Source: https://wiki.unallocatedspace.org/wiki/index.php?title=BYOD
Timestamp: 2018-12-11 20:59:52
Document Index: 643936522

Matched Legal Cases: ['ART 1', 'ART 2', 'ART 3', 'ART 4', 'ART 5', 'ART 1', 'ART 2', 'ART 3', 'ART 4', 'ART 5']

BYOD - Unallocated Space
1 BYOD PROJECT
2 PART 1 - DESCRIPTION, DEFINITIONS, AND SCOPE
2.1 BYOD = Bring Your Own Devices
2.2 BYOD Criteria
2.2.1 Typical BYOD Devices
2.3 BYOD Status in the Production Network
2.3.1 UNAUTHORIZED
2.3.1.1 DEFAULT
2.3.1.2 INTRUDER
2.3.2 AUTHORIZED
2.3.2.1 GUEST
2.3.2.2 AUTHENTICATED
3 PART 2 - BYOD POLICY – APPLIES TO EVERYONE AT THE COMPANY
3.1 BYOD Device Authorization
3.2 Unauthorized BYOD Devices are Prohibited
3.2.1 Examples of Prohibited Unauthorized Devices
3.3 BYOD Detection and Enforcement
3.4 Penalties for Unauthorized Use and BYOD Intrusion
3.5 Making BYOD Devices Safe Near the Production Network
4 PART 3 - IMPLEMENTING BYOD INTRUSION DETECTION
4.1 Detection Requirements
4.2 Action Requirements
4.3 2.C. Detection Software Candidates Required Features / Product Matrix (To Do)
5 PART 4 - SECURITY IMPLEMENTATION - PRODUCTION NETWORK
6 PART 5 - SECURITY IMPLEMENATION - GUEST NETWORK
6.1 Physical Separation of Guest and Production Network Zones
6.2 Guest >< Production Zone Routing Policies Similar to Internet Firewall
Revised Jan 8, 2014
IMPORTANT NOTE: This is a Project, IT IS NOT UAS POLICY
This is an Open Project that anyone may contribute to.
Build a model for implementing BYOD (Bring Your Own Devices) Policies and Procedures in a Production Workplace Environment. In this case, it will be a hybrid BYOD environment where the following apply:
BYOD usage is permitted - e.g. A visitor or employee acceptably uses with their own cell phone and their own 3G service, not connected to the Company's Intranet.
Authorized BYOD is permitted - e.g. The President wants to access Company resources with her laptop when in the office or on the road.
Unauthorized BYOD is prohibited - e.g. An employee brings their own wireless router in and connects it to the Company Intranet so he can have a wireless access point to surf the Internet.
PART 1 - DESCRIPTION, DEFINITIONS, AND SCOPE
Employee owned network devices are becoming more prevalent in the workplace. This document defines what BYOD devices are and what Policy is regarding their use.
Recently, many employees are now the proud owners of BYOD devices – and some people may not even realize it! Every “Smart Phone” capable of transmitting and receiving data (text, photos, music, videos, etc.) is a BYOD capable of connecting to the Production Network and potentially affecting its performance, reliability, privacy, and security. The Policy and Procedures described in this document are intended to be implemented to protect the Production Network from Unauthorized or Intruding devices.
The activities not applicable to this document are the acceptable uses of BYOD devices not connected to the Production Network by employees in the shop. For example: Cell Phone voice calls and employees using their own personal 3G/4G Internet services on their devices.
The Production Network in this document is the Company's Internal (LAN Intranet) Network accessed from within the facility itself or from the Internet using Remote Control software or VPN. A BYOD is a device with any of the following criteria:
A device that attempts to connect to the Production Network and the device is not owned or maintained by the Company.
The device’s significance, usage, or functions are not related to Company Production.
The device is attached to another network outside of the Production Network for significant periods of time.
Typical BYOD Devices
Typical BYOD Devices are Hardware Devices that include, but are not limited to the following:
Personal Computers, Laptops, Tablets, and Hand Held PC network devices.
Cellphones with WiFi capabilities
Personal WiFi Access Points and Routers
Network Games and Media Players
BYOD Status in the Production Network
New unidentified Devices that is trying to connect to the Production Network
Example: Employee’s cell phone with WiFi capability turned on while working in the shop.
Unauthorized Device that successfully connected to the Production Network.
Example: Unknown cell phone connecting to the Production Network without Admin Authorization.
Authorized Device that connected to the Production Network
Example: Consultant brings in a laptop and wants to access the Internet.
Authorized Device that is connected to the Production Network and the user has authenticated a login to one or more Production Network Resources.
Example: Consultant brings in a laptop and wants to access the printers or ERP system.
PART 2 - BYOD POLICY – APPLIES TO EVERYONE AT THE COMPANY
BYOD Device Authorization
Each BYOD device must be uniquely identifiable when connected to the network
Each BYOD device must be reviewed by the System Administrator
Each BYOD device will be reviewed for compatibility and security to determine its eligibility for Authorization.
Authorized device and owner information will be cataloged in the ISOE database.
The usage of BYOD devices may be recorded, logged, or monitored in real time by the System Administrator or delegate.
Unauthorized BYOD Devices are Prohibited
Any Unauthorized BYOD device whose capabilities may impact the performance or reliability of the Production Network are prohibited.
Examples of Prohibited Unauthorized Devices
Routers, VLAN Switches, any devices capable of running network routing and discovery protocols
Cell Phones with Access Point Feature Enabled
ANY device potentially acting as a DHCP or BOOTP Server!
Routers, Network Game Servers
Laptop with ICS [internet connection sharing] enabled
NAT enabled devices with more than 1 network port.
Network Recording Devices (personal web cams, network radios, network audio, keyboard loggers)
Laptops, PCs, Tablets, Severs, Embedded Servers, and Virtual Machines on those.
BYOD Detection and Enforcement
The Systems Administrator may use any means of detection to determine the presence of BYOD devices on the Production Network.
Definition: An Unauthorized BYOD Device that succeeds in connecting to the Production Network is considered an INTRUDER and considered a high risk security threat.
The Systems Administrator may use any means of penetration testing to determine the identity and functional features of any INTRUDER (Unauthorized and Connected).
The Systems Administrator may aggressively use any security measures or tools to protect the Production Network from Unauthorized Devices attempting to connect or INTRUDERS.
The Systems Administrator is not responsible for problems that an Unauthorized BYOD device may experience as the result of penetration testing or security measures.
Penalties for Unauthorized Use and BYOD Intrusion
The Systems Administrator may revoke or refuse authorization and force disconnection or change of status to INTRUDER for BYOD devices without providing a reason to the device owner or user. Reasons for such action are often technical in nature and beyond the immediate scope of the offense (i.e. post mortem forensics may be required).
INTRUDER BYOD devices may be immediately confiscated by the Systems Administrator. Return of a confiscated BYOD device will be done after mediation between the INTRUDER BYOD Device Owner, Company Management, and the Human Resources Management.
Making BYOD Devices Safe Near the Production Network
Employees should configure their Unauthorized BOYD devices to not connect to the Production Network and to not disable shared Wireless Access Point mode. Using the following device configurations will prevent the BYOD from being tagged as an INTRUDER.
> Turn Off WiFi Autoconnect feature in all Unauthorized BYOD devices
> Turn Off Access Point (shared wireless router) feature in all Unauthorized BYOD
> Do not attempt to physically connect any Unauthorized BYOD device to the network.
PART 3 - IMPLEMENTING BYOD INTRUSION DETECTION
Detect and Uniquely Identify BYODs attempting to connect to the LAN
Log BYOD connection attempts and successes
Determine if a BYOD connection is Authorized or Unauthorized
Transmit an email/text notification to the Sys Admin alerting to unauthorized connections
2.C. Detection Software Candidates Required Features / Product Matrix (To Do)
...(To Do)
PART 4 - SECURITY IMPLEMENTATION - PRODUCTION NETWORK
PART 5 - SECURITY IMPLEMENATION - GUEST NETWORK
Physical Separation of Guest and Production Network Zones
Guest >< Production Zone Routing Policies Similar to Internet Firewall
Retrieved from "https://www.wiki.unallocatedspace.org/wiki/index.php?title=BYOD&oldid=527"
This page was last edited on 8 January 2014, at 21:03.