100 likes | 110 Views
Explore the impact of consumer-originated technologies on enterprise security and discover how organizations can benefit from IT consumerization while managing risks.
E N D
Impact of IT Consumerisation on Enterprise Security Rajesh Thapar CISO YES Bank
IT Consumerization As per Gartner : “Consumerization is the specific impact that consumer-originated technologies can have on enterprises. It reflects how enterprises will be affected by, and can take advantage of, new technologies and models that originate and develop in the consumer space, rather than in the enterprise IT sector.” Usage of Technologies developed for Consumer’s personal use making pathway into enterprises. BYOD ? IT Consumerization is beyond “hardware” Its more than only a device…… Its about CONTROL
IT Consumerization : Characteristics It’s different than traditional Enterprise IT • Consumer’s Mobile Devices and applications • Public data networks • Organization cannot make rigid rules for IT interactions • Outside Perimeter and Parameters • Consumer driven IT
Factors driving IT Consumerization • Huge growth of personal computing devices • Social Media as tool for customer service improvements • Cloud based services • Workers are mobile • Users ask for instant gratification Benefits • Empowered Users • Improved Productivity • Lower Purchase and support costs
Impact of IT Consumerization • Increased User control… User freedom can lead to reputation damage • Corporate network extends to …….. • No standardization of Assets • Anytime… Anywhere access – Diminished contextual security • Rework Security policy • Enterprise data spread far and wide….monitor real time? • Increased number of systems attacking • How to manage upgrades and replacements? • Legal implications of data lost from consumer device. 3rd party data loss? • What is actual liability of employee owned devices for business? • Consumerization of software – more user friendly, adapt to user needs, real time collaboration with any device.
Security Concerns • Consumer owned devices which can’t support policies • Acceptance criteria and virtualized access • Data loss • MDM, DLP, DRM • Continuing check : compliant devices and settings • Visibility into device. Insulate if non compliant • Personal data segregation • Controls only on business data • Privacy protection • Disable location tracking unless lost device reported • Security policy as to how IT can or cannot use information collected.
Additional Controls • Device Registration and Strong authentication • Sandboxing / Containerization • Context and Content aware capabilities • Information Protection / Encryption • Remote wipe • Built in device controls • Which applications to allow • End user Awareness • Source code review • Malware protection • Protect against Jail broken / Rooted devices • Mobile Access Management (MAM)
“Can’t avoid IT consumerization ………..… Lets Accept it, plan to embrance it and capitalize the benefits it brings while balancing against the applicable risks.”
Rajesh Thapar YES Bank