Attacks Taxonomy On Bring Your Own Devices

Feasibility of BYOD scheme at Aztek

Question:

Discuss About The Attacks Taxonomy On Bring Your Own Devices?

Aztek has a large network of employees, customers, partners, vendors and stakeholders. The primary goal of the organization is to enhance its customer base by providing better, accurate and secure financial services along with the enhancements of revenues. BYOD will allow the use of employee-owned devices which will lead to better productivity of the employees and will assist in the achievement of the goals. The project is feasible from the organizational point of view.

The operations that will be carried out by the employees will be tracked and monitored using remote tracking and management. The employees will also be able to access the organizational tools and applications from their homes and outside of office premises to gain hands-on on the applications. This will lead to lesser occurrence of operational mistakes. The BYOD scheme will therefore be feasible from the operational point of view.

Technical tools and applications that are being used by the organization are compatible with most of the recent and widely used operating systems. These tools will be easily integrated with the devices of the employees. Also, the security department will install the necessary technical controls and applications for enhancing the security of the device. The project is feasible from the technical point of view.

There are no laws or regulations created by the Australian Government regarding the prevention of employee-owned devices in the offices. There are specific rules to financial industry that will be adhered during the project along with information privacy laws. The project is feasible from the political point of view as well.

There are many risks that have been identified from the security aspect in association with the BYOD scheme. These risks may emerge as the potential disadvantages for the project. However, it is possible to put a check on these risks and avoid them by using correct set of methods, plans, policies and controls.

There will be many advantages that will be offered with the implementation of BYOD in the organization. The first advantage would be in the form of reduced costs. The costs associated with the procurement of the devices, maintenance of the devices, infrastructural and operations costs will be reduced. The employees will be allowed to access most of the organizational tools and applications from any of the remote location which would enhance their operational excellence leading to better productivity and efficiency levels. The customers will also be satisfied as their demands will be met and the quality of services will also improve. This would lead to better revenues and market shares as well.

Operational and technical advantages of BYOD scheme

Aztek has decided to allow the employees to bring their personal devices at the workplace for the execution of professional tasks and activities.

The company is based out of Australia and the country does not have any specific laws in place for the governance and surveillance of the employees making use of any form of application or service outsourcing. However, the specific business domains do have certain rules and regulations defined. The business domain and functional area for Aztek is finance. There are two primary jurisdiction areas in Australia that is, New South Wales and Australian Capital Territory.  The use and application of the electronic communication and networking varies in these areas which shall be followed by Aztek as per the service territory.

Australian Securities and Investment Commission (ASIC) is a government body that regulates all the financial transactions and services at the federal, state and territory levels. There are laws that have been set up under this body for the regulation of electronic payments under the e-payments code and for the financial access control and management as well. These laws and guidelines shall be followed (Asic, 2017).

BYOD scheme would allow the employees to make use of their devices for the organizational activities outside of the office premises as well. NSW is an Act that has been defined for the surveillance of the employee activities and processes beyond the office premises. The communication and operational activities will be tracked on the employee device under this act and there would be restriction on the sharing of information with the resources outside of the office or a particular project. Aztek may also make use of overt surveillance which would involve automated software for the purpose of tracking. In this case, the employees must be told about the same 14 days prior to the conduction process.

The employees may also exchange emails and messages using their devices which may include financial information and details. Workplace Privacy Act 2011 has been defined by the Australian government for the email surveillance and tracking. The data that will be exchanged by the employees on their mail servers will be monitored by Aztek as per the rules of this act (Act, 2016).

Telecommunications Act 1979 has also been defined by the Australian Government to cover the permissions that are associated with communication interception. It has been established to ensure the integrity of the communications so that any of the unknown communications do not take place. This act only covers the content tracking and does not include the tracking of email address or metadata (Coe, 2011).

Political feasibility of BYOD scheme

The financial information that will be processed and managed by the devices of the employees under the BYOD scheme would also be required to abide by the rules under Intellectual Property and information privacy. The privacy and security of the information will be maintained under these laws and regulations.

Privacy Act (APP 5) has also been defined for the maintenance and management of the information privacy. The devices of the employees must not store or process the personal information of other employees or the customers of Aztek. The access rules and the user privileges shall also be defined for the purpose of information access. In case of a data breach, the employees must be aware of the process that they must follow for reporting the matter to the senior management (Oaic, 2014).

There are a number of security postures and policies that must be considered and modified in association with Aztek with the introduction of BYOD scheme. It would include the current state of security in the organization, use of mobile devices currently in use along with the future use of the devices, geographical strategies that shall be followed for the deployment of the project.

The finance industries that are present in a particular country need to abide by certain rules and regulations at the federal and state level along with the territory and industry level. Such financial constraints and necessities have been discussed in the section above. In case of Aztek, another area of concern that shall be monitored and handled is the security of the devices, information and networks. There are certain weaknesses in the current security state of Aztek which are included as follows:

• There are numerous obsolete devices and security mechanisms that are being used in the organization. For instance, there are many of the computer systems and gadgets that are in use which are more than 5 years old. Some of these systems cannot be updated as per the latest technological concepts and security frameworks. These systems and components shall be removed and replaced by the newer systems.
• The use of identity and access control is Aztek is still restricted to the magnetic card readers and identification. There are newer forms of controls that can be used for this purpose, such as biometric recognition.
• There is an excessive use of in-house storage and management of the information that is associated with the organization. The file servers and database servers are also located in-house which makes it a single point of failure. In case the attacker succeeds in gaining access to these locations, then the security breach would be huge.
• The legacy systems that are being used by Aztek are also technically not sound and need a lot many updates to be done.

The security loopholes that have been identified above will require a lot of investment to be done to make sure that the security infrastructure is improved. With the use of the BYOD scheme, there will be many devices that will be brought by the employees in the organization and the need to procure additional set of devices will not be required. However, this scheme will have its own security risks and concerns.

In the organizations that have a single vendor or manufacturer of the devices, it is easy to control the security status through unified management. There is a single set of security control and checks that need to be implemented to attain overall security of the devices.

However, in the case of outsourcing, the security policies and plans that are required to be followed are different. The employees in this case will bring their own devices to the organization which will have different security framework, different operating systems, different data and information capabilities etc. There is no uniform security scheme that can be designed and implemented so that the overall security of all the devices is ensured. The device portfolio will also expand with the BYOD scheme with the inclusion of Smartphones, laptops, tablets etc. from different sources. The current security policy will therefore require many updates to be done and installed (Curran, Maynes and Harkin, 2015).

Risks associated with BYOD scheme

The approach such as locking down of the devices outside of the company networks would not work as the devices are personally owned by the employees and the practice would discourage them to adapt to the BYOD scheme. A flexible approach which is also secure would be required for the management of the risks. The use of access control on the official applications that include critical and sensitive information can be done outside of the office network (Gillies, 2016).

There are many risks that are associated with the device itself. For instance, the device of the employee may get lost or may get stolen by an entity that may get access to the organizational information if the device would be connected to the VPN. The confidential information would then get exposed to such unauthorized entities and for this device tracking and security would be of utmost importance.

There may also be ownership issues that may crop up. The employees will be the owners of their devices and would like to have a complete ownership on their data and information. They may attempt to jailbreak the devices which may have an extremely negative impact on the device security. The terms and conditions under the BYOD scheme shall therefore be clearly explained to the employees before they agree to bring their devices at the workplace (Tokuyoshi, 2013).

There are also certain basic mechanisms that can be used for the protection of the devices and the information present in these devices.

• The security team must investigate the devices to highlight the alignment with the security policies of Aztek.
• Mobile device management must be carried out by the team of the auditors and reviewers.
• Device encryption, remote wiping and the use of PIN codes shall be done for device and information security.
• The use of certified software and critical information sets must be restricted on the office networks only (Beckett, 2014).

With the use of BYOD scheme, there can be two categories of application specific risks that may be observed. These risks include the malware attacks through the applications that are installed which would demand the highest level of malware protection. There may also be exploitation of the security vulnerabilities present in the application which may lead to the compromise of the security of sensitive and confidential information.  Enhanced application management will be necessary for this purpose so that such risks are avoided and controlled (Romer, 2014).

There shall also be upgrades and security updates that must be installed in the devices and for the applications that are present in the devices to make sure that the security risks specific to device version or application version are avoided.

The Cybersecurity framework that is followed in this case is based upon the flexible and high performance mechanisms that can be used for the enhancement of the security posture in an organization.

Security concerns with BYOD scheme

The core of the framework includes the definitions for the functions along with the categories and sub-categories along with the references that come under the security checklist. The set of functions comprise of the risk identification, asset protection, incident identification, planning of the responses along with the recovery of the data. There are different categories that are used including asset management and control, access management and control, detection and prevention systems. The information security mechanisms against the security risks that are defined have been done for the information in transition along with the information at rest.

There are different tiers to security that Aztek must follow and consider and it must be ensured that the security state must move towards the highest tier.

• Tier 1 is the state in which there is a partial protection of the organizational assets and the processes are defined but not formalized in association with security.
• Tier 2 is the state in which the risks have been identified and a formal procedure for the management of the risks has also been created.
• Tier 3 is the state in which the management approves of the protection and security measures that must be used. There is a use of consistent methods in this case.
• Tier 4 is the state that includes adaptive risk management to make sure that the organization is efficient to handle the changing threat landscape.

In case of Aztek, the BYOD scheme will bring with it a lot many new challenges and issues. The employees of an organization may also change and there may be new devices that may be added in the set of devices to be managed by the organization. There will be a continuous change in the threat landscape and therefore, the risk assessment process that is followed in this case shall be in tier-4 (Singh et al., 2014).

An analysis of the threats and vulnerabilities has been done in association with the BYOD scheme and the results have been summarized in the table below.

Risk Name	Risk Impact (1 to 5 with 5 being highest)	Risk Probability (1 to 5 with 5 being highest)	Risk Rank (Impact x Probability)	Suggested Response Strategy
Information Breach	5	4	20	Risk avoidance
Information Leakage	4	4	16	Risk avoidance
Information Loss	4	4	16	Risk avoidance
Lost/Stolen Devices	5	2	10	Risk mitigation
Insider Threats	5	4	20	Risk transfer
Man in the Middle Attacks	3	3	9	Risk avoidance
Spoofing Attacks	4	3	12	Risk avoidance
Application and System Vulnerabilities	3	4	12	Risk avoidance
Hacking of the APIs	3	3	9	Risk mitigation
Denial of Service Attacks	4	3	12	Risk avoidance
Malware Attacks	3	5	15	Risk avoidance
Phishing Attacks	4	3	12	Risk mitigation
Eavesdropping Attacks	3	4	12	Risk avoidance
Social Engineering Attacks	5	4	20	Risk mitigation

Table 1: Risk Register

There are several countermeasures and security programmes used to make sure that the risks that have been assessed above are handled carefully.

• Aztek must define the scope, objectives and the set of goals in association with outsourcing the use of BYOD scheme. These definitions must be based upon the security aspect and must consider the use of devices in the office premises along with the outside networks as well.
• The next step shall include the prioritization of the risk handling and the implementation of the treatment strategies. These shall include the treatment of the risks with higher impacts in the first phase followed by the treatment of the risks that may have a low probability and impact (Kumar and Singh, 2015).
• There would also be risks that may have an impact on the specific information sets and categories. The risks that may have an impact on the sensitive and critical data sets must be identified and the mapping response strategies shall be created. These risks shall be handled at the top priority.

Once the initial round of planning and analysis is completed, there shall be mapping on the type of the countermeasure that shall be applied. For example, there are certain risks that can be controlled and avoided by using administrative checks only while there are a few risks that may demand a technical tool and application for the avoidance and management of the risk (Stoecklin et al., 2016).

There are several countermeasures that have been developed which can be applied in order to overcome, avoid, prevent, detect and control the security risks that are associated with the decision of Aztek to provide the employees with the permission to bring their devices at work.

• Preventive Controls: These are the control measures that shall make sure that the occurrence of security risks does not take place by using mechanisms like advanced access control and authentication. Also, the setting up of firewalls and proxy servers would come under this category. These controls form the basic approach towards the maintenance and management of security.
• Detective Controls: There may be cases when the preventive controls may fail and the malevolent entities may succeed in violating the access or basic security measures. In such cases, these controls shall be applied which shall highlight the activities of the attackers by making use of integrity checks, security logs and audits along with intrusion detection tools.
• Corrective Controls: There are advanced methods that are used by the attackers to give shape to the security attacks. They may succeed in passing through the preventive and detective controls. The corrective controls are the ones that shall be used for the control and minimization of the damage. The use of encryption is one of the examples of such controls which would protect the information even if it gets exposed to the attackers (Blizzard, 2015).
• Deterrent Controls: The attackers must be made aware of the readiness of the organization to deal with the security risks and attacks. These controls are the measures that send across this message by using advanced network monitoring and maintenance of the network and security logs.
• Recovery Controls: There are security controls that have been set up with the purpose of disaster recovery. These controls are similar to the corrective controls but are applied in more significant damages and impacts. There are various attempts that the organization must make so that the continuity of the business operations is maintained and the backup of the data is also created and updated at the regular intervals.
• Compensating Controls: There may be cases when the required security control may take time to be developed and implemented. In such cases, the security of the application, service, system or device shall be maintained by using an alternative measure, such as use of patches in case of security updates or installations.

Data is one of the biggest assets for Aztek as it is the case with every other organization and there are various measures that may be used and implemented for making sure that the risks associated with the data and information are avoided. Some of these measures include access control, incident recording and resolution, privacy standards, codes of conduct, use of social media, encryption techniques, anti-denial and anti-malware tools etc. These may also include the employee and user awareness along with training sessions on the security practices to be followed.

Weaknesses in the current security state of Aztek

In case of the BYOD scheme, the probability and the types of probable risks increase as there are different access points that may be used for giving shape to the attack. The attack surface would increase along with the attack window. Aztek would be required to make use of end-to-end data protection techniques to make sure that the security risks and attacks are avoided. The mismanagement of the devices that will be owned by the employees may be the biggest contributor in the occurrence of the data security attacks and risks. There must be policies that must be created for data protection in case of employee resignation and transfer. The tools, applications and information present in the device of the employee shall be allowed to be remotely wiped out and a cross examination of the same shall also be carried out.

There can be severe implications in terms of financial and legal obligations that may be caused with a weak data security. There are certain measures that must be used to avoid the same.

• There shall be advanced log maintenance maintained in the organization in terms of the device activity in Aztek and the employee activity on the devices and applications.
• The company must take up the responsibility of managing the user passwords and PIN codes. In case of default passwords and PIN codes usage, there are various security vulnerabilities that come up. There shall be use of automated password managers along with the alerts on password change at frequent intervals. The use of common passwords like name, DOB etc. shall be avoided.
• The critical applications associated with Aztek must be installed in the devices owned by the employees but shall be accessible only when the device is connected to the corporate network.
• The employees must be provided with the training session on the security practices that they must use along with the common security mistakes that take place which shall be avoided.

There is a lot of data that is managed by Aztek that belongs to different categories and may have different security requirements. The following table defines the data classification and the corresponding security strategies that shall be applied.

Type of Data	Information included under this classification	Damage to the Information Sets in case of security attack	Security strategy to be used
Highly sensitive data	Social security numbers of the employees and customers, PIN codes and passwords to access the bank accounts	In case of a security risk or an attack to this type of information, there may be legal or financial obligations that the organization may have to face in terms of legal punishments or financial penalties	The highest form of security shall be applied to protect this information. Only the CEO and CIO of the organization shall be allowed to access this data category and there shall be no modifications allowed by any entity (Morrow, 2012).
Sensitive and Confidential Internal Data	Contract information with the third part vendors, details of the projects taken up by the organization	The reputation of the organization in the market may suffer as the customers will not be able to invest their trust in the organization and the competitors may gain advantage of the disclosed information (Yoo, Park and Kim, 2012)	The administrative and technical controls must be used to protect this category of information. There shall also be physical controls set up with data access provided only to the CEO, CIO, Data administrator and Security Manager.
Private Data	Internal organizational charts, communication mechanisms, project methodologies and approaches	There may be negative implication in terms of the stakeholder engagement as the internal details of the organization will be revealed in public	The administrative and technical controls must be used to protect this category of information. There shall also be physical controls set up with data access provided only to the CEO, CIO, and Data administrator, Security Manager, Security Analyst, Stakeholders and Data Scientists.
Public Data	Solutions provided by the organization, list of products offered, names of popular clients	The data shall be disclosed only as intended by the management of the organization. In case of the early disclosure, there may be negative implications in terms of the competitive advantage to the other entities in the market	The information shall be protected by using the security controls and mechanisms and the stakeholders shall be able to view the information with modifications to be applied only by the data administrator.

Table 2: Data Classification & Security Analysis

Conclusion

The management and administration at Aztek has decided to implement the Bring Your Own Devices (BYOD) project.

 BYOD scheme would allow the employees to make use of their devices for the organizational activities outside of the office premises as well. The finance industries that are present in a particular country need to abide by certain rules and regulations at the federal and state level along with the territory and industry level. Such financial constraints and necessities shall be followed by Aztek in the implementation of BYOD, such as adherence to ASIC guidelines, Intellectual Properties laws etc. The device portfolio will also expand with the BYOD scheme with the inclusion of Smartphones, laptops, tablets etc. from different sources. The current security policy followed at Aztek will require many updates to be done and installed.  There may be risks to the devices, information in the devices, applications, systems and databases. There shall be upgrades and security updates that must be installed in the devices and for the applications that are present in the devices to make sure that the security risks specific to device version or application version are avoided. There shall be use and implementation of advanced security plans with controls such as preventive, detective, corrective, deterrent, recovery and compensatory controls. For the protection and safety of data, measures like access control, incident recording and resolution, privacy standards, codes of conduct, use of social media, encryption techniques, anti-denial and anti-malware tools etc. shall be used. These may also include the employee and user awareness along with training sessions on the security practices to be followed.

References

Act (2016). Workplace Privacy Act 2011. [online] Available at: https://www.legislation.act.gov.au/a/2011-4/current/pdf/2011-4.pdf [Accessed 26 Sep. 2017].

Asic (2017). ASIC Home | ASIC – Australian Securities and Investments Commission. [online] Asic.gov.au. Available at: https://asic.gov.au/ [Accessed 26 Sep. 2017].

Beckett, P. (2014). BYOD – popular and problematic. Network Security, 2014(9), pp.7-9.

Blizzard, S. (2015). Coming full circle: are there benefits to BYOD?. Computer Fraud & Security, 2015(2), pp.18-20.

Coe (2011). Telecommunications (Interception and Access) Act 1979. [online] Rm.coe.int. Available at: https://rm.coe.int/1680304330 [Accessed 26 Sep. 2017].

Curran, K., Maynes, V. and Harkin, D. (2015). Mobile device security. International Journal of Information and Computer Security, 7(1), p.1.

Gillies, C. (2016). To BYOD or not to BYOD: factors affecting academic acceptance of student mobile devices in the classroom. Research in Learning Technology, 24(1), p.30357.

Kumar, R. and Singh, H. (2015). A Proactive Procedure to Mitigate the BYOD Risks on the Security of an Information System. ACM SIGSOFT Software Engineering Notes, 40(1), pp.1-4.

Morrow, B. (2012). BYOD security challenges: control and protect your most sensitive data. Network Security, 2012(12), pp.5-8.

Oaic (2014). Chapter 5: APP 5 — Notification of the collection of personal information| Office of the Australian Information Commissioner – OAIC. [online] Oaic.gov.au. Available at: https://www.oaic.gov.au/agencies-and-organisations/app-guidelines/chapter-5-app-5-notification-of-the-collection-of-personal-information [Accessed 26 Sep. 2017].

Romer, H. (2014). Best practices for BYOD security. Computer Fraud & Security, 2014(1), pp.13-15.

Singh, M., Sin Siang, S., Ying San, O., Hassain Malim, N. and Mohd Shariff, A. (2014). Security Attacks Taxonomy on Bring Your Own Devices (BYOD) Model. International Journal of Mobile Network Communications & Telematics, 4(5), pp.1-17.

Stoecklin, M., Singh, K., Koved, L., Hu, X., Chari, S., Rao, J., Cheng, P., Christodorescu, M., Sailer, R. and Schales, D. (2016). Passive security intelligence to analyze the security risks of mobile/BYOD activities. IBM Journal of Research and Development, 60(4), pp.9:1-9:13.

Tokuyoshi, B. (2013). The security implications of BYOD. Network Security, 2013(4), pp.12-13.

Yoo, S., Park, K. and Kim, J. (2012). Confidential information protection system for mobile devices. Security and Communication Networks, 5(12), pp.1452-1461.