Information Technology / Operations Management K Bring Your Own e Where end-users once queued up to ask the IT department for permission to y buy a new computer or a new version of software, they are now bypassing IT e s altogether and buying it on their own. From laptops and smartphones to iPads Devices (BYOD) and virtually unlimited software apps, end-users have tasted their freedom and love it. IT will simply never be the same. B r Bring Your Own Devices (BYOD) Survival Guide explains the psycho- Survival Guide i techno phenomenon also known as bring your own technology (BYOT). n Providing the guidance necessary for living in this new world, it describes the g new end-users (Millennials) and their demands, as well as the strategic and tactical ramifications of these demands. Y o Examining the business aspects of BYOD—selection, purchasing, and u corporate culture—the book covers the broad range of technical considerations S including selection, connectivity, training, support, and security. It also ur includes an extensive set of best practices. rO v The book is geared for the small- to medium-size enterprise that needs to w i integrate BYOD into their environment. It addresses top ics such as content and v data management, risk assessment, performance measurement, management, an and even configuration management. l D G The text includes a set of Quick Start guides that provide tips for such e things as assessing costs, cloud integration, and even legal issues. There is u also a full set of appendices that supply helpful information on everything v i from security settings for Apple iOS devices to a sample employee mobile di c device agreement. ee s K16077 ( ISBN: 978-1-4665-6503-6 B 90000 www.crcpress.com Y 9 781466 565036 O www.auerbach-publications.com D Jessica Keyes ) Bring Your Own Devices (BYOD) Survival Guide Bring Your Own Devices (BYOD) Survival Guide Jessica Keyes CRC Press Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2013 by Taylor & Francis Group, LLC CRC Press is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works Version Date: 20130204 International Standard Book Number-13: 978-1-4665-6504-3 (eBook - PDF) This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, includ- ing photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, please access www.copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged. Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe. Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com Contents Preface ...................................................................................................xv About the Author. ...............................................................................xvii Chapter 1 The BYOD Revolution .......................................................1 What’s in It for the Organization? ............................................2 So, What Can Go Wrong? ..........................................................2 Mobile Device Management ......................................................3 Consumerization of IT ...............................................................5 Business as Usual .........................................................................9 Chapter 2 Making a Financial Case for BYOD ................................13 Supporting BYOD .....................................................................13 Cost-Benefit Analysis ................................................................14 Break-Even Analysis ..................................................................15 Estimating ROI for an IT Project ............................................16 Earned-Value Management .....................................................20 Rapid Economic Justification ..................................................21 Value Measuring Methodology ...............................................22 Step 1: Develop a Decision Framework .............................22 Task 1—Identify and Define Value Structure ..............24 Task 2—Identify and Define Risk Structure ................25 Task 3—Identify and Define Cost Structure ................27 Task 4—Begin Documentation ......................................27 Step 2: Alternative Analysis—Estimate Value, Costs, and Risk ................................................................................28 Task 1—Identify and Define Alternatives ....................31 Task 2—Estimate Value and Cost ..................................31 Task 3—Conduct Risk Analysis ....................................32 Task 4—Ongoing Documentation ................................32 Step 3: Pull Together the Information ...............................33 Task 1—Aggregate the Cost Estimate ..........................34 Task 2—Calculate the Return on Investment .............34 Task 3—Calculate the Value Score ................................35 v vi • Contents Task 4—Calculate the Risk Scores ................................35 Task 5—Compare Value, Cost, and Risk .....................36 Step 4: Communicate and Document................................36 Task 1—Communicate Value to Customers and Stakeholders ......................................................................37 Task 2—Prepare Budget Justification Documents ......38 Task 3—Satisfy Ad Hoc Reporting Requirements ......38 Task 4—Use Lessons Learned to Improve Processes .......................................................................38 Uncertainty Analysis ............................................................39 Sensitivity Analysis ..............................................................39 Glossary ......................................................................................41 Reference ....................................................................................46 Chapter 3 Integrating BYOD into Performance Measurement and Management Systems ...............................................47 Why Measure? ...........................................................................47 Understanding Performance Management ...........................49 Define Organizational Vision, Mission, and Strategy .........................................................................49 Develop Performance Objectives, Measures, and Goals ..................................................................................49 Give Measures Time to Evolve ............................................50 Attributes of Successful Performance Measurement Systems ........................................................................................51 Developing Benchmarks...........................................................52 Plan ........................................................................................54 Collect ...................................................................................54 Analyze ..................................................................................55 Adapt ......................................................................................55 Using Balanced Scorecard to Measure BYOD Effectiveness ...............................................................................58 Representative IT Balanced Scorecard Value Metrics ..........69 Keeping Track of What’s Going On ........................................70 Validation and Verification ......................................................75 References ...................................................................................76 Contents • vii Chapter 4 Assessment and Mitigation of Risks in a BYOD Environment .....................................................................77 Initiating the Risk Assessment ................................................78 A Typical Organization’s Computer System ..........................79 System Architecture .................................................................80 System Operational Authority/Ownership ...........................80 Threats to A Typical Organization’s Assets ...........................81 Current Security Measures ......................................................83 COG Contingency Planning ...................................................84 Divisional Contingency Planning ...........................................85 Protection against Network-Related Threats ........................86 Vulnerabilities Reported by the Risk Assessment Team .....87 Recommendations for Mitigating the Identified Vulnerabilities ............................................................................89 Summary ....................................................................................92 Reference .....................................................................................92 Chapter 5 Guidelines for Managing and Securing Mobile Devices in the Enterprise. ................................................93 Mobile Device Overview ..........................................................93 High-Level Threats and Vulnerabilities .................................94 Use of Untrusted Mobile Devices and Networks .................96 Use of Applications Created by Unknown Parties ...............97 Interaction with Other Systems ..............................................98 Use of Untrusted Content ........................................................98 Use of Location Services ..........................................................99 Technologies for Mobile Device Management .....................99 Components and Architectures .......................................100 Capabilities ...............................................................................101 General Policy .....................................................................101 Data Communication and Storage ...................................102 User and Device Authentication ......................................102 Applications .........................................................................102 Security for the Enterprise Mobile Device Solution Life Cycle ..................................................................................103 Initiation ..............................................................................104 Development........................................................................107 Implementation ...................................................................108 viii • Contents Operations and Maintenance ...........................................109 Disposal ................................................................................110 Case Study ................................................................................110 Chapter 6 Cloud Best Practices ......................................................113 Selecting a Cloud Service .......................................................114 CSP and End-User Agreements .............................................115 Terms of Service Agreements ...........................................116 Non-Disclosure Agreements .............................................116 Service Level Agreements ..................................................117 Terms and Definitions .......................................................117 Measuring SLA Performance ............................................117 SLA Enforcement Mechanisms ........................................118 CSP, Organization, and Integrator Roles and Responsibilities ........................................................................118 Contracting with Integrators ............................................119 Clearly Defined Roles and Responsibilities.....................119 Standards .................................................................................120 Security ....................................................................................120 Continuous Monitoring ....................................................120 Incident Response ...............................................................121 Key Escrow .........................................................................122 Forensics..............................................................................122 Audit Logs ...........................................................................122 Privacy Impact Assessments (PIA) .................................123 Data Location .....................................................................124 Breach Response ................................................................124 Reference ...................................................................................125 Chapter 7 Configuration Management in a BYOD Environment ......127 CM and Process Improvement .............................................128 Measurement and Metrics .....................................................129 Benefits of BYOD CM .............................................................130 CM Components .....................................................................130 Configuration Identification ..................................................131 Configuration Change Control .............................................133 Configuration Status Accounting .........................................135