Bring-your-own-device (BYOD) Policy - An end-user's perspective - Page 1
Forum section: electronics / general

author: Halcyon
author_rank: Unknown
timestamp: July 21, 2023, 01:59:38 am
content: I'm in the process of re-writing some IT policies at work, including our BYOD policy. Rather than think with my "executives hat" on, I'd love to hear from end-users who might have a BYOD policy at their workplace.When it comes to IT security, there are always tradeoffs. For example, you could have the most locked down network and systems, but usability and the ability for people to do their jobs are hindered. Whilst BYOD does introduce some complexities, I believe my department should service the end-user as best as possible, while still maintaining a reasonable level of security. The easy option will be to blanket-ban BYOD altogether and put it in the "too hard" basket, but I don't operate like that. I know people will ultimately ignore such a policy and login to their email/Teams/Sharepoint/Whatever using their personal devices out of convenience (or necessity). I refuse to waste time writing policies that aren't going to be enforced, just to tick off some ISO certification or similar.I also don't believe in forcing MDM (Mobile Device Management) on personal devices. If I wouldn't do it myself, I'm not going to force it on others. I'm thinking of going down the path of allowing BYOD, provided they comply with certain criteria. For example: Mobile devices must be running a currently maintained version of Android or iOS and must not be devices manufactured by Huawei, ZTE, OnePlus, Oppo, Xiamoi, etc... This sort of policy should be relatively trivial to enforce through Microsoft 365, so if you try to sign-in using an unsupported operating system/browser, your access will be denied. At least this way, we can acceptsomerisk while not getting in the way of people being able to work.Which brings me to the point of this post. What BYOD policies do you guys have out there at your workplace? What works? What doesn't work? What would you do different?

author: twospoons
author_rank: Frequent Contributor
timestamp: July 21, 2023, 02:28:14 am
content: Where I am currently it seems to be company devices only. Personal mobiles cannot log into the company wifi. But given that we make payment terminals, we live or die on security - so the policy makes perfect sense. And frankly doesn't hinder me doing my job at all.

author: brucehoult
author_rank: Super Contributor
timestamp: July 21, 2023, 02:40:25 am
content: I would never accept employment anywhere that didn't allow BYOD and WFH -- certainly not until employers are willing to provide equipment comparable to to what I buy with my own money at home, not low spec shitboxes with cheap monitors (if anything, the provided monitors are usually worse than the CPUs: no, 2x full HD monitors are not a replacement for a 32+" 4K). And I'll never run Windows as the primary OS -- it can be sandboxed in VirtualBox for required corporate bollocks if necessary.It is unbelievable how employers will pony up well over US$100k a year salary, but not want to spend even $5k once every few years on the equipment to help you be productive.My recent employers included Samsung (who are about as big and stuffy as they come), and SiFive (a San Francisco startup) and they both had acceptable policies.Fundamentally, trust your employees and their professional judgement, or don't hire them.

author: Bud
author_rank: Super Contributor
timestamp: July 21, 2023, 04:11:07 am
content: If you wont use an MDM with enforced unified policy for BYOD you will have a Zoo on your network. I cant imagine how you will be maintaining a level of security, unless your audience is very small, 10 people or less.

author: Halcyon
author_rank: Unknown
timestamp: July 21, 2023, 06:13:27 am
content: Quote from: Bud on July 21, 2023, 04:11:07 amQuote from: twospoons on July 21, 2023, 02:28:14 amI guess I'll answer both of these as they kind of relate.I'm not going to be allowing any personal devices on the corporate network. WiFi is secured with certificate-based auth, so even with valid credentials, users can't connect their personal devices to our office networks.But with most things being cloud based (email, communications, file sharing etc...) all you need is an internet connection and valid credentials to access those services. This is the space where the BYOD policy would apply.

author: Kleinstein
author_rank: Super Contributor
timestamp: July 21, 2023, 06:35:42 am
content: For work on site (in the office main site) there is little need for privately owned IT.The other point is working in a home office or on the road / mobile. Here it can be very convenient not to have a 2nd computer or phone or printer around. It still very much depends on the work and security needs.Already for the home office the advanatges to have a sepration to reduce destractions (e.g. notifications on private email or messages).

author: Halcyon
author_rank: Unknown
timestamp: July 21, 2023, 07:26:38 am
content: I should probably mention, our staff do work 99% from home. They do get given corporate laptops, but of course, you can't please everyone when it comes to corporate technology.

author: 50ShadesOfDirt
author_rank: Regular Contributor
timestamp: July 21, 2023, 07:49:49 pm
content: You want locked-down networks, machines, and *data* ... reasons are too numerous to list, but it's the only way to protect the business.I'd do the military-base scheme of "leave your smartphones at the door, and pick them up on your way out for a break or the end of shift", for obvious security reasons.End-users want "something" to do some personal stuff on, so give it to them, all without allowing personal machines in the door. Use personal VM's, and don't allow the vm's to pollute your business environment or have data exchange. Set them up an AWS vm for windows, and possibly one for Android (whatever apps they feel they can't live without for 8 business hours), or combine them, to cover 99% of their needs.Hackers will always be a step ahead, and there's just no allowing BYOD to be your chink in the armor. Insider threats will always be a step ahead, so thwart that as well. Never be in the position of closing the barn doors *after* some threat or data loss.Hope this helps ...

author: Halcyon
author_rank: Unknown
timestamp: July 22, 2023, 02:44:53 am
content: Quote from: 50ShadesOfDirt on July 21, 2023, 07:49:49 pmYou're absolutely right. Data classification is very important as we handle everything from private commercial information to information classified Top Secret by the Australian Government. We have a group of people with the required national security clearances and of course that data is separated from everything else. Anything classified as Secret or above won't be accessible from home or on personal devices, period.

author: brucehoult
author_rank: Super Contributor
timestamp: July 22, 2023, 03:30:38 am
content: Quote from: Halcyon on July 22, 2023, 02:44:53 amAh. Not a normal business then.

author: AndyBeez
author_rank: Frequent Contributor
timestamp: July 23, 2023, 08:44:20 am
content: From a UK cyber security POV these useful guides are worth a five-ten minute read:https://www.ncsc.gov.uk/collection/device-security-guidancehttps://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/mobile-device-managementIf you are challenged on your policy, you can mention that you wrote for compliance with UK cyber security recommendations/best practice. I'm sure Oz has very similar.

author: Halcyon
author_rank: Unknown
timestamp: July 23, 2023, 08:46:13 am
content: Quote from: AndyBeez on July 23, 2023, 08:44:20 amThe UK ones are based on the Aussie Information Security Manual ;-) But yeah I'll have a looksie.

author: Kjelt
author_rank: Super Contributor
timestamp: July 23, 2023, 08:53:41 am
content: In our company we use an app to log your own device which is MAC address based then you get wifi access to the DMZ. So indeed only to check personal mail, whatsapp etc not for business.We get the option to order a company phone (Apple SE) which then is purely business and does get access over VPN to company mail and is allowed to be used personally. Laptops are a nono, only company laptops.

author: AndyBeez
author_rank: Frequent Contributor
timestamp: July 23, 2023, 09:48:15 am
content: Quote from: Halcyon on July 23, 2023, 08:46:13 amSo glad to see HMG saving UK tax payer's money [by spending yours]. Possibly some useful case studies there. I do not know the size and scope of your organization, but would it be good policy to appoint a permanent cyber security specialist with responsibility for cyber governance? That would be a permanent position created in the company, however it is justifiable as data integrity and cyber security are equally important to a business as are human resources, supply side management, market intelligence and ensuring senior executives fly a minimum of business-plus.From a finance perspective BYOD was the best thing to happen to IT budgets. From the IT systems perspective, a total frickin disaster. It was bad enough when the USB memory stick was invented, but then came along smart phones with HD cameras and now, no zone is secure. Spies once needed a tiny Minox camera that fitted into their undies, now they just drop a flip phone in a pocket and walk past the disinterested illegal migrant on the security desk. On an MDM note, do not forget to include the contractors/tradies and cleaners in thelock your darn cell phone in the locker providedpolicy. BAE Systems:https://www.baesystems.com/en-uk/what-we-do/cyber-security---intelligenceQuote from: Kjelt on July 23, 2023, 08:53:41 amApple has similar under theirUser Enrolmentproduct.https://support.apple.com/en-gb/guide/deployment/dep23db2037d/1/web/1.0#dep6c59a3144MDM payloads for Apple User Enrolment:https://support.apple.com/en-gb/guide/deployment/dep6ae3f1d5a/web

author: PA0PBZ
author_rank: Super Contributor
timestamp: July 23, 2023, 10:59:10 am
content: Our policy:- Corporate devices will have MDM.- BYOD that need to go on to corporate network (why?) or use corporate email need MDM installed.- Private devices can use the guest network for internet access that is separate from the corporate network, no corporate email or other services allowed.The guest network has a different outside IP address which is not in the allow list for the corporate services.Without MDM it will be hard to enforce any rules about OS versions and such on BYOD.

author: paulca
author_rank: Super Contributor
timestamp: July 23, 2023, 11:06:17 am
content: The tier 1 investment and retail banks have BYOD policies. In fact, for the first year of lock down I was using my personal PC for work alone.The reason this works is simple. Security is so high internally that even a "on site workstation" is not trusted and none of the users/employees are trusted either. "Least trust" principle across the board. Also, processes are incredibly intensive and self controlling. One principle is "no single point of trust" or "no single authorisation". All processes beyond sending an email (and if that goes external there is process) has to have more than one person authorise it and they can't be in the same team.So the step from that to having people use there own devices is not that great.On the other end of the spectrum, there are secure rooms which have specialist PCs and networking where people may be required to work if they do want access to live "secrets". You're device isn't allowed in that room and it's locked while you are there etc. etc.

author: nctnico
author_rank: Super Contributor
timestamp: July 23, 2023, 11:59:14 am
content: Quote from: Halcyon on July 21, 2023, 01:59:38 amMaybe you should turn the question around: why would it be acceptable for people to use their personal gear for work? How about providing people with a company owned & managed device (but not a slow & crappy one)? That also gives uniformity across devices.If people insist on using their own device then you can enforce things like the devices needing to be up-to-date and ban certain brands.

author: Halcyon
author_rank: Unknown
timestamp: July 25, 2023, 12:02:49 am
content: Quote from: nctnico on July 23, 2023, 11:59:14 amYou raise a good question and one I have asked myself too. I'd love to just go out and buy 50 brand new laptops that are all spec'd up, but I simply don't have the budget at the moment to replace everything (then there are people's desktop workstations to consider, I'd be looking at a $150-200k project). As it is, I'm probably going to have to consider 2 different models of laptop depending on the team/individual requirements. A "one size fits all" approach wouldn't work.Choosing a platform is going to be hard enough. There are those that prefer to use Mac over Windows (and as I start using Mac more and more, I can certainly see why), then there are others who would never touch a Mac.At the end of the day, people are people and they will take the path of least resistance when it comes to doing work. If that means they can quickly check emails or Teams/Slack messages on the device of their choosing, they'll do that. The tighter we screw things down, the more cumbersome it becomes from both a user and administrative perspective. We just need to find that happy balance. People will naturally find a way around obstacles.I've worked in organisations where end-users are told "no" all the time. I'm the opposite, my default position is "yes" unless there is a compelling reason otherwise.To simply say "because security" is a bit of a cop out excuse to me (although applicable in some circumstances). When I hear that, it's basically the IT department saying "We don't want to do the extra work to make it happen, so deal with it".I see a proper BYOD solution as the way business operates today. It's a bit like working from home; most organisations would have laughed at the idea 10 years ago, yet today its prevalent and has been shown to work well in many sectors. I don't believe we should always stick to "the way we've always done it" and I think challenging my team to come up with a workable solution, even if it means more work for the IT department, is the better way to go.

author: paulca
author_rank: Super Contributor
timestamp: July 25, 2023, 12:07:23 pm
content: I think BYOD is far too broad a topic without discussing the business itself.As I mentioned, in the high ends of the industry, it's obviously not about cost. Those 1 litre desktop PCs, 24" monitors and 15" laptops are available on the second hand market in their 10s of thousands for a reason.In these places the "end device" is never trusted anyway. If I walk into the office and sit down at a desk, it isn't "my desk" and it isn't "my PC", it's just whatever desk and PC was free. That PC has almost nothing on it. No office, no email, nothing. No DNS let alone internet access. It won't accept USB devices either. It has IE installed and you can use that to authenticate to some periphery systems, but the main access is gained by authenticating to the VMWare edge proxy, requiring username, RSA token, pin code, host allocation number and the actual token. That gets you in the outer ring from where you can launch a session on a Windows Server for IT support or you can log into your Windows VM (VDI), usually in the cloud somewhere, though you can't tell. Usually in a location close by, but it could be on the other side of the world and it moves daily. The security once on that VDI does not stop. Every single services you touch requires authentication. You have no admin and your only networking is via a webproxy. Every web UI and ever application will time out it's authentication tokens anywhere from 1 minute to, thankfully on many dev systems 24 hours. You honestly spend about 5% of your day logging in to things.When we started working from home the only thing that changed was the RSA token generators had to be requested differently and exported as "remote access tokens".As to BYOD, they don't actually care, you still have to authenticate to that edge node with all the right credentials, the connection to the VDI is secure assuming they trust the VMWare infra they maintain.The remote access token generator can be used in "App form", on your own devices, however the list of devices supported is incredibly short. This is because the various info-sec teams have limited resources to test and confirm security compliance across all devices. Additionally many devices, OS's and versions of OS's are blocked due to the company not liking the security or privacy of that OS.The company "App" will sometimes then provide additional functionality, like forwarding your call into the company Zoom or conferencing system, access email, accessing IM chats etc. Not always, it differs. Typically those with a bespoke application will allow access through that. Others will provide you Office365 mobile access with the increased MFA security as a "pre-gate" to the SSO login.On the other end of the spectrum a very common entity these days is the business with absolutely zero onsite infra and even close to zero private cloud infra either. They base 99.9% of their business in online 3rd party cloud services like Office365, Google Business, etc. etc. etc. HR applications are also exported to public cloud services. So in these places there is no on-site infra to authenticate to and all authentication is handled by the "Office365" SSO stuff... or is entirely independent. There is very little preventing access to these systems from any random location and the "company" might not even be aware.I was using my personal PC for work for over a year when the company got bought and the new owners gave us all new laptops and told us we must use company hardware and networks to access any customer system, regardless of what the customer say. That ended that. So now my connection has to go out to my company infra in the cloud, "de-VPN" itself and head straight back out on the internet to a different country to the customers public IP.A caution for people, as employees, who wish to take their company up on their BYOD policies... Read the small print. In many cases the software you use will have open and clear spying clauses, monitoring clauses which may, or may not extend to your phone use while the application is closed. they will claim this is to protect their security and is legitimate use.The laws internationally are presently far, far, far behind the present technical situation regards to data, it's distribution and usage. Laws around "corporate privacy overreach" are still unestablished on the topics of monitoring people in their own homes and on their own devices.Personally I refuse as much as I can now. I insist on keeping my personal security scope isolated from my work security scope. This is becoming increasingly difficult and the consequences for having miss-aligned views to the company (DEI Department especially) are growing rapidly.If your company can move it's "Office workload" into Office365 you can save a lot on devices and allow BYOD access to that services and let Microsoft manage the security.If you want personal PCs/laptops to access "onsite" infra (including private cloud infra), then provide access only to a DMZ "terminal server" or edge node. From there you control access on an individual basis.If you move your infra to AWS, you had better understand the security, roles, permissioning complex nightmare that can be.So, bottom line. Move on site infra to the cloud. Let the cloud handle the security. For everything you can't use multi-staging security regions and several MFA stages. A VPN with anti-bridging and end-point protection software might be worth enforcing while connected to said VPN. On the internal side, these are considered "UNTRUSTED" and their operations strickly controlled.Note, external authentication providers can span many services with single set of creds. An example might be "Okta". These present interesting control and ownership models based around need to know and privacy. Typically the end user creates the account and owns the account with Okta. They then follow an invite like to bind that Okta account to the companies authorisation. This mean the end user has control of the data in the account and can reject or close associations with entities.

author: nctnico
author_rank: Super Contributor
timestamp: August 01, 2023, 08:43:48 pm
content: Quote from: paulca on July 25, 2023, 12:07:23 pmThat is a good point I like to emphasize. I have a few customers for which I have a Google account but I only use it through a web-browser. I don't link my own phone or computer to the cloud service at all.

author: aeberbach
author_rank: Regular Contributor
timestamp: August 01, 2023, 09:59:04 pm
content: Have you looked into Kolide + ZScaler? I am just a user rather than an admin but it isn't bothering me as a user. I could complain that it sometimes takes 3 seconds + a browser interaction to open 1Password but there are far worse experiences to be had. On the admin side it seems to offer a lot of flexibility, it will do things like find a 1Password recovery document (the one containing passwords and QR) and make you take it offline, it will check for Chrome and OS being latest version or patched appropriately, many other things. If there is a breach of policy it doesn't break anything but it does stop you being trusted and logging in until fixed, optionally with a grace period like "You will be unable to sign in in 6 days".The very worst "security" experience I ever had was with a thing called Carbon Black that did a round trip with every previously unseen binary to some remote server. When your job is to create binaries that's a problem, it took project compile time from around 15 minutes to around an hour. Of course all the developers learned that if you copy the repo to another machine at home and work on that it was much better. So much for "security".

author: Halcyon
author_rank: Unknown
timestamp: August 01, 2023, 10:42:12 pm
content: Quote from: nctnico on August 01, 2023, 08:43:48 pmI've seen this in large organisations and largely it's true. Even to the point where IT can capture screen shots of your entire display for later analysis/management action.I'm not about to do that. Firstly, there won't be "small print" in any of our IT policies. It'll be straight to the point and written in clear language. There is no point in devising a policy that is long-winded, that no one will read, or comply with. If we do eventually go down the MDM route, we'll explain exactly what is being captured, how long it's kept for and who can view it and when.Ultimately BYOD is a choice for the employee should they wish to take it up. All we can do as the employer is give them all the facts and let the individual decide if it's a good fit for them.Quote from: aeberbach on August 01, 2023, 09:59:04 pmThanks for your perspective. This is exactly what I'm after. I want to hear from those who actually use this stuff. Good leadership is more about listening and less about dictating (if only more managers did this).As for Carbon Black, yep, I know all about its issues. We were using VMware CBC before I started and I'm currently phasing it out on our endpoints in favour of a different solution, one that doesn't constantly phone home would be ideal (which is necessary for our protected networks which are not connected to the internet). The team and I are currently evaluating CrowdStrike and SentinelOne products.

author: paulca
author_rank: Super Contributor
timestamp: August 02, 2023, 03:35:32 pm
content: LastPass (premium/corporate)OktaZScalerAlways on VPN with selective routing (so you don't take the liability or privacy issues with routing user 'random' traffic across your networks).AWS STS SSO login.Office 365.There are a range of "Endpoint management" systems, even from Microsoft such that you can set policies while your VPN is in use. They are designed for the hybrid model.For any actual "infrastructure" needed in terms of physical or virtual machines, you put into AWS and use Okta+STS auth. EC2 whatever.It creates a kind of dual state on the users machine. All access to the company is authenticated by third parties (with your interests), but you protect your self from bridging, user traffic and most if not all of the malware on the users home network.When it comes to MDM and those aspects, I'm way behind the times.From the user point of view as employee, I didn't feel that worried about using my personal PC to access work related stuff and work full time there. The reason is that in very large enterprise the boundaries are extremely clear. You know where you are. The software in use is trusted industry wide from both sides. The connections made are openly displayed. So you are aware. For example, the VMWare Horizons client shows that my 'customer' was connecting to my keyboard, mouse, webcam and microphone. When I queried the later they explained it is because... the want to specify the classes of device that CAN connect, but in doing so it also automatically aquires access to that set of peripherals. So becuase they want you to be able to use your local webcam/camera and mic, they list those as "standard channels" and it auto connects. I disagreed with this explanation because you were also unable to disable or disconnect said devices. When I asked on the VMWare Horizons reddit the most authorative answer was, "If you do not want your third party to access those devices, either disconnect them, or disable them in Device manager, otherwise they do have access."In smaller organisations I would not feel as safe. I would not accept "End point protection" software in order to connect to a company VPN. The reason is that software will scan my home system and network for what my company considers "Threats", which might include a lot of legitimate personal interests or even family interests. The boundaries are much less clear, security on both sides is lower than optimal. It's better to be in a digital relationship with an organisation that already sets clear boundaries and protects themselves from you and also you from them.

author: Ranayna
author_rank: Super Contributor
timestamp: August 04, 2023, 08:51:30 am
content: What we allow by now is using the VMWare Horizon Client on a private device.The Horizon Client connects to a virtual Windows Desktop that is hosted in our datacenter. Besides Mouse, Keyboard, Monitors and USB Headsets, it allows no cross connection with the host it is running on. The neat thing: The Horizon Client is available for virtually all Endpoints: Windows, Linux, MacOS, even iPadOS.All data stays in our datacenter.

author: fluxcapacity
author_rank: Newbie
timestamp: September 15, 2023, 07:19:51 pm
content: MDM can be good depending how strict it is. It helps insofar as, if an employee downloads weird programs, they can, but, it'll be in a different sandbox than apps that can access company google accounts and services. So overall it lets you allow personal devices to use those logins with a reduced risk that malware will get access to corporate data.The alternative is providing everyone with all the devices they might need to use which is easier said than done.

author: bingo600
author_rank: Super Contributor
timestamp: September 16, 2023, 06:36:05 am
content: We don't allow BYOD on the CORP network, also goes for VPN connections..We have a "Guest" network for BYOD ... (WiFi internet connection)Employees gets a CORP Laptop.And a Mobile Phone (if needed), rest of us uses Teams as CORP Phone.The mobile phone is being "Tax'ed ..But private use is then allowed", so ie. i don't want one, as i already have a private phone.Could just be my opinion but:I would never enroll my private device in ANY CORP MDM or Zscaler or .....

author: Karel
author_rank: Super Contributor
timestamp: September 16, 2023, 09:28:29 am
content: Quote from: bingo600 on September 16, 2023, 06:36:05 amI completely agree.If it's my device, I decide the OS, and software installed and nobody else. If that's a problem for the company,then they can provide a corporate device.

author: Karel
author_rank: Super Contributor
timestamp: September 16, 2023, 09:31:05 am
content: Quote from: Halcyon on July 25, 2023, 12:02:49 amIn that case security will be a compromise.Good security comes at a price.

author: paulca
author_rank: Super Contributor
timestamp: September 16, 2023, 12:42:34 pm
content: Private cloud.Don't send the devices to the people, bring the people to the device.Let your staff use the rubbish they have, but only to access your managed infra in a private enterprise cloud on AWS/Azure or other "network in a box" style sites.Then keeping the hardware and OS's up to date becomes a web based management activity. YOU can choose to reboot a staff member's virtual machine to install updates. You also get to put "Light switches" on the VMs so that they get suspended and parked overnight to bring costs down.In my cases you can buy you time on a daily basis from "idle" unused hosts. When someone discards an EC2 for example, instead of unprovisioning it, AWS will reset it's cloud config and make it available as a cheap EC2 instance. So logging in there and picking a few cheap EC2s for your staff that day could save even more costs.A cloud instance of a desktop Windows with 8Gb or RAM and 8 cores is going to cost you about $30 a month. However that includes the electricity and network bandwidth. If you self host a similar machine it will cost you at least that in running costs anyway and you have to keep the hardware up to date at your own costs. In AWS increasing the amount of RAM, cores or disk space on a VM, or upgrading it entirely is a click, next, next, ok!I would avoid layer 2 clouds. Stick to the layer 1 providers. The providers who provide you with low level infra and not "pre-canned, managed solutions". The later will not give you privacy, security and are highly likely to lock you into subscription models which later tighten up or increase in price, leaving you stuffed. Go for private, AWS, Azure infra such as VMs, a VPC or two.For access your staff can use VMWare Horizons which I believe you can configure on AWS though I haven't tried. VMWare Horizons supports multi-layer MFA auth. You can put an RSA style token on the outer layer and rely on the Windows SSO (or AWS SSO) on the hosts them selves. Usually the outer layer only provides access to raise a support ticket to fix login or VM issues.EDIT: For balance. The downside with Azure and AWS is "internalisation". All AWS and Azure services are about bringing your infra in to their cloud. Once it's in their cloud getting it to integrate with your infra outside of their cloud is something they do not make easy or cheap. Consider S3 for backups. It costs pennies to upload and store dozens of gigabytes of data there. However. If you check the download costs they are orders of magnitude higher. So while it might cost you $20 a month to sync 2Tb of backups to an S3 bucket. It will cost you more like $100 to download those 2Tb when you need to restore a backup.

author: Fflint
author_rank: Frequent Contributor
timestamp: October 07, 2023, 11:32:36 am
content: Having been WFH for over half a decade for a number of Fortune 300 companies (currently working regularly for two clients, a big multinational telco, and a big software company) I have some opinions on BYOD policies from the user point of view :-)First,do not require bloody 8 digit or an alphanumeric pin on Android devicesan aggressive lockout policy with a time delay between tries is more than enough. Alternatively (I'm not sure if this is doable with the current software) require a long pin only when the work profile is active, when it's off revert to whatever settings the user had, requiring authentication on enable of the profile.This "long pin required" is my only pet peeve on mobile devices. I'd never allow an employer or a client manage my personal device in its entirety, as long as I can "switch off the work profile" after hours and on the weekends so I don't get any notification etc and the employer can't remotely wipe my device by mistake I'm fine with BYOD.With regards to laptops I always had clients send me their devices for use. Windows laptops all used bit locker, Linux laptops use some tool called "Dell security" and use full disk encryption too. On both systems there is always a VPN client, but details differ. One company for example locks down all local network traffic except their vpn until the vpn is connected, then after passing certain checks local network access is enabled again(so local printers can be used for example). Another company uses a windows vpn client that connects to the corporate DMZ before windows login (with 2fa), then it connects to a different network once you're logged in (allowing you to login a user for a very first time).In all these companies local admin on these devices is given on as-needed basis following a long and tedious procedure of "proving why you need it" so I got quite adept at working without it (using WSL2 on Windows, installing everything I need in the home folder on Linux, etc).

author: Halcyon
author_rank: Unknown
timestamp: October 08, 2023, 01:32:07 am
content: Quote from: Fflint on October 07, 2023, 11:32:36 amThe problem with short PINs on both (some) Android and iOS devices is they can be easily brute forced or bypassed if the phone is lost. I've mentioned this in other threads but there are tools out there which will allow you to brute force a 4-digit iPhone PIN in hours (seconds if the phone is left on and not rebooted after first unlock). Some Android phones are similar (or PINs can be bypassed entirely).How likely this is to occur I suppose depends on your industry and who you are.

author: Kjelt
author_rank: Super Contributor
timestamp: October 09, 2023, 04:38:33 pm
content: Quote from: Halcyon on October 08, 2023, 01:32:07 amReport it to Apple and get a huge hack bounty. If the FBI could not get into a terrorist iPhone in months and requested help from Apple makes me think their security is pretty good and after three mistries the phone is locked.

author: Halcyon
author_rank: Unknown
timestamp: October 09, 2023, 11:52:42 pm
content: Quote from: Kjelt on October 09, 2023, 04:38:33 pmApple have known about it for many, many years and for whatever reason have decided not to fix it or simply can't fix it.Security is always a balance which also impacts user experience. As I always say, you can have the most secure product in the world, but all bets are off once someone else gets a physical hold of it.In relation to the "San Bernardino" iPhone case, the technology didn't exist at the time for this specific use-case. It's not uncommon for the first point of contact to be directly with the manufacturer, I've done it myself. After that option was exhausted, a company with some very clever people came up with a solution and made a crap load of money, which is still used today all the way up to the current iPhone and iOS versions. This solution also allows the PIN retry lockout (and some other security features which I'm not allowed to discuss under NDA) to be bypassed.

author: Fflint
author_rank: Frequent Contributor
timestamp: October 12, 2023, 03:23:21 pm
content: >This solution also allows the PIN retry lockout (and some other security features which I'm not allowed to discuss under NDA) to be bypassed.I wonder how long it takes them to do one attempt. However, there is a solution for that I'd love to see implemented. A short pin (let's say 4 digits) when you have your "work profile" off (which is most of the time I use my mobile) and enforcement of a long pin when it is active.Or, having an extra password /pin to open the work profile. This assumes data is stored in an encrypted form(myknox on Samsung phones etc).

author: Halcyon
author_rank: Unknown
timestamp: October 13, 2023, 12:00:31 am
content: Quote from: Fflint on October 12, 2023, 03:23:21 pmIt depends on the model of phone and iOS version. But brute forcing 4-digit PINs usually takes hours to days. 6-digit PINs can take weeks to months. There are a few strategies that can be employed to help bring that time down.If the phone is kept on after it's first unlocked, the PIN/password discovery is usually minutes.If it's an alpha-numeric password, that increases brute force time exponentially, but again, people are lazy so they usually stick to short PINs/passwords, re-use passwords across accounts/devices, or use weak/compromised passwords.

author: Fflint
author_rank: Frequent Contributor
timestamp: October 14, 2023, 09:33:03 am
content: Quote from: Halcyon on October 13, 2023, 12:00:31 amPhone manufacturers could've resolved it a long time ago with a longer delay between checks. I'm assuming these methods work by eitherA: emulating a usb connected input device, in which case a simple user defined delay of 30s on the "enter pin" screen and lock after 10 unsuccessful tries wouod solve it.B: They actually exploit some usb handling vulnerability in the phone and they call an internal api trying to unlock it - that api could have the same delays/lockout built in.Also, many times these numbers are quoted in context of BYOD devices, I think most people are perfectly fine with the level of protection a 4 digit pin gives them if the device could be reliably locked after a number of tries (automated or not).Company data is another matter, but that too could be made secure by requiring a password on unlocking the work profile itself (on encrypted storage). So cracking into a phone with a work profile disabled would be but a first simple step in getting to that sweet sweet company data...There is also always an option of not using a BYOD device, but having a dedicated one... I think its good if this is a users choice which one to use.

author: paulca
author_rank: Super Contributor
timestamp: October 20, 2023, 09:55:05 am
content: Quote from: Halcyon on October 08, 2023, 01:32:07 amI know if I had a work phone and I lost it ... and I didn't report it within hours I would be in some serious shit, possible civil litigation and even potential criminal implications for failure to report it.I have always had a strict work or personal policy. I did break it at the start of COVID, but out of choice. The client I was connecting to used VMWare horizons and couldn't care where you connected from, everyone was a hacker until proven otherwise by 2 layers of MFA. You knew where you stood with that.However I did allow my Windows PC to join the company O365. Which was still permitted back then. This was just to gain access to "Teams chat" and email.The company got bought, that policy revoked, VPN only for O365 connection. Work laptop was mandatory. I removed it from the PC and other than being a bit confused when I wanted to log into microsoft as myself I never seen any bother.Really big customers, their security is so tight you, yourself feel safe. They are under so much regulatory scrutiny and are so massive if they make any mistake with YOUR data you can sue them for tens of thousands and they know this. So they are usually pretty clean and when they are going to eves drop on you, they tell you up front when.It's the middle ground, the startups and the exclusively USA based companies that are the real threats to home network security. They still have the YOLO, your data is now mine approach. They don't have clear privacy boundaries and if a single devops or IT guy wants to record your microphone or turn your webcam on, who's to know right?So, when I got a few of these customers laptops in and onto the home Wifi I got hacked by them. Mostly the MacBookPro auto discovery services, but it was getting awfully close to the loosely authenticated HDDs where I keep my Pron! A customers laptop!This is when I learnt how to VLAN and segment my network.Only this morning I had to fix one of the two work laptops. One of them has a fixed endpoint address for it's VPN and tunnels everything including DNS over it, the other uses local DNS and only puts O365 and other traffic over the VPN... it's DNS was broken. I was redirecting their DNS traffic to PiHole to kill ads. Turns out my PiHole just isn't interested in helping the guest network this morning, most likely because I redid the entire lab/office layer 1 last night, taking out every cable, moving the switches and routers and replacing the cables again. I expect a guest VLAN tag is set wrong on the DNS server.... although they did get DHCP. Odd. But I removed the redirect and it's happy with 8.8.8.8