Our company is implementing a BYOD policy. I am working with management to draft end user training guidelines / standards as senior member of the Information Security team. Our company is in a regulated industry and works routinely with PII / PHI. Company employees come from varied technical backgrounds from cybersecurity background (like myself) to completely non - technical (e.g: customer support representative in call center).
As BYOD is implemented, I see end user training of security controls and security awareness to become much more important, as endpoint device security become more of the user's responsibility, responsibilities such as the ones listed below. I also see incident response responsibilities from the end user taking greater importance, to mitigate incidents such as this one.
- User device patching
- Maintenance of AV and malware solution
- Use of encrypted WiFI and avoidance of public WiFi hotspots
- Secure storage and transmission of company data and user requirements to segregate company data from personal data on the user's device
I have been thinking of ways to tailor the education to all end users, IT or not. Our team want the training to be sufficiently in depth so end users know what their expectation are regarding protecting company data on personal devices, but not so technical that end users are confused. What I am thinking for a draft:
Very high level of BYOD for non - technical folks focusing on why and what
Same high level training as above, but more technical details of how for IT employees with more technical know-how
When giving training materials on IT security to company employees, how should the decision on what level of training is appropriate best made?
Are there any other considerations for training end users on their increased responsibilities and expectations when implementing BYOD
What changes in training method or content, if any, should be made for third parties / vendors (some international) who access company IT resources from their own device?