BYOD and Remote Wipe By @RickNotDelgado | @CloudExpo [#Cloud]
While it makes sense, remote wiping has its opponents
Nov. 24, 2014 12:15 PM
BYOD & the Importance of the Remote Wipe
Most people enjoy the freedom of bringing their own devices to work. It's hard to beat the comfort of using a familiar machine or not having to carry two phones or tablets. Employees are eager to support BYOD and don't think twice when they sign their company's policy. However, there's an often overlooked, small-print clause at the bottom of these policies that, if read, may cause employees to rethink using their personal devices at work.
Many companies hold the right, in the event a device is lost or stolen, to remotely wipe the contents. It doesn't matter if it's a personal device, because if it's used at work, company data is considered company property. Most employees are in the dark about remote wipe policies, because while a majority of them support BYOD, 70 percent say they'd avoid using a personal device if they knew an employer could wipe its contents.
Initially, this may seem unfair because it could result in the lost of personal information. However, employers counter by saying remote wipe is sometimes the only means of protecting important information before it gets into the wrong hands. For example, look at the healthcare industry. What if a doctor lost a device containing important, sensitive information about a patient? You wouldn't want your personal health information out in the open for anyone to look at. For this reason, the law requires devices that contain HIPAA data (even personal devices) be wiped in the event of loss or theft.
While it makes sense, remote wiping has its opponents. People are beginning to question its efficacy as a security tool, not to mention the legal issues surrounding it. Some experts are even saying it's a fairly crude approach to BYOD security. Mobile Device Management (MDM) vendors and advocates may disagree, but there are a number of good reasons against remote wipe.
First, remote wiping isn't an exact science and mistakes are made. While IT departments try and remove only business data during a wipe, personal information could disappear as well. When you blend work and personal in one device, it's likely personal information will get deleted. This brings a legal element into the debate. Can an employer legally wipe an entire device? If the employee owns the laptop or phone, as well as the personal data he or she stored on it, who takes responsibility in the event a device needs to be completely wiped? The cloudy legal arena on this one is enough to make some hesitant.
Another substantial hurdle to remote wiping is that bad guys are always a step ahead. Thieves are aware of remote capabilities and are quick to secure devices before they can be accessed. They can turn phones off or even lock them in special containers that render connectivity to the device nearly impossible. They can then take all the time they need to extract information without any interference.
Critics will argue that if remote wipes are activated quick enough, they can beat attackers. Perhaps, but those 24 hour policies requiring employees to report lost devices immediately aren't followed very closely. Think about it, if you lost your phone and reported it, it'll be wiped. Maybe important personal apps, photos or other data could be lost. In many cases, employees will avoid disclosing a lost device in the hopes it'll turn up. Meanwhile, the data could be long gone.
Another issue to consider, and one many consultants have raised concerns over, is employees using MDM wipe capabilities in order to avoid the law. If a device is seized, or a user fears it's likely to be taken, he or she could report it stolen and have the contents and all evidence removed. This isn't exactly a feature worth promoting, and certainly one law enforcement isn't too happy about.
Long story short, remote wipes aren't a perfect solution. The original intent had some validity, but it also raises too many concerns. Wiping is really only an effective solution in an ideal world. Unfortunately, thieves don't play by the rules and find ways around our solutions. For the moment, employees should always ask questions regarding BYOD policies in order to know what the remote wipe procedure is. Also, partition your device, which will increase the likelihood of personal data being protected in the event of a wipe.