Where an Agency permits personnel to supply their own mobile devices (such as smartphones, tablets and laptops), Official Information and agency information systems are protected to a level equivalent to an agency provided and managed office environment.

]]> This section provides information on the use and security of non-agency owned or provided mobile devices when used for official business. This is commonly known as Bring Your Own Device (BYOD). The use of agency owned devices is described earlier in Section 21.1 – Agency Owned Mobile Devices.

]]> In the context of this section, a BYOD Network is any agency owned or provided network dedicated to BYOD.  A BYOD Network is usually within an agency’s premises but does NOT include networks and related services provided by commercial telecommunication or other technology providers.

]]> BYOD will introduce a wide range of risks, including information and privacy risks, to an organisation, in addition to the existing ICT risks and threats.  Agencies will need to carefully examine and consider the security, privacy, governance, assurance and compliance risks and implications of BYOD.

]]> Mobile devices are a “soft” target for malware and cybercrime providing a further attack channel or vector for organisational ICT infrastructures and networks. Risks fall principally into the following categories:

  • Data exfiltration and theft;
  • Data tampering;
  • Data loss;
  • Malware;
  • System outages and Denial of Service; and
  • Increased incident management and recovery costs.
]]> Reference  Title Publisher Source  

Risk Management of Enterprise Mobility including Bring Your Own Device

ASD

https://www.cyber.gov.au/acsc/view-all-content/publications/risk-management-enterprise-mobility-including-bring-your-own-device 

 

BYOD Guidance: Device Security Considerations

GOV.UK

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/360960/BYOD_Guidance_-_Device_Security_Considerations.pdf [PDF, 235 KB]

 

End User Devices Security and Configuration Guidance

NCSC, UK

https://www.ncsc.gov.uk/collection/device-security-guidance/bring-your-own-device

NIST Special Publication 800-121, Revision 2, May 2017

Guide to Bluetooth Security

NIST

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-121r2.pdf [PDF, 2.1 MB]

NIST Special Publication 800-46, Revision 2, July 2016

Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security

NIST

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-46r2.pdf [PDF, 570 KB]

NIST Special Publication 800-114, Revision 1, July 2016

User’s Guide to Telework and Bring Your Own Device (BYOD) Security

NIST

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-114r1.pdf [PDF, 435 KB]

 

]]> Commonly termed “Bring Your Own Device” (BYOD), personal use of mobile computing in an organisational environment is widespread and personnel have become accustomed to the use of a variety of personal mobile devices.  BYOD can have many advantages for an agency and for personnel.  At the same time, BYOD will introduce a range of new information security risks and threats and may exacerbate existing risks.

]]> Agencies MUST undertake a risk assessment and implement appropriate controls BEFORE implementing a BYOD Policy and permitting the use of BYOD.

]]> Agencies MUST take an integrated approach to BYOD security, covering policy, training, support, systems architecture, security, systems management, change management, incident detection & management and business continuity.

]]> BYOD introduces number of additional risks and attack vectors to agency systems.  Not all BYOD risks can be fully mitigated with technologies available today.  It is therefore important that, where feasible, all the controls specified in this section are implemented.

]]> BYOD MUST only be permitted for agency information systems up to and including RESTRICTED.

]]> BYOD MUST NOT be used for CONFIDENTIAL, SECRET or TOP SECRET systems.

]]> “Jail-Breaking” and “rooting” are terms applied to devices where operating systems controls have been by-passed to allow installation of alternate operating systems or software applications that are not otherwise permitted.  This is a risky practice and can create opportunities for device compromise.  Users may wish to alter settings to allow the download of personal apps.  This can result in security setting violations.

]]> Devices that have been “jail-broken”, “rooted” or have settings violations MUST NOT be used for any agency business or be allowed to connect to any agency systems UNLESS this been specifically authorised.

]]> Technical controls fall into two categories: organisational systems and device controls.  Protection for organisational systems will start with a risk assessment which guides the development of a secure architecture to support BYOD operations.  Additional controls will need to be applied to individual devices.  The privacy of user data should be considered. A user policy is essential.

]]> Agencies may identify additional policy provisions and controls that are required, based on their assessment of risk.  Agencies MUST implement the additional controls and protocols before implementing BYOD.

]]> Agencies MUST implement a BYOD acceptable use policy, agreed and signed by each person using a BYOD device.

]]> The agency’s policy MUST clearly establish eligibility of personnel for participation in the agency BYOD scheme.

]]> Personnel MUST have written authorisation (usually managerial approval) before a connection is enabled (on-boarding).

]]> Written authorisation MUST include the nature and extent of agency access approved, considering:

  • time, day of the week;
  • location; and
  • local or roaming access.
]]> Procedures MUST be established for removal of agency installed software and any agency data when the user no longer has a need to use BYOD, is redeployed or ceases employment (off-boarding).

]]> Standard Operating Procedures for the agency’s BYOD network MUST be established.

]]> Provision MUST be made for contractors and other authorised non-employees.  It is at the agency’s discretion whether this activity is permitted.  The risk assessment MUST reflect this factor.

]]> Ownership of data on BYOD devices MUST be clearly articulated and agreed.

]]> Agency policies MUST clearly articulate the separation between corporate support and where individuals are responsible for the maintenance and support of their own devices.

]]> Agency policies MUST clearly articulate the acceptable use of any GPS or other tracking capability.

]]> Individual responsibility for the cost of any BYOD device and its accessories MUST be agreed.

]]> Individual responsibility for replacement in the event of loss or theft MUST be agreed.

]]> Individuals MUST be responsible for the installation and maintenance of any mandated BYOD-based firewalls and anti-malware software and for implementing operating system updates and patches on their device.

]]> The procedures for purchasing and installing business related applications on the mobile devices MUST be specified and agreed.

]]> The responsibility for payment of voice and data plans and roaming charges MUST be specified and agreed.

]]> The use of BYOD presents increased risk and threat to agency systems.  Changes to an agency’s security architecture are necessary in order to minimise and manage the increased risk and threat to agency systems, information and information privacy.

]]> It is important that the principles of separation and segregation are applied to any system architecture or design to assist in the management of risk in BYOD systems.

]]> BYOD devices will seek to establish multiple connections through Wi-Fi “hot spots”, Bluetooth connection and simultaneous internet and cellular connections.  This behaviour creates multiple simultaneous “back channels” which can provide attack vectors for malicious activities and is considered to be high risk.

]]> A security architectural review MUST be undertaken by the agency before allowing BYOD devices to connect to agency systems.

]]> The BYOD network segment MUST be segregated from other elements of the agency’s network.

]]> Agencies MUST architecturally separate guest and public facing networks from BYOD networks.

]]> Network configuration policies and authentication mechanisms MUST allow access to agency resources ONLY through the BYOD network segment.

]]> Access to internal resources and servers MUST be carefully managed and confined to only those services for which there is a defined and properly authorised business requirement.

]]> Wireless access points used for access to agency networks MUST be implemented and secured in accordance with the directions in this manual (See Section 18.2 – Wireless Local Area Networks).

]]> Bluetooth on BYOD devices MUST be disabled while within designated secure areas on agency premises.

]]> Access Controls MUST be implemented in accordance with Chapter 16 – Access Control.

]]> Agencies MUST maintain a list of permitted operating systems, including operating system version numbers, for BYOD devices.

]]> Agencies MUST check each BYOD device for malware and sanitise the device appropriately before installing agency software or operating environments.

]]> Agencies MUST check each BYOD device for malware and sanitise the device appropriately before permitting access to agency data.

]]> BYOD MUST have a Mobile Device Management (MDM) solution implemented with a minimum of the following enabled:

  • The MDM is enabled to “wipe” devices of any agency data if lost or stolen;
  • If the MDM cannot discriminate between agency and personal data, all data, including personal data, is deleted if the device is lost or stolen;
  • The MDM is capable of remotely applying agency security configurations for BYOD devices;
  • Mobile device security configurations are validated (health check) by the MDM before a device is permitted to connect to the agency’s systems;
  • “Jail-broken”, “rooted” or settings violations MUST be detected and isolated; 
  • “Jail-broken” devices are NOT permitted to access agency resources; 
  • Access to agency resources is limited until both the device and user is fully compliant with policy and SOPs;
  • Auditing and logging is enabled; and
  • Changes of Subscriber Identity Module (SIM) card are monitored to allow remote blocking and wiping in the event of theft or compromise.
]]> Intrusion detection systems MUST be implemented.

]]> Continuous monitoring MUST be established to detect actual or potential security compromises or incidents from BYOD devices.  Refer also to Chapter 6 - Information Security Monitoring.

]]> Agencies MUST maintain a list of approved cloud applications that may be used on BYOD devices.

]]> Agencies MUST block the use of unapproved cloud applications for processing any agency or organisational data.

]]> BYOD devices MUST NOT be permitted direct connection to internal hosts, including all other devices on the local network.

]]> BYOD devices connecting to guest and public facing networks MUST NOT be permitted access to the corporate network other than through a VPN over the Internet.

]]> Bluetooth on BYOD devices SHOULD be disabled while within agency premises and while accessing agency systems and data.

]]> BYOD devices and systems SHOULD use Multi-factor (at least two-factor) authentication to connect to agency systems and prior to being permitted access to agency data.

]]> Devices will automatically associate with the strongest signal and associated Access Point (AP).  A rogue AP may belong to another organisation in an adjacent building, contractor, customer, supplier or other visitor.  Association with a rogue AP can provide a means for the installation of malware.

]]> Wireless IDS / IPS systems have the ability to detect rogue wireless AP’s by channel, MAC address, frequency band and SSID.  They can continuously monitor wireless networks and detect and block denial-of-service and adversary-in-the-middle wireless attacks.  Establishing baselines of known authorised and unauthorised devices and AP’s will assist in detecting and isolating any rogue devices and AP’s.

]]> Agencies MUST implement a wireless IDS /IPS on BYOD wireless networks.

]]> Agencies MUST implement rogue AP and wireless “hot spot” detection and implement response procedures where detection occurs.

]]> Agencies SHOULD conduct a baseline survey to identify:

  • All authorised devices and AP’s; and
  • Any unauthorised devices and AP’s.
]]> Mobile devices are susceptible to loss, theft and being misplaced.  These devices can be easily compromised when out of the physical control of the authorised user or owner.  To protect agency systems it is important that BYOD devices are also secured and managed on an ongoing basis.

]]> Any agency data exchanged with the mobile device MUST be encrypted in transit (See Chapter 17 – Cryptography).

]]> Any agency data stored on the device MUST be encrypted (including keys, certificates and other essential session establishment data).

]]> The use of virtual containers, sandboxes, wraps or similar mechanisms on the mobile device MUST be established for each authorised session for any organisational data.  These mechanisms MUST be non-persistent and be removed at the end of each session.

]]> Any sensitive agency data MUST be removed and securely deleted, or encrypted at the end of a session.

]]> Connections to the agency network MUST be time limited to avoid leaving a session “logged on”.

]]> Communications between the mobile device and the agency network MUST be established through a Virtual Private Network (VPN).

]]> Agencies MUST disable split-tunnelling when using a BYOD device to connect to an agency network (See Section 21.1 – Agency Owned Mobile Devices).

]]> Agencies MUST disable the ability for a BYOD device to establish simultaneous connections (e.g. wireless and cellular) when connected to an agency’s network.

]]> The use of passwords or PINs to unlock the BYOD device MUST be enforced in addition to all other agency authentication mechanisms.

]]> BYOD device passwords MUST be distinct from any agency access and authentication passwords.

]]> BYOD passwords MUST be distinct from other fixed or mobile agency network passwords (See Section 16.1 – Identification and Authentication for details on password requirements).

]]> There are many new devices and operating system versions being frequently released.  It may not be feasible or cost-effective for an agency to support all combinations of device and operating system.

]]> Agencies SHOULD compile a list of approved BYOD devices and operating systems for the guidance of staff.

]]> Agencies SHOULD consider the implementation of Data Loss Prevention (DLP) technologies.

]]> Agencies SHOULD consider the use of bandwidth limits as a means of controlling data downloads and uploads.

]]> Agencies SHOULD take legal advice on the provisions in their BYOD policy.

]]>