Companies have the most varying takes on protecting their assets and teams. Some businesses have strict internal policies like allowing wire-only peripherals, and others force computer shutdown at the end of the working day.
However, rigid restrictions are challenging to keep up with and follow if not monitored closely, especially in hybrid environments. Remote workers, freelancers, teams on different sites, and mobile employees like consultants and salespeople extend a single-location office’s borders.
The fast pace of businesses and information flow often requires being present and removing any obstacles that disconnect employees from being out of reach. It brings us to people using their own devices in the workplace and its extended modern version.
Should organizations encourage using other than corporate-issued endpoints? And how can you manage the risks that come with them? This article will look closely into securing flexible setups of all ways of working.
Focus definitions
Bring Your Own Device (BYOD) is an organizational policy allowing employees to work or access corporate data and applications using or linking personal devices like computers and/or smartphones.
Deep Packet Inspection (DPI) is a packet filtering feature that examines data pieces against admin-defined security policies and forbidden keywords to block the information from entering the network.
BYOD in the workplace
In the modern world, incorporating employee-owned devices into the company’s technological ecosystem often rolls out with the daily operations flow. The growing tech literacy and availability influence the use of personal devices at work.
Some organizations have an unwritten rule that employees must be within reach after working hours, even though it’s not included in their job description. Or how can you quickly solve a situation when you must join a work meeting, but a corporate-issued PC just started a mandatory OS update?
Real-life situations normalize personal phones or laptops for daily or occasional use. Yet, it allows companies to save expenses for supplying extra cell phones to the staff. And the workforce is already familiar with personal phones and laptops, which allows for skipping training and adjustment periods without affecting productivity.
The BYOD strategy relieves employees from owning +1 or more devices that aren’t necessary and turns into gadget pollution. Besides, employee-owned devices are more likely to be in use and thus up to date.
Data insights: BYOD policy adoption
According to BYOD Security Report 2022, the vast majority — 82% of organizations have a policy that allows staff to use their own devices, at least to some extent. Although BYOD is mainly considered an employee-related topic, contractors, partners, customers, and suppliers also can become unmanaged-device sources to the organization.
Companies with a BYOD strategy record major benefits for organizations and the workforce. Employees using their own devices at work are more satisfied as they aren’t attached to an additional piece of technology that needs to be mastered. It boosts productivity and flexibility with a cost-saving approach.
However, convenience has its price. BYOD policy in an organization exposes it to a broader spectrum of risks. An employee manages non-company-issued devices, thus, contents and activity are much more challenging to supervise.
Risks of BYOD
The idea behind the bring your own device is to incorporate unmanaged user devices into the company network as supportive work tools. Technically, it becomes a security gap as such endpoints aren’t supervised if no security measures are enforced. To what risks do pre-owned user devices expose the organization?
Unknown end-user
A personal device doesn’t mean it is completely accessed only by its owner. If no lock pattern exists, family members, friends, or anyone can use the endpoint, which easily can lead to a data breach or leak.
Device loss
Taking your laptop or phone outside the office increases the risk of lost or stolen devices. Any hardware containing business-sensitive information compromises data security as it can be extracted or accessed with little effort.
Non-trusted apps and networks
Individual devices mean personal activities. Work-related apps, communication channels, and email accounts mix with entertainment software (at times consisting of surveillance or malicious elements), streaming services, free-roam browsing, and potential for phishing attacks.
Security features to support BYOD
Preventive measures like single sign-on or multi-factor authentication, network segmentation, and rooted-device detection help manage various risks of BYOD.
Integration of a solution to block external threats makes internet browsing safer for users with pre-owned endpoints. NordLayer’s ThreatBlock feature enriches DNS filtering by screening connection inquiries against libraries of malicious sites and blocklisting them from visiting.
Besides only focusing on protecting the device, encryption of communication channels is a strong addition to BYOD strategy enforcement. Modern AES 256-bit encryption used in internet protocols like NordLynx encodes traveling data. It ensures the confidentiality of sensitive business information when connected to untrusted networks.
Another way to ensure device compliance with organizational security policies is to enable auto-connection to the company's Virtual Private Network (VPN) once an internet connection is detected and use always-on VPN features. Automatization minimizes the human error vulnerability so users can’t ‘forget’ to switch their devices to the required gateway when accessing company resources.
Let’s shift from the n+1 possible strategies of enabling BYOD policy and, this time, dig deeper into one of the most prominent security functionalities - Deep Packet Inspection (DPI) - that controls what’s entering the company network despite the source of the endpoint.
What is DPI?
Deep Packet Inspection helps protect the company network by filtering out harmful or unwanted sites and applications. It scans data packets of traveling information against flagged keywords and website categories. Unlike DNS filtering, which filters only website data, DPI goes above browser-level restrictions and inspects data on the applications and device levels.
DPI processes packet filtering that may contain malicious elements leading to intrusions and viruses. Alternatively, it allows blocking out sources incompatible with work productivity, like gaming or streaming sites.
In short, the feature serves network management by controlling what ports and protocols employees can access while connected to the company gateways, effectively securing the devices as DPI inspects not only the headers but also the contents of data packets.
How does DPI enable the flexibility of BYOD policy?
In the post-pandemic era, companies are calibrating which approach - remote or on-site - works best for their organizational culture. Ultimately it shows a clear tendency for the application of hybrid work variations. Meaning the BYOD policy is implicit in such companies.
Securing remote workforces
Physical distance is the main attribute of remote work. Traveling and remote employees and freelancers are the driving force for implementing the BYOD policy since acquiring hands-on staff is easier and cheaper.
Removing the office-based restrictions of a controlled network prevents IT administrators from actively monitoring the company infrastructure within a contained perimeter. In this case, the security focus can shift from the actor to the conditions of the environment they operate in.
DPI is based on a set of rules that admins impose collectively for the whole organization or teams and selected users. They can define restrictions on what content can’t enter the company network while connected to the organization gateway.
Blocking specific ports and protocols aid security strategy by stopping:
Downloading file-sharing applications
Accessing malicious websites that may inject malware
Falling victim to a man-in-a-middle attack while connected to public wifi
Entering links with phishing attempts
Installing shadow add-ons and software
(Un)voluntary data leaking
Office security enhancement
It is easier to manage on-premise work until it turns to online browsing. Dozens of open tabs, links, and distractions on the internet require additional precautions to improve productivity within the office borders.
DPI solution enables IT administrators to manage access to online resources that tend to impact employee effectiveness daily.
First, an organization can simply deny access to streaming, gaming, and secondary websites unrelated to performing job tasks. Less Youtube, Twitch, or Netflix streaming in the background, more focus on performance quality.
Secondly, unnecessary internet traffic slows down the bandwidth within the office. Slow connections disrupt the intended workflow, put pressure on infrastructure, and result in poor user experience. DPI feature allows IT admins to eliminate traffic overload on the company network.
Enabling secure BYOD with NordLayer
NordLayer introduced Deep Packet Inspection (Lite) security feature focusing on the most tangible organization pain points with hybrid setups. Security and productivity are the priorities of a business; thus, DPI Lite seals the security vulnerabilities, whether you try managing globally spread teams and freelancers or unlocking workforce performance.
NordLayer’s DPI Lite is one of the many security layers that, combined with other network management features like DNS filtering and IAM integrations, solidify any cybersecurity approach — and help you find the most straightforward way to improve your organizational security.
