3

I've heard complaints about allowing employees, clients, etc. to bring their own device and connect it to the network. What exactly is the complaint and how can it be a threat? If no network resources are involved, how is this a security problem? For example I don't see what it matters if someone brings there laptop from home and connects to the company wi-fi, just using the same internet connection doesn't open up a bunch of doors that I'm aware of? In fact some businesses use this as a selling point, such as Starbucks and Mcdonals advertise free wi-fi for anyone who brings there own (virus infected) device.

For this question I'm not considering "liability" of what someone does with particular IP address, for example someone can use a free internet connection to hack into a company and then the owner of the internet connection gets sued.

Improve this question

2 Answers 2

Reset to default
5

... allow employees to connect their own devices to the internet? ... bring their own device and connect it to the network.

There is a difference between these two phrases and this difference is the important one. It is not really a problem to let users connect to the internet per se with their own devices.

The main problem is if users connect their devices to the companies internal network, because then they might infect the network with malware or cause the leak of sensitive data through there private devices.

Another problem is that any traffic will be associated with the company, which includes clients send spam, spreading malware or downloading or distributing illegal files etc. Thus the company might be held liable for any damages.

Improve this answer
4
  • 1
    Being held liable is one thing but imagine sending out bulk emails using the corporate IP could get you blacklisted. In case your companies mail server is using the same IP users access the internet with (design flaw) it could also cause mail issues when put one specific RBL's as most mail server will no longer accept your emails.
    – Jeroen
    Nov 20, 2015 at 8:13
  • I was given the example today that, at my school, students are allowed to connect to the university wi-fi through their own devices. They said this poses a security risk. Though we sign on to the wifi using the same credentials we use to logon to a computer on the the network, I don't believe we're getting any more access to the internal network beyond the internet connection. Is this still a vulnerability? Basically I'm asking "where is the distinction between using a networks internet connection and using the internal network beyond that?"
    – Celeritas
    Nov 20, 2015 at 8:44
  • @Celeritas: First there might be a difference between what you believe what kind of access you have (without proof) and what you have in reality. Apart from that see the part about liability and the excellent comment about getting blacklisted.
    – Steffen Ullrich
    Nov 20, 2015 at 8:56
  • While Blacklisting may not be an issue for McDonalds or Starbucks, since they send their email via their company mail server, while the branch IP address could possibly be blocked by other mail servers, this does not hold for universities with a campus network with single uplink. Yet in Germany many "free wifis" have a different IP address altogether, running on a second landline or at least a different VLAN. This is so the branch's main IT is still operating should police step in after copyright infringement claims and seize the whole network from which some "guest" infringed copyright.
    – Alexander
    Nov 20, 2015 at 9:21
2

BYOD means that your legal liabilities become CONJOINED. If the company is sued, or the FBI shows up to confiscate equipment, your personal devices become part of that search and/or seizure. If they allow you to use their computers for personal business, they assume the same level of liability for your behavior.

Conversely, your company assumes a certain level of liability and risk for your devices. While there are NAP tools to manage virus scanners and updates, the company is not going to have sufficient control over your personal device to reasonably ensure the device is safe for use on their network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .