ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

Bring Your Own Device (BYOD)

An organization has a Bring Your Own Device (BYOD) policy, where a subject is authorized to connect personally owned devices—such as smartphones, tablets, or laptops—to organizational resources. These resources include corporate networks, cloud applications, and on-premises systems that may handle confidential and/or sensitive information.

 

The use of personal devices in a corporate environment introduces several risks, as these devices may lack the same level of security controls and monitoring as organization-owned equipment.

Prevention

ID Name Description
PV040Network Access Control (NAC)

Network Access Control (NAC) manages and regulates devices accessing a organization's network(s), including personal devices under a Bring Your Own Device (BYOD) policy. NAC systems ensure that only authorized and compliant devices can connect to the network, reducing security risks.
 

NAC performs the following functions:

  • Device Authentication and Authorization: Checks whether the device meets the organization’s security policies before granting access.
  • Compliance Checks: Verifies that devices have up-to-date security patches and configurations. Non-compliant devices may be denied access or placed in a quarantined network zone.
  • Segmentation and Isolation: Restricts devices' access to sensitive areas, limiting potential impact from compromised devices.
  • Continuous Monitoring: Tracks connected devices for ongoing compliance and can automatically quarantine or disconnect those that fall out of compliance.
  • Policy Enforcement: Applies security policies to ensure devices can only access appropriate resources based on their security status.

 

NAC functionality can be provided by dedicated NAC appliances, next-generation firewalls, unified threat management devices, and some network switches and routers.

PV009Prohibition of Devices On-site

Certain infringements can be prevented by prohibiting certain devices from being brought on-site.