BYOD, or “bring your own device,” is popular with employees and employers alike. The former enjoy using the hardware they already love and are often more productive as a result, while the latter are exempt from spending thousands of dollars on the latest laptops.
However, the practice can also be astronomically risky if not enough is done to secure those personal devices and the company systems that they connect to. In these situations, traditional defenses based on firewalls that serve as a secure perimeter to protect corporate networks go out the window because the endpoints sit outside that perimeter.
In an effort to control who connects to the company’s servers, many cyber teams opt for zero trust solutions focused on user identification and verification. Zero trust refers to a security framework based on the idea that systems should never trust, but always verify. When this framework is applied, every single user identity is treated with suspicion as a default.
Instead of focusing on establishing a secure perimeter, each individual and device must authenticate to access corporate applications and data, and permissions are granted only for what’s absolutely necessary.
But implementing zero trust isn’t always so straightforward, as it requires thorough management of several aspects of identity-based gatekeeping. In many cases, businesses may need to consider adopting multiple zero trust security solutions to ensure they don’t leave any gaps in their defenses.
Let’s take a look at a few types of zero-trust security tools and how they support effective BYOD security.
Identity and Access Management for Individual Access
Zero trust solutions work by identifying who is trying to log into the system, and this is best done using Identity and Access Management, or IAM, tools that rely on a number of key technologies. Multi-factor authentication sits at the heart of any good IAM strategy. By requiring users to verify themselves with two methods, organizations can dramatically reduce the risk of an employee’s device or password being stolen.
At the same time, many systems will use single sign-on services, enabling users to authenticate once for multiple apps and systems to reduce the fatigue of constantly entering passwords, undergoing biometric scans, or using other authentication methods. Finally, IAM requires strong conditional access policies that evaluate the login context. For instance, if an employee who normally logs in from Chicago suddenly tries to log in from Russia, that should immediately trigger additional verification steps.
IAM systems are designed to ensure that individuals are who they claim to be and to protect against risks such as credential stuffing and phishing attacks. However, IAM is not bulletproof; its main glaring weakness is that it doesn’t secure the actual device being used.
If an employee’s personal laptop is infected with malware or another threat, any data downloaded onto it could be stolen. The malware doesn’t stop them from entering their passwords or passing an iris scan to log in to critical systems, which could then lead to a potential windfall for cyberattackers.
Privileged Access Management For High-Risk Operations
Because everyone’s work requires access to different types of sensitive resources, some users are considered higher risk than others. For instance, a marketing employee or a salesperson might need to access an email client and a couple of different apps to do their work, but a software engineer or an IT administrator will have much wider access to all kinds of systems, dramatically increasing the risk. In such situations, privileged access management, or PAM, is the way to go.
PAM is one of the most aggressive zero-trust solutions because of how it isolates and monitors users with administrative access to critical databases and systems. It relies on strict, policy-based protocols including credential vaulting, where access passwords to critical systems are stored in a secure repository, preventing the user from ever seeing it.
Just-in-Time access is another key component of PAM, where users are granted elevated permissions only as long as it takes to complete the task they’re trying to accomplish. Finally, most organizations will also implement session recording in order to document everything that the employee does while they’re logged into a specific system or app with privileged access. This gives security teams another way to track anomalies.
These kinds of measures provide strong mitigation against insider threats and prevent administrative credentials from falling into the wrong hands. They’re especially common among organizations hiring contractors. Should someone make malicious changes to the configuration settings of a critical app or delete a key database, their actions can easily be traced.
But the key limitation of PAM is its narrow focus. It creates too much friction for day-to-day business work, and it’s also resource-intensive, meaning higher costs. That’s why it’s usually only reserved for critical system access.
Zero Trust Network Access for Secure Connections
Identity verification cannot be the only failsafe in zero trust solutions. In addition to verifying users, organizations must secure the connection that links their device to the corporate network. Traditionally, the best way to do this was with a virtual private network, or VPN, that enables encryption for broad lateral access, but this can be risky for BYOD strategies. Many companies opt for a more nuanced approach called zero trust network access, or ZTNA.
ZTNA works by separating each application, so instead of giving a user permission to access the entire network, they’ll only be allowed to use a specific app through a secure point-to-point connection after authenticating themselves.
This means the device will not even see the rest of the network. Such an approach minimizes the attack surface, preventing hackers from moving laterally to access other applications and systems, reducing the impact of any security breaches.
Nonetheless, ZTNA is not foolproof, and once again, the main weakness lies with the user’s endpoint. The moment the user downloads information from an internal database or a platform like Workday or Salesforce, ZTNA loses the ability to protect that data. It’s no longer controlled by the organization, putting it at risk of theft or exposure if the device is not secure.
Secure Enclaves for Local Data Protection
The above zero trust solutions ensure tight control of users, connections, and administrative privileges, but enterprises must also consider how to nail down the actual devices that belong to their employees. The most efficient way to do this is to isolate corporate data that’s downloaded onto users’ hardware with the use of secure enclaves.
Secure enclaves are isolated and encrypted workspaces that can be created on third-party devices. They can be set up to ensure that whenever the owner logs in to get some work done, all of the business applications they access and data they download will run within this secure environment, which is kept separate from the rest of the machine and even the underlying operating system. They’re ideal for BYOD because with a secure enclave, companies only need to worry about their sensitive assets and not the device itself.
Within secure enclaves, corporate data is tightly controlled in order to prevent it from being copied or pasted into another folder on the user’s laptop, or exported to the cloud, or even printed out on paper. Isolation is enabled through cryptography, which prevents any malware that might be lurking elsewhere on the user’s laptop from accessing the secure enclave.
As an added benefit, it’s also possible for organizations to delete an entire secure enclave remotely in the event the employee’s device gets lost or stolen. The moment a thief powers on the stolen laptop, all of the sensitive information will be purged from the machine, and if the employee is lucky enough to be reunited with the device later, files like their personal photos and movies will still be there.
A Layered Approach to Zero Trust
Employee-owned devices must be treated with the utmost caution and considered a massive risk every time they’re used to log in to a corporate network. Safely enabling BYOD means implementing a layered strategy that uses multiple zero-trust solutions.
By using IAM to verify user identities, ZTNA to isolate individual applications and systems, and PAM for higher-level work, organizations can eliminate most of the chinks in their armor. Secure enclaves provide the final piece of the puzzle, ensuring that sensitive business data is protected from vulnerabilities within the user’s device that can easily evade other zero trust mechanisms.
No one said BYOD is easy, but the benefits of having employees work remotely from any device often outweigh the hassles of making sure every user, connection, administrator, and download is fully protected.
