearts content. Perhaps you would detect this with IPS, web proxy, software inventories, or other means, but I bet few would until it was too late. 3 - Standardization: I agree there are efficencies here, but unless you are in a highly secured environment, take a walk and count the number of Macs that people are using in your environment. BYOC is already in play if you count even one Mac in use and don't have corporate Macs. My point isn't to tell you to give up. My point is to say, distinguish between any illusions of control and the realities of your environment as they exist today. Then look at the impact BYOC has on your company's risk. My company is planning to roll out BYOC and already has pilots in place. We are focusing on policy, governance, and making the program 'opt in' so we can have the user agree to some monitoring and limits. We plan on offering loaners for users whose laptops are broken in a way we don't support. And we are segmenting our corporate network from the BYOC network and better controlling the flows. We're finding these measures to be effective. We also are finding security advantages. For one, more users want to partner with us FOR security instead of feeling oppressed and being against us. The above won't work for every organization, but I think it would for many.

[#10]

MikeH9,

You have some interesting points, but what I think we have really arrived at is that we're not blaming BYOD for current failures - we're acknowledging that BYOD would compound current failures.  I made the point in my blog that there is always the risk of rogue devices and departments already have to deal with exceptions to the rule (e.g. executive priviledge), but to allow everyone that priviledge would be a tremendous risk on top of the current risk.

You do make some good points about the software licensing risks, although I can't say I've agreed with this 100% from the start.  Of all the risks that we have been examining, I believe that code and apps from unlicensed software is probably fairly low on the matrix.  I think that most developers who enjoy working as a developer understand the issues that licensing can bring and probably avoid it.  I would honestly trust developers more than I would a general employee.

I have been pushing for controls and regulation on devices, but let's look at it for what it really is.  Once you introduce an entire new network heirarchy just for "BYOD", then all you're really doing is building a separate CDN designed to do what? - the point of a network is to empower collaboration and profitability through services built-in to the solution.  My point is, that if a certain developer wants a particular software, why would the company not simply license that software?  Is it really boiling down to greed (i.e. we don't want to pay $7,000 for a license for this so let's just let them bring their own "copy" in on their own machine (that 'might' not be a legit copy?)).  My point is, what is BYOD going to solve that can't already be accomplished on the current network with current security policy and enforcement and with current standardization protections in place?  I'm still failling to see the real net benefit.

I think the discussion has led us to the point that we really identify that a small business that operates a small network with a small number of people who could actually benefit in some manner from BYOD would be acceptable.  Unfortunately, I believe that the average organization ( especially those in healthcare) should steer clear, and very much so in situations where some or many of the employee positions are considered expendable (or who rotate often due to high turnover).  I think I can speak for Mr. Los as well when I say that, overall, we are not pointing the finger at BYOD for problems, we are acknowledging that BYOD would only further compound those problems by and unacceptable amount.  Thanks for the great comments and ideas.  You got me thinking and compelled me to respond.  That's exactly what we need in this industry right now.

[#11]

Your point on "What if your machine attacks another organization from within the corporate perimeter" is an interesting one. In recent years one of the biggest sectors where BYOD has changed everything is education. For most colleges and universities it makes sense that students and staff bring their own devices. Recently I worked with a university where a rooted iPhone was attempting to connect to hundreds of other systems outside of its local network. This resulted in a notification been sent to the university requesting that the incident was investigated and stopped.

Another issue that I see coming up a lot is that BYOD puts increasing demand on IP address management. In the case of an educational institute, students can grab 3 or more addresses. Many network managers are decreasing the lease time for address assignments so that they can be recycled quicker.