BYOD Participation Agreement
11
BYOD Participation Agreement A framework Dentons Canada LLP Timothy M Banks, CIPP/C Partner T: 416-863-4424 [email protected] follow: @TM_Banks Originally presented at the Canadian Institute’s 19 th Annual Regulatory Compliance for Financial Institutions, November 14, 2013
description
In this presentation, Dentons’ Timothy Banks discusses BOYD (Bring Your Own Device) Participation Agreements, key topics include: - Administrative Issues - Technical Controls - Managing Day-to-Day Online Risk - User Responsibilities - Employer Access and Ownership - Monitoring - Employee Access - Respect the Workday
Transcript of BYOD Participation Agreement
BYOD Participation AgreementA framework
Dentons Canada LLP
Timothy M Banks, CIPP/CPartnerT: [email protected]: @TM_Banks
Originally presented at the Canadian Institute’s 19th Annual Regulatory Compliance for Financial Institutions, November 14, 2013
Administrative Issues
Prescribed Devices
• Limit suite of supported devices• No unencrypted flash drives!!
• Directory of supported devices
• Caution against upgrades before testing
Administrative Prerequisites• Who qualifies? What approvals?• Number of devices per individual• Financial support (or not)
Service Level Standards
• IT/IS’s commitment• Ready or not – IT/IS is now a
service provider to employees
• Employee’s commitment
Technical Controls
IT/IS Controls
• Device must be registered with IT• Inventory of devices
• Encrypted storage
• Digital Certificates• No manipulation
• Strong authentication controls• No circumvention
Mobile Device Management Software
• Implement• Explain!
• Audit of compliance with IT standards
• Remote disabling, wiping
• App / Software restrictions
3
Managing Day-to-Day Online Risk
Maintenance• Update malware protection• Applying operating system
patches• IT MUST cooperate
Backups• User responsible for own data• IT – don’t frustrate with
unnecessary controls
Managing Online Risk• Use malware protection• Comply with authentication
requirements
Unsecured WIFI• Explain Risks• Policy against unsecured
Restricted sites
• Safe Apps & Software directory
User Responsibilities
Physical Security• Device must not be left
unattended• Examples: No vehicle trunks• Loss of possession reported
immediately• No family-sharing of devices
Responsibilities on termination of employment
Data Control and Access• Data stored on network not
device
Segregation of Data• Work data in work apps• Personal data in personal apps
• If you have a Gmail account on your phone, why are you using work email for personal business?
5
Employer Access and Ownership
• Rights & Interest in Data• Waiver of ownership or rights in
business data• Responsibilities on termination of
employment
• Rights of Employer Access• Internal investigations• Regulatory investigation• Company litigation• Compliance audits
• Confidentiality to Employees• You are now a service provider
6
Monitoring
Scope of Monitoring• Usage• Geolocation• Types of Apps• Attempts to jailbreak• Personal data
Purpose of Monitoring• Policy enforcement• Productivity
Monitoring Methods• Automatic with reporting• Automatic with exception reports• Reasonable suspicion
Consequences of Monitoring
• Who gets the reports?
• What are the consequences of violation?
• Where is the monitoring data kept?
• How long is the monitoring data kept?• Consider overtime issues
7
Employee Access
Employee Access
• Access to the data
• What data will not be provided
• How to get more information
Access by & Disclosure to Others
• Stored in Canada? In U.S.?• Advise that laws of other jurisdiction
may apply
• Available to foreign corporate parent?• For what use?
• Circumstances in which disclosed to law enforcement
Respect the Workday
Work hours = Work• Doesn’t matter that it is “your”
device• Two way street
Restricted Site on Own Device• On a site that would otherwise
offend code of conduct during work hours
• Does it matter that it was lunch break?
9
The preceding presentation contains examples of the kinds of issues that corporations could face. If you are faced with one of these issues, please retain professional assistance as each situation is unique.
11
