Welcome!

@CloudExpo Authors: Pat Romanski, Zakia Bouachraoui, Elizabeth White, Yeshim Deniz, Liz McMillan

Related Topics: @CloudExpo, Mobile IoT, Containers Expo Blog, Agile Computing, Cloud Security

@CloudExpo: Blog Post

BYOD and Remote Wipe By @RickNotDelgado | @CloudExpo [#Cloud]

While it makes sense, remote wiping has its opponents

BYOD & the Importance of the Remote Wipe

Most people enjoy the freedom of bringing their own devices to work. It's hard to beat the comfort of using a familiar machine or not having to carry two phones or tablets. Employees are eager to support BYOD and don't think twice when they sign their company's policy. However, there's an often overlooked, small-print clause at the bottom of these policies that, if read, may cause employees to rethink using their personal devices at work.

Many companies hold the right, in the event a device is lost or stolen, to remotely wipe the contents. It doesn't matter if it's a personal device, because if it's used at work, company data is considered company property. Most employees are in the dark about remote wipe policies, because while a majority of them support BYOD, 70 percent say they'd avoid using a personal device if they knew an employer could wipe its contents.

Initially, this may seem unfair because it could result in the lost of personal information. However, employers counter by saying remote wipe is sometimes the only means of protecting important information before it gets into the wrong hands. For example, look at the healthcare industry. What if a doctor lost a device containing important, sensitive information about a patient? You wouldn't want your personal health information out in the open for anyone to look at. For this reason, the law requires devices that contain HIPAA data (even personal devices) be wiped in the event of loss or theft.

While it makes sense, remote wiping has its opponents. People are beginning to question its efficacy as a security tool, not to mention the legal issues surrounding it. Some experts are even saying it's a fairly crude approach to BYOD security. Mobile Device Management (MDM) vendors and advocates may disagree, but there are a number of good reasons against remote wipe.

First, remote wiping isn't an exact science and mistakes are made. While IT departments try and remove only business data during a wipe, personal information could disappear as well. When you blend work and personal in one device, it's likely personal information will get deleted. This brings a legal element into the debate. Can an employer legally wipe an entire device? If the employee owns the laptop or phone, as well as the personal data he or she stored on it, who takes responsibility in the event a device needs to be completely wiped? The cloudy legal arena on this one is enough to make some hesitant.

Another substantial hurdle to remote wiping is that bad guys are always a step ahead. Thieves are aware of remote capabilities and are quick to secure devices before they can be accessed. They can turn phones off or even lock them in special containers that render connectivity to the device nearly impossible. They can then take all the time they need to extract information without any interference.

Critics will argue that if remote wipes are activated quick enough, they can beat attackers. Perhaps, but those 24 hour policies requiring employees to report lost devices immediately aren't followed very closely. Think about it, if you lost your phone and reported it, it'll be wiped. Maybe important personal apps, photos or other data could be lost. In many cases, employees will avoid disclosing a lost device in the hopes it'll turn up. Meanwhile, the data could be long gone.

Another issue to consider, and one many consultants have raised concerns over, is employees using MDM wipe capabilities in order to avoid the law. If a device is seized, or a user fears it's likely to be taken, he or she could report it stolen and have the contents and all evidence removed. This isn't exactly a feature worth promoting, and certainly one law enforcement isn't too happy about.

Long story short, remote wipes aren't a perfect solution. The original intent had some validity, but it also raises too many concerns. Wiping is really only an effective solution in an ideal world. Unfortunately, thieves don't play by the rules and find ways around our solutions. For the moment, employees should always ask questions regarding BYOD policies in order to know what the remote wipe procedure is. Also, partition your device, which will increase the likelihood of personal data being protected in the event of a wipe.

More Stories By Rick Delgado

“I’ve been blessed to have a successful career and have recently taken a step back to pursue my passion of writing. I’ve started doing freelance writing and I love to write about new technologies and how it can help us and our planet.” – Rick DelGado (@ricknotdelgado)

CloudEXPO Stories
Digital Transformation: Preparing Cloud & IoT Security for the Age of Artificial Intelligence. As automation and artificial intelligence (AI) power solution development and delivery, many businesses need to build backend cloud capabilities. Well-poised organizations, marketing smart devices with AI and BlockChain capabilities prepare to refine compliance and regulatory capabilities in 2018. Volumes of health, financial, technical and privacy data, along with tightening compliance requirements by FTC, CUI/DFARS, EU-GDPR and the underlying National Cybersecurity Framework suggest the need for a ground-up re-thinking of security strategies and compliance actions. This session offers actionable advice based on case studies to demonstrate the impact of security and privacy attributes for the cloud-backed IoT and AI ecosystem.
Transformation Abstract Encryption and privacy in the cloud is a daunting yet essential task for both security practitioners and application developers, especially as applications continue moving to the cloud at an exponential rate. What are some best practices and processes for enterprises to follow that balance both security and ease of use requirements? What technologies are available to empower enterprises with code, data and key protection from cloud providers, system administrators, insiders, government compulsion, and network hackers? Join Ambuj Kumar (CEO, Fortanix) to discuss best practices and technologies for enterprises to securely transition to a multi-cloud hybrid world.
"Calligo is a cloud service provider with data privacy at the heart of what we do. We are a typical Infrastructure as a Service cloud provider but it's been designed around data privacy," explained Julian Box, CEO and co-founder of Calligo, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use of real time applications accelerate, legacy networks are no longer able to architecturally support cloud adoption and deliver the performance and security required by highly distributed enterprises. These outdated solutions have become more costly and complicated to implement, install, manage, and maintain.SD-WAN offers unlimited capabilities for accessing the benefits of the cloud and Internet. SD-WAN helps enterprises to take advantage of the exploding landscape of cloud applications and services, due to its unique capability to support all things cloud related.
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the APIs that make today's multi-cloud environments and hybrid clouds possible. In this Power Panel at 17th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the importance of customers being able to use the specific technologies they need, through environments and ecosystems that expose their APIs to make true change and transformation possible.