Because of network slowdowns, access restrictions or to circumvent security, tech-savvy, digitally native employees are spinning up their own network using a mobile hotspot or personal MiFi router. Consultants and contractors who don’t want to wait for IT to set up access to the corporate network may turn their phones into a wireless hub in order to be productive. End users may innocuously circumvent the corporate wireless network if it’s slow due to congestion, but at other times, to circumvent corporate access controls or security policies, causing a much larger problem.
The trend is most apparent in organizations that haven’t handled BYOD properly. Enterprises that don’t embrace BYOD and actively work with employees to build effective policies for personal device access soon find that employees have no qualms about circumventing IT. BYON is considered an even larger risk than BYOD. With BYOD, employees need access to the corporate WiFi, meaning IT can at least have some visibility into what devices are connecting. As more BYON personal networks crop up and fly under the IT’s radar, it literally creates a black hole when it comes to monitoring and controlling usage – throwing security protocols out the window.
To manage BYON, it needs to be brought under the BYOD fold of enterprise network security. IT will need to find ways to understand what is causing employees to turn to BYON, the risks of BYON and how address these concerns. If the IT department attempts to prevent and reject BYON, the problem will not go away, and the risks will only increase.
The following are ways to help start the process to address BYON at your organization:
- Create effective BYOD policies: BYOD and BYON need to be addressed under the same umbrella. Some organizations may decide to prohibit BYON completely and treat personal networks like any other breach of policy, but it’s far better to engage employees and build policies aimed at providing the resources needed in a controlled, secure manner. This could mean implementing a separate wireless network solely for BYOD use, or stipulating that BYOD users must use the corporate guest network.
- Educate employees: When employees understand why certain policies have been implemented, they are more likely to follow protocol. Policies implemented must mutually meet with employee and IT needs, addressing speed of access balanced with security protocols. Once employees have been educated on BYOD/BYON policies, have them sign off that they understand the risks and the repercussions of violating policy.
- Control access: IT should also implement access control on such networks, so that even if employees or consultants are using BYON to streamline work processes, IT still knows exactly who is on the network and why. One solution is to ban employees from outside access, but short of a complete ban, it might be best to set up a series of access points that addresses who and what can access each:
- A primary network that allows access to in-house systems and authorized mobile devices
- A secondary network to provide employees or contractors access through a VPN
- A third wireless network for guests
- Monitor usage: If a BYON network is IT-approved, monitoring tools can then be used to ensure work-related data isn’t being moved, intentionally or unintentionally, out of the office over a BYON network.
BYON is a threat to your organization mainly because your data is now outside your network and there is no way to protect it. In order to maintain control of your network, IT will need to understand the limitations of your network that are causing employees and contractors to seek alternative access. Once you identify the pain points, work with your employees to address them so that no one has a need to violate policies and compromise your organization. Bringing BYON into the fold means that BYON is controlled, and you can authorize access and monitor where your data might be compromised – significantly reducing your risk.