The Growing Case for
Corporate-Liable Mobile
Devices over "BYOD" inFinancial Services

Sponsored byPresented by

Financial services firms are raising an alarm about mobile

freedom of using personal phones for work. This opened thedevice security as federal regulators continue to crack

door to increasing use of consumer communications apps

down on improper record keeping at a number of banks andin the work setting. Employees on their own devices at work

brokerages. Some executives are questioning whether Bring

easily revert to favorite communications apps instead of strict

Your Own Device (BYOD) practices — and the consumer apps

corporate protocols.

that frequently accompany them — are sufficiently airtightfrom a risk and compliance perspective. "Mobile security

Still, in a tight labor market, companies remained lenient about

is part and parcel of a company's overall security posture.

using personal phones. "During the Great Resignation, people

As security practitioners, we have noticed mobile devices

tended to leave or migrate to organizations that allowed

contributing to mission-critical operations," says Jude Fils-

them to do what they wanted with their devices," says Fils-Aimé, Managing Partner of Enterprise Security for Verizon

Aimé. After all, consumer apps were beneficial in corporate

Business Group.

environments in some ways — they raised the bar for user
experience and empowered employees to meet customer

Recently, the Securities and Exchange Commission (SEC) andneeds during a crisis period. "But within a highly regulated

the Commodity Futures Trading Commission (CFTC) once

industry like finance, consumer apps must be able to produce

again levied hefty fines on a group of financial institutions forcommunications that can be logged and retained to create

failing to keep proper records of business communications,records of interactions — and retried later, if they're needed,"ordering them to pay a combined $549 million . In an evenaccording to an August article from Insider Intelligence3. In

larger action last year, regulators fined several top-tier Wallrecent years, cases of financial crimes or scandals have been

Street brokerages and banks a collective $1.8 billion for

discovered because of digital messages preserved in chatviolations related to widespread use of consumer messagingrooms. It remains critical for business communications to beapps and poor business recordkeeping .

handled according to protocols.

A relatively lax attitude toward personal devices at work has
been a lingering side effect of the pandemic era. During theHow Threat Actors Can Leverage Personal
Phonesnational emergency, the abrupt shift to remote work required

There are multiple ways for threat actors to leverage asome enterprises to be unusually flexible about allowing

mobile device and jeopardize an individual or enterprise.

employees to use their own mobile phones for business as

They may be able to "jailbreak" a device by unlocking thethey quickly pivoted to working out of makeshift home offices.

operating system to bypass security features in order to1

2load applications. By loading malware on a device, they can

BYOD Became Routine — But Remains Risky

often enable location-based services or push notifications"Expediency made BYOB the flavor of the day. During COVID,

that provide opportunities to intercept communications.

when people suddenly moved to working from home, someCriminals can also hijack a device's connected network andrequirements were relaxed. In particular, many people started

cloud sessions. If an employee goes to a coffee shop andusing consumer messaging apps, bypassing their firm's

joins an unsecure hotspot, a threat actor could launch achosen message archive system," says Fils-Aimé.

man-in-the-middle attack to impersonate the user by stealing
their credentials and sending emails or messages to the

Even before the pandemic, a trend toward "theindividual's employer.

consumerization of IT" caused work and personal functions
to become increasingly intertwined on employees' computers

Increasingly, C-level executives are being targeted withand phones. As the line between business and personal isphishing, smishing and vishing attacks. For example, badincreasingly blurred, particularly for younger workers, BYOD

actors can deploy SMS phishing to hijack an executive'swas extremely popular with employees for the flexibility andpersonal phone number. "From there they are able to hijack

1

Insider Intelligence | eMarketer, "Regulatory crackdown on bankers’ use of WhatsApp and texts enters its second round with another $549 million in fines," August 11, 2023.

2Barrons, "Wall Street's Biggest Banks Fined $1.8 Billion Over Use of Banned Messaging Apps," September 28, 2022.

2

your credentials or lure you to a 'watering hole' website built

Risk and compliance officers are reconsidering the dangers

specifically around your business segment," says Fils-Aimé.

associated with employee-owned smartphones and other

They can combine personal data obtained from the dark web

connected devices. When personal phones are widely usedor past data breaches to manipulate not only the individual's

in a business setting and there are no controls over usage,

financial accounts, but their corporate accounts — including"It's impossible for IT departments to enforce governancesending messages to the financial institution that appear towith corporate and legal requirements," according to Insider

be from the executive, leading to the potential for corporate

Intelligence.

intellectual property to be exfiltrated. Corporate-liable devices
preempt many headaches, because they can be set up withThere are also legal risks. "Who is responsible for company

controls to allow only compliant communications apps anddata versus employee privacy? What if a breach or attack ismessage archiving.

spawned from a personal mobile device?" says Fils-Aimé.

"We've observed this evolve for our customers, where

As companies note the increase of malicious apps, phishing

shifting to corporate devices reduces the risk of enablingand other cybercrimes, some have shifted back to corporate-a richer set of communication options for employees. This

liable phones. "In the financial sector, corporate-liable phonesbridges the mobile modalities for text, voice, enterpriseare becoming more of the protocol," says Fils-Aimé. In thecollaboration and even consumer applications…." says Blane

past, all verticals—including financial—took a ham-handed,

Warrene, Vice President of Product Management at Smarsh,draconian approach," says Fils-Aimé. Employers were given

a provider of message archiving and compliance solutions

devices strictly for business use and were forbidden to checkfor financial services companies.4 "This model enables an

personal texts or their own financial accounts. Unlike with pastorganization to leverage efficiencies of automating devices

rounds of corporate-issued mobile phones, there are now

and services — while their employees can move fluidly from

more employee-friendly variations available.

office to home and beyond with the right tools to serve
customers."

A New Happy Medium – Corporate-owned,Personally-Enabled

Pendulum Swinging Toward Corporate-Liable
Devices

The latest trend is COPE: corporate-owned, personallyIn the wake of the regulatory actions, many financial

device, but it gives employees a choice of devices. Personal

institutions are reexamining their risks and liabilities arounduse is allowed, but it is 'sandboxed' in its own container," says

messaging and communications. Companies have becomeFils-Aimé.

enabled. With a COPE policy, "the company purchases theless confident in their defenses around mobile security. "After
Goldman, J.P. Morgan and others were levied fines, many firms"Both profiles [business and personal] are using the same

are slowly but surely realizing the lack of visibility they have on'bare metal' device, but it is bifurcated at a software layer

mobile security from a risk posture," says Fils-Aimé.

so you have access to both your corporate view and yourpersonal view. You can see both profiles seamlessly, without

At this point, the market appears to be beginning to favorhaving the chore of logging in and out," he says.

corporate-liable device programs versus BYOD. Risk officers
are reverting to the more conservative position that regulated

A COPE strategy ensures that enterprises can keep visibility

firms are safer when they deploy regulated mobile device

and control over the mobile devices for security purposes,solutions. When personal devices and messaging apps arewithout being intrusive about innocent employee actions suchwidely used in a corporate environment, enterprises lose theas checking their personal email account or logging in toability to control costs and ensure compliance.

their bank. "But, if we see that the user clicked on a malicious
link, we can prevent any exposure to malware before it is3

Insider Intelligence | eMarketer, "Regulatory crackdown on bankers’ use of WhatsApp and texts enters its second round with another $549 million in fines," August 11, 2023.

4

Blane Warrene, "Employee or Corporate Owned Devices: The Tough Choice for Organizations in Regulated Industries," July 19, 2023.

3

downloaded and pushed to the device. If someone clicks on

experiences for employees with Verizon solutions by reviewing

a known bad site, or there is a phishing campaign underway

these two documents:that is known, we will stop that connection before it can spawn
within the organization," says Fils-Aimé.
"Theoretically, if a firm issues a corporate liable phone, they•

Improve your strategy for archiving key communications•How Verizon Mobile for Microsoft Teams can help withcompliance call recording and archiving needs

can better control the apps that can be loaded on it. If a firm
permits a BYOD phone, the firm can segment off part of theOr contact your Verizon Client Partner.

phone for business, but they can't control the rest of thephone," he says. IT departments have greater controls andDISCLAIMER: Verizon continues to work on improving its

ability to ensure mobile security by managing access to thecapabilities and thought leadership in areas where we canapps that employees need, keeping apps updated to the latest

support our customers with challenges around mobile device

and most secure versions, and providing backup for devices insecurity. There is no silver bullet. In order to solve thesecase of loss or breakage.

challenges, enterprises should take a programmatic approach
involving collaboration with IT and security operations, finance,

Learn more about how your financial institution can enhance

legal and human resources.

mobile device security while providing flexible and positive

4Mobile Device Use: Regulations andAcronyms
COBO: Corporate-Owned, Business Only. The phone isselected and owned by the enterprise, and personal use
is not supported.
BYOD: Bring Your Own Device. The employee chooses
and owns the device, and the primary use of the device ispersonal.
COPE: Company-Owned, Personally-Enabled. A newer
trend in which the employer distributes company-owned
devices but employees are able to use them for personal
business within established parameters.
CYOD: Choose Your Own Device. Employers offer
employees a selection of company-owned mobile phones
to choose from.
1934 Securities Exchange Act: Proper recordkeeping ispart of this regulation governing financial institutions.
Rule 17a-4: The SEC updated this rule to include
recordkeeping requirements for electronic customer
records and communications.
Rule 18a-6: This SEC rule was also modernized to govern
recordkeeping for electronic records, which must be
properly stored and able to be promptly furnished whenrequested.
PCI-DSS: An information security standard for credit
card payments from the Payment Card Industry Security
Standards Council.

Who we are
We deliver the promise of the digital world by enhancing the ability ofhumans, businesses and society to do more new and do more good.
We transform how people, businesses and things connect with eachother through innovative communications and technology solutions.
Verizon Business - Transform Your Business