The Issue with BYOD

Lots of companies allow the workforce to use personal computers. The bring-your-own-device or BYOD model is appealing because it reduces the IT Operations costs, and it allows employees to use the systems they’re most comfortable with. Unfortunately, BYOD also presents a security risk. Is it worth it? Let’s discuss.

How likely is it that my employee’s computer is compromised?

Left totally unchecked, a company of even moderate size must assume that their employees are working from compromised machines. Criminals have compromised tens of millions of computers for financial crime, botnets, or other nefarious reasons. The US Government’s FBI reports more than 800k annual complaints. One of the leading categories is Tech Support Fraud. Active hacking aside, employees may download and install malware themselves through online marketplaces and forums.

How can an employee’s machine leak data?

Once a personal computer is compromised, an investigator must operate under the assumption that the unauthorized user had access to everything the employee did on that machine. Attempting to prove that the attacker had limited access would be a difficult, if not infeasible, task, given that forensic investigators typically have to review drives from every compromised computer as part of a comprehensive investigation.

1. Keystrokes: The compromised computer can expose everything typed into the computer. Emails, briefings, memos. Literally everything!
2. Screen scraping: The compromised computer can expose everything shown on the screen, saving video recordings. More recently, artificial intelligence tools
3. Exfiltration: Attackers are likely to find sensitive files stored locally and simply export them. They can sync them to online storage solutions or simply remote into the computer and pull whatever they want.
   

What if the employee doesn’t have sensitive data?

Even if the employee doesn’t see sensitive information, these compromised devices are gateways for cybercriminals to infiltrate the company's network by exploring the environment, discovering other potentially vulnerable machines, or creating malicious software and leaving it for someone with higher privileges to execute.  

Even if the compromised computer didn’t have access to ANY files, file shares, other computers, it still serves as a cyber risk as the attacker can simply misbehave as if they were an employee! One example might be emailing customers telling them they should send payment to a new bank account.

What does the attacker do next?

The attacker’s playbook is simple. Once they pop one machine, they’ll look for others. A company’s computers networked together making it easier to move across the enterprise. Some examples would include emailing malicious files or uploading malware to shared drives.  Ideally, the attacker finds their way into company servers, computers with access to cloud administrator or other higher value targets sensitive.

Who’s going to do that?

Turns out, a lot of people. Your internet connected device is accessible to billions of people. Even one bad apple in a million leaves thousands of motivated and capable threat actors. Although motivations are as diverse as the unmanaged operating systems used by the average consumer, three primary motivations stand out:

1. Financial incentives: Cybercriminals recognize the potential gains of infiltrating organizational networks. They can steal, commit fraud, or just encrypt the files demanding money for the keys.  
2. Intellectual property theft: Especially in hypercompetitive industries, unmanaged devices may store valuable proprietary knowledge that attackers can exploit to undermine your company’s competitive advantage.
3. Ideological motivations: hacktivists and criminal groups leveraging unmanaged computers to further their agendas, be it political, social, or economic. Examples include inflating social media posts or interrupting service for controversial (but legal) services like gun manufacturing or reproductive healthcare.
   

When has this risk materialized?

Here are a few publicly available examples of the risk associated with unmanaged mobile computers.

What should we do to protect ourselves?

The level of protection depends on your business’ unique situation, including its susceptibility to attacks, position in the marketplace, tolerance for accepting risk and regulatory influence like compliance with FedRAMP or HITRUST.

Good - Access Restriction and Education

Prevent employees from accessing sensitive data and systems. This approach keeps things simple: if employees don't interact directly with sensitive IT, the risk of compromise through their personal devices is minimized. Regularly train employees about risks associated with accessing data.

Better - Zero Trust Architecture

Adopt a zero trust approach where no device or user is inherently trusted. Every access request is fully authenticated, authorized, and encrypted before granting access, ensuring that all interactions with company data and networks follow the principle of "never trust, always verify."

Best - Managed Company Devices with Zero Trust

Equip employees with standardized, monitored, and regularly updated devices. These managed devices, when combined with the zero trust philosophy, offer a robust defense. Managed devices and zero trust architecture work in tandem to amplify security: the inherent safeguards of standardized devices integrate with stringent access controls, establishing a solid defense against potential threats.

Conclusion

BYOD's cost savings and convenience are tempting, but the risk of compromised employee computers is real. Once a personal computer is breached, data leaks are highly likely. We can also be certain that, given enough unmanaged machines, at least one will be breached. Ready to secure your organization? Let our experts guide you to a safer, more efficient future.

About RISCPoint

If you are looking to bolster your organization’s security or achieve compliance, RISCPoint has advanced services tailored to your needs. Our certified cyber security professionals have successfully supported companies across a wide range of industries and sizes, from Fortune 10 to pre-Series A startups. To learn more, visit riscpoint.com/contact or call 1-888-320-1327.