How should security user training be provided when implementing a company BYOD strategy?

Question

Our company is implementing a BYOD policy. I am working with management to draft end user training guidelines / standards as senior member of the Information Security team. Our company is in a regulated industry and works routinely with PII / PHI. Company employees come from varied technical backgrounds from cybersecurity background (like myself) to completely non - technical (e.g: customer support representative in call center).

As BYOD is implemented, I see end user training of security controls and security awareness to become much more important, as endpoint device security become more of the user's responsibility, responsibilities such as the ones listed below. I also see incident response responsibilities from the end user taking greater importance, to mitigate incidents such as this one.

• User device patching
• Maintenance of AV and malware solution
• Use of encrypted WiFI and avoidance of public WiFi hotspots
• Secure storage and transmission of company data and user requirements to segregate company data from personal data on the user's device

I have been thinking of ways to tailor the education to all end users, IT or not. Our team want the training to be sufficiently in depth so end users know what their expectation are regarding protecting company data on personal devices, but not so technical that end users are confused. What I am thinking for a draft:

1. Very high level of BYOD for non - technical folks focusing on why and what

2. Same high level training as above, but more technical details of how for IT employees with more technical know-how

Questions:

1. When giving training materials on IT security to company employees, how should the decision on what level of training is appropriate best made?

2. Are there any other considerations for training end users on their increased responsibilities and expectations when implementing BYOD

3. What changes in training method or content, if any, should be made for third parties / vendors (some international) who access company IT resources from their own device?

Answer 1

In the security community, BYOD stands for "Bring Your Own Disaster".

Any realistic implementation would need to be segmented networks with core systems isolated from the more general access network.

Company access should only be through a company supplied encrypted VPN/Tunnel application with 2FA. This in turn implies individual tracking, vice generalized permission.

Limit personal device access to a whitelist of services and protocols.

Comprehensive network activity monitors need to be running and paid attention to, not logged and ignored as is so common.

Training should emphasize network monitoring. Make it it clear and public that individual actions are tracked and recorded.

Good Luck!

Answer 2

What level of training is appropriate? The level of training that results in changed behaviors. The entire point of training is to get people to behave differently or consistently. To accomplish this, you typically need to create tiers of training to accommodate the different levels of technical knowledge.

The increased considerations for BYOD security training have to do with an increased awareness of the classification of data now on their personal devices. They are walking around with company-sensitive and PHI/PII data in their pockets. The other point to make is the impact of handing their personal device to family members. While they might think twice about handing a company phone to a toddler, they might not think about it when it's their own phone.

As for 3rd parties, whatever training changes you want to make depends on what behaviors you want them to have, just as above. If you want them to behave differently, then have different training.

Answer 3

I once saw a joke about a bug that could not be fixed before shipping. It said: "We'll fix it in the manual". And when it wasn't in the manual: "We'll provide training."

So you are now at the end of that line: you need to provide the training. However, if you do not have all the technical measures, processes, monitoring and the likes in place to safeguard your data and processes, no amount of training will be enough. You state:

As BYOD is implemented, I see end user training of security controls and security awareness to become much more important, [...]

That basically says to me that you are solving deficiencies in your security with training.

You probably have some guidelines already set, like do not store sensitive data on your laptop, report when your laptop gets stolen, wipe clean before you resell the laptop/phone etcetera. In my experience, no amount of training will ensure that people actually do this.

The problem is: people need to do their job. Unless you have found the Holy Grail of automation, they will always hit the limitations of the systems, and will work around it. That will mean storing data on personal devices, because that is more convenient in a specific meeting, or all sorts of other reasons. And he/she will get praise for having the data available, and not a reprimand for having data on a personal device.

I would suggest that in your training, you address at least the following points:

• What kind of data are we dealing with, what are the consequences for the people whose data gets lost and what are the consequences for the company
• Report if you see something strange. This MUST be backed-up by a process that handles these reports and provides feedback on what is done with the complaint. There should also be an open atmosphere about these reports, and not a Kafka's Process handling.
• have a part where the participants can ask how to do their jobs without breaking the rules.
• Don't just tell them you have security monitoring, show them.
• Make sure they understand that, if something is technically possible, it does not mean that it is allowed.
• And of course, make sure they patch, use Bitlocker/Luks/etc, have anti-virusses, strong passwords and a s*tload of technical stuff.