BYOD Security and Privacy Concerns

This assignment delves into the multifaceted implications of Bring Your Own Device (BYOD) policies within organizational settings. It examines the inherent security and privacy concerns associated with employees utilizing personal devices for work purposes. The analysis draws upon a collection of research papers, reports, and expert opinions to shed light on the risks and benefits of BYOD adoption. Key topics covered include data protection, malware vulnerabilities, network security, legal compliance, and employee awareness.

Running head: RISK ASSESSMENT1
AztekIT Risk Assessment- Personal Devices
Name
Institutional Affiliation
Date

RISK ASSESSMENT 2
Executive Summary
Among the major challenges that the ICT management team face in today's technological
ageis mostly related to their Bring-Your-Own-Device (BYOD) policies. BYOD refers to policies
that stipulate the rules and regulations governing the employees’ access to an organization’s IT
resources using their devices such as laptops, smartphones, or tablets (Miller, Voas & Hurlburt,
2012).The BYOD challenge is consequent of consumerization of IT whereby information
technologies emerge in the consumer way before organizations or even governments adopt the
technologies (Thompson, 2012). The result of this concept is a workforce with new, better, and
improved technology as compared to their organization’s technology framework (Scarfo, 2012).
Furthermore, most employees tend to work during their free time and do their personal stuff
during working hours.
Several risks may arise from allowing personal devices in Aztek’s work environment.
These risks include the reduced system security assurance by Aztek management, difficulty in
distinguishing between thepersonal and work-related use of these devices, risk of unsecured use
of sensitive information, and the likelihood of these devices getting lost or being stolen along
with the organization’s sensitive information (Morrow, 2012). Adopting a BYOD policy will
also have implications on Aztek’s personnel resources budget, their legal liability, and
compliance regulations. To mitigate these risks, Aztek must enforce policies outlining term of
use and regulatory grounds for device permits.
In addition to outlining the employees’ IT interaction behavior, Aztek should enforce
technical risk controls to identify any policy violations. Only devices shortlisted and approved by

RISK ASSESSMENT 3
Aztek management will be permitted to access or store the organization’s sensitive information.
These devices will be monitored using the technical risk controls. Thesecontrols include flagging
and preventing unapproved applications from executing and accessing sensitive data, limiting
employees’ ability to use modified devices that grant them administrativeprivilege, and the
prompt patching of systems (Zahadat et al., 2015). Alternatively, the management of Aztek may
provide their employees with approved personal devices while retaining legal ownership of the
same. These measures aim to mitigate the various risks that Aztek faces from the adoption of a
BYOD policy. However, the management team must determine the effectiveness of these
controls in managingtherisks.
Pillay et al. (2013) notes that aside from the risks involved, a BYOD policy presents a
wide range of benefits to both the organization and its employees. The policy allows the
continuity of business activities outside the office in the occurrence of a power outage, natural
calamities, or even transport complications. With the flexibility facilitated by a BYOD policy,
employees of Aztek can achieve a work-life balance in their professional and personal activities
(Mitrovic et al., 2014). Furthermore, skilled employees who cannot relocate to Aztek facilities
can still be recruited and perform their respective duties.Employees will be satisfied with their
jobs hence improving retention and recruitment of staff. Implementation of the policy will also
be beneficial to the environment in terms of transportation and use of paper. With the advent of
consumerization, emerging technologies will enable employees of Aztek to innovate and find
better and efficient ways to carry out their daily work activities. Aztek will benefit financially as
a result of reduced technological hardware costs. This policy will ultimately improve the general
productivity, efficiency, and service delivery of Aztek. This risk assessment report aims to
analyze the risks emerging from adopting a BYOB policy in Aztek, the relevant control

RISK ASSESSMENT 4
measures, and potential benefits. The purpose of this assessment is to assist management and
stakeholders in their making process on the implications of a Bring Your Own Device policy to
Aztek and how it supports the business structure of the organization.

RISK ASSESSMENT 5
Table of Contents
Executive Summary.....................................................................................................................................2
Project Review...........................................................................................................................................5
Develop a BYOD strategy.....................................................................................................................6
Existing BYOD framework...................................................................................................................6
Legislations and Regulations................................................................................................................7
Communicating the Organization’s Policy..........................................................................................7
Technical Support.................................................................................................................................8
Financial Support..................................................................................................................................8
Impact of the BYOD Project on Security................................................................................................8
Risk Assessment.......................................................................................................................................10
Devices selected....................................................................................................................................11
Malicious Programs.............................................................................................................................11
User Engagement.................................................................................................................................11
Unauthorized Access...........................................................................................................................12
Sensitive Data Exposure......................................................................................................................12
Loss of Devices.....................................................................................................................................12
Informational Integrity.......................................................................................................................13
Data Flow and Security...........................................................................................................................13
References.................................................................................................................................................14

RISK ASSESSMENT 6
Project Review
Before implementing a BYOD policy, Aztek must carefully scrutinize both the business
and security implications of the project. This policyis regulated by various legislative measures
and controls described in the Freedom of Information Act 1982, Archives Act 1983, and also the
Privacy Act 1988. These regulations govern the BYOD implementation criteria in an
organizationand the relevant legal control measure to oversee the policy. These legislative
regulations were necessary due to the liability risks emerging from adopting a BYOD policy in
an organization. To ensure thesuccess of the BYOD project, the ICT management team of Aztek
must develop a BYOD strategy, determine the implications of the project on any potentially
existing BYOD, identify related legislation and regulations, communicate the organization’s
BYOD policies, and the relevant financial and technical support measures.
Develop a BYOD strategy
In order to successfully implement a BYOD strategy that compliments the business
structure of Aztek, it is crucial to carefully formulatea strategy that is tailored to the needs and
activities of Aztek. A strategy is importantso as to clearly analyze the risks involved and the
appropriate measures (Ghosh, Gajar & Rai, 2013). The absence of a strategy might create a
situation whereby BYOD policies are employee driven.
To developing a BYOD strategy for Aztek, the ICT team under the guidance of the
management will conduct a pilot trial of a few employees in a low-risk section of Aztek. A
review of the pilot trial using clearly defined success measures will provide Aztek management
with an overview ofthe project’s security implications, its cost-benefit relevance, and the impact
on Aztek’s business activities.

RISK ASSESSMENT 7
Existing BYOD framework
In today's technological culture, it is likely that there exists an authorized or unauthorized
BYOD framework in any organization. Aztek must first determine the possible BYOD
existingprior to the implementation of the strategy. This information can be obtained from
Aztek’s employees and other relevant stakeholders. A review of the organization’s assigned
devices can also help in mapping out the existing framework and implement the new strategy in
a complementary manner.
Legislations and Regulations
According to the Information Security Manual (ISM) by the Australian government, it is
important for any organization to seek legal advice before allowing employees to access the
organization’s systems using their personal devices so as to carefully understand the legal issues
and liabilities imposed by a BYOD strategy.
Communicating the Organization’s Policy
Aztek must carefully determine how to implement the policy in a manner that will
facilitate employees’ compliance and support. Among the most effective ways ensure user
compliance is by involving all relevant stakeholders in developing and implementing the BYOD
policies (Lebek, Degirmenci & Breitner, 2013). This will ensurea policy that is complementaryto
the business and workforce structure of Aztek, employee motivation, and that the needs of all
affected parties are met. The management of Aztek can alternatively offer BYOD as an optional
strategy rather than mandatory.In order to ensure full awareness, the policy must be
communicated to all departments, employees, and stakeholders. The policy must clearly
highlight the authorized devices, the organizational data that they are permitted to access,

RISK ASSESSMENT 8
authorized applications and software, storage and distribution regulations, non-compliance
repercussions, and the controls that the managementis obligated to enforced to ensure the success
of the BYOD strategy. To ensure the compliance of all employees and to prevent legal liabilities,
the employees of Aztek will be required to sign an Acceptable Use Policy that stipulates their
authorized behavior and consequent repercussions of any violationsof the policy.
Technical Support
In developing a BYOD strategy, it is necessary for Aztek to determine the technical
support implications of the strategy. A BYOB strategy would result in awide variety of personal
devices with different operating systems, manufacturers, configuration settings, and electrical
layouts. It would, therefore, be ineffective to assign Aztek’s IT support desk with the
responsibility of managing the devices. Possible solutions for Aztek include issuing a list of
approved devices or providing basic technical training to the employees.
Financial Support
The main aim organizational goal of Aztek is to ensure shareholders’ wealth
maximization and making profits. It is therefore important to consider the financial implications
of a BYOD strategy before its implementation (Seigneur et al., 2013).This includes concerns
about expenses from internet and connectivity while at Aztek or outside the office, personal
devices provided by Aztek, and the relevance of these expenses in helping accomplish Aztek’s
organizational goal.All this will be dependent on Aztek’s budget, financial resources, and
necessity of the BYOD strategy to the organization.

RISK ASSESSMENT 9
Impact of the BYOD Project on Security
In today’s modern environment, it is challenging for any organization to adapt. This
challenge is especially crucial to financial service organizations such as Aztek. Financial service
institutions face high data security risk and management obligations. The situation is worsened
by the increased level of competition among financial service organizations (Gustav & Kabanda,
2016). These institutions manage the sensitive financial information of their many clients.
Implementing a BYOD strategy, therefore, imposes a huge risk on Aztek and other financial
service institutions. The security of the customer’s sensitive financial information is put at risk of
loss or even malicious manipulation when employees are authorized toaccess to this information
from their personal devices. The management of financial institutions is often faced with a
dilemma of improving the customers’ security and meeting the auditor’s requirements on the one
hand and increasing organizational efficiency and customer relationson the other hand
(Vijayan,& Hardy, 2015).
To mitigate the security risks as a result of a BYOD strategy, Aztek can specifically
assign authorized devices to a regulated number of reliableemployees. By controlling the specific
business and employees, Aztek can ensure security and efficiency of its financial services. With
the continuously growing number of mobile devices, it is important for financial institutions to
implement BYOD policies that are complementary to the organizations. This is particularly
crucial for financial institutions in the modern age. A survey by IDC revealed that a huge number
of financial institutionsare exposed to risk related to employees’ personal devices (Burt, 2014).
The institutions do not have relevant strategies and policies to govern the use of mobile devices,
applications, and mobile security concerns for their employees.

RISK ASSESSMENT 10
In order to address the security concern, Aztek must first evaluate the impact of a BYOD
strategy on the organizational goal of wealth maximization. The organization should then
formulate efficient methods to govern employees’ personal device use, authorized data and
content, applications’ compliance, privacy, and general security. In addition to enforcing these
policies, Aztek may consider seeking the professional servicesof solution providers such as
AT&T and the likes. These solution providers are specialized in providing BYOD solution,
formulation of policies, risk assessment, and control measures to assist in the management of the
policies.
It is important to realize that technological evolution is inevitable(Guan, 2012). Aztek
should, therefore, strive to leverage the advances in technology to its own benefit.This can be
achieved by carefully planning a BYOD strategy under the current of future advances in devices,
mobile networking, and application management. The need for the management team to
implement a robust BYOD strategy is further emphasized by the financial data risks faced by
Aztek.
Although BYOD presents many opportunities and benefits to an Aztek, it also exposes
the organization to various security threats and risk as outlined above. Studies have shown that
most breaches on the securityframework of organizations are adirect result of using personal
devices to access the organizations’ sensitive data(Keyes, 2013). Therefore, Aztek must enforce
appropriate measures to maintain integrity and confidentiality,ensure compliance by the
employees, manage the security risk, and preserve the availability of sensitive data in a secure
manner. Some information when placedin the wrong hands may cause substantial damage to the
organizations, client’s image, operational complications, and even financial loss.

RISK ASSESSMENT 11
Risk Assessment
Aztek faces various vulnerabilities, threats, and consequences of a BYOD strategy. This
report will analyze the risks based on the devices selected for the BYOD strategy, potential
malicious programs or applications, insecure user engagement, unauthorized access, sensitive
data exposure, loss of BYOD devices, and the loss of informational integrity.
Devices selected
The first thing for Aztek to consider in the risk assessment are the personal devices that
the organization will authorize to access Aztek’s sensitive information (Suby, 2013). This
assessment will include the device manufacturers, operating system platforms, and security
features in the respective devices. Aztek’s assessment team must also determine the security
threats imposed by each of these devices. Information on the merits and demerits of all
authorized devices should be availed to the employees along with strategies to cope with any
security issues that may arise as a result of the devices (Watkins, 2014).
Malicious Programs
There are a wide variety of malicious applications designed to steal, modify, or sniff
sensitive information. As users interact with their devices, they often tend to customize the
devices or access the internet for work-related and personal use. This exposes their devices to an
attack by malicious programs that may access the sensitive organizational information in those
devices (Chin et al., 2011). A risk assessment is, therefore, necessary to determine possible
infection avenues and ways of tackling the risk. Aztek may consider limiting application
downloads to only trusted and authorized markets, ensure installation of malware prevention

RISK ASSESSMENT 12
programs, and sensitive the users on the security threats, mitigation procedures and ways to
avoid infection (Felt et al., 2011).
User Engagement
Risk arises based on the operational behavior of employees as they interact with their
personaldevices (Mansfield-Devine, 2012). Insecure behavior may expose the devices to
malware attacks or inadvertent leakage of sensitive information (Ballagas et al., 2004). Aztek is
especially vulnerable due to the sensitivity of the financial services it offers. This risk assessment
aims to determine the employees’ level of competency in handling sensitive organizational data
from their personal devices.
Unauthorized Access
BYOD poses a major threat to Aztek’s information as a result of unauthorized access.
Unlike organizational devices which are safely protected and managed by Aztek’s security team,
the security of personal devices, especially outside the office, is solelyto the user (Keyes, 2013).
This poses the risk that an unauthorized third party may obtain access to the devices and Aztek’s
sensitive data. Employees must be sensitized on security measure to prevent unauthorized
access.
Sensitive Data Exposure
Under a BYOD strategy, employees can access and distributeAztek’s information from
multi-points and in different locations. This exposes the information of this financial institution
to manipulation and unauthorized use. The variety of devices also complicates the process of

RISK ASSESSMENT 13
controlling data access and applying security measure to monitor the access, use, and distribution
of Aztek’s sensitive information.
Loss of Devices
It is easy for employees to lose devices containing sensitive information. The devices
might contain financial information, private documents,sensitive emails among others. Such
information when used maliciously may damage Aztek reputation and its clients. Sincea
misplaced device exposes Aztek to various critical risks, appropriate measures to manage the
vulnerability should be put in place. Aztek may introduce tools to manage all personal devices
remotely (Oppliger, 2011). With these tools, the IT team should have the relevant access to
remotely lock lost devices or even wipe them clean if the need arises.
Informational Integrity
A defining characteristic of any BYOD strategy is the seamless integration of work and
personal environments (Song, 2014). As the users interact with their personal devices on both
environments, they expose Aztek to the loss of data integrity. A user may alter crucial
information by mistake while interacting with the devices for personal use. It is therefore
important for Aztek’s management and ICT team to provide security measures to avoid
accidental alteration of Aztek’s information.
Data Flow and Security
The final part of this report analyzes the data flow and security risk of implementing a
BYOD strategy.BYOB poses a privacy concern to Aztek. While in the process of obtaining
work-related information from a personal device, it’s likely that the organization may

RISK ASSESSMENT 14
accidentallyobtainthe user’s personal information (Garba et al., 2015).The Australian
government has set out rules and regulations governing how organizations can store their clients’
sensitive information such as bank account details, social security numbers, driver’s license
among others (Downer & Bhattacharya, 2015). Aztek must, therefore, determine how these
regulations affect their BYOD strategy. The organization must determine the legally authorized
information that its employees can store on their personal devices. Employees must likewise be
sensitized on the governing laws and prohibited by way of a written agreement from storing such
information.There also exists laws that require financial institutions to securely destroy or
encrypt sensitive information regarding their customers such as financial reports or medical
records (Moyer, 2013).
In conclusion, a Bring-Your-Own-Device (BYOD) strategy bring various benefits and
opportunities that will help Aztek achieve its organizational goal. The opportunity,
however,presents the organization with various security and privacy risk. The Aztek must ensure
compliance with all relevant laws regulating the financial services sector.The evolution of
technology has facilitated a trend whereby privacy legislationisbeing developed and enforced
continuously (French, Guo & Shim, 2014). Aztek must be alert to amendments and new laws as
we implement the BYOD strategy.

RISK ASSESSMENT 15
References
Ballagas, R., Rohs, M., Sheridan, J. G., & Borchers, J. (2004, September). Byod: Bring your own
device. In Proceedings of the Workshop on Ubiquitous Display Environments,
Ubicomp (Vol. 2004).
Burt, J. (2011). BYOD trend pressures corporate networks. eweek, 28(14), 30-31.
Chin, E., Felt, A. P., Greenwood, K., & Wagner, D. (2011, June). Analyzing inter-application
communication in Android. In Proceedings of the 9th international conference on Mobile
systems, applications, and services (pp. 239-252). ACM.
Downer, K., & Bhattacharya, M. (2015, December). BYOD security: A new business challenge.
In Smart City/SocialCom/SustainCom (SmartCity), 2015 IEEE International Conference
on (pp. 1128-1133). IEEE.
Felt, A. P., Chin, E., Hanna, S., Song, D., & Wagner, D. (2011, October). Android permissions
demystified. In Proceedings of the 18th ACM conference on Computer and
communications security(pp. 627-638). ACM.
French, A. M., Guo, C., & Shim, J. P. (2014). Current Status, Issues, and Future of Bring Your
Own Device (BYOD). CAIS, 35, 10.
Garba, A. B., Armarego, J., Murray, D., & Kenworthy, W. (2015). Review of the information
security and privacy challenges in Bring Your Own Device (BYOD)
environments. Journal of Information privacy and security, 11(1), 38-54.

RISK ASSESSMENT 16
Ghosh, A., Gajar, P. K., & Rai, S. (2013). Bring your own device (BYOD): Security risks and
mitigating strategies. Journal of Global Research in Computer Science, 4(4), 62-70.
Guan, L. (2012). Established BYOD management policies needed. Government News, 32(2), 9.
Gustav, A., & Kabanda, S. (2016). BYOD adoption concerns in the South African financial
institution sector. In CONF-IRM (p. 59).
French, A. M., Guo, C., & Shim, J. P. (2014). Current Status, Issues, and Future of Bring Your
Own Device (BYOD). CAIS, 35, 10.
Keyes, J. (2013). Bring your own devices (BYOD) survival guide. CRC press.
Lebek, B., Degirmenci, K., & Breitner, M. H. (2013). Investigating the influence of security,
privacy, and legal concerns on employees' intention to use BYOD mobile devices.
Mansfield-Devine, S. (2012). Interview: BYOD and the enterprise network. Computer fraud &
security, 2012(4), 14-17.
Miller, K. W., Voas, J., & Hurlburt, G. F. (2012). BYOD: Security and privacy considerations. It
Professional, 14(5), 53-55.
Mitrovic, Z., Veljkovic, I., Whyte, G., & Thompson, K. (2014, November). Introducing BYOD
in an organisation: the risk and customer services view points. In The 1st Namibia
Customer Service Awards & Conference (pp. 1-26).
Morrow, B. (2012). BYOD security challenges: control and protect your most sensitive
data. Network Security, 2012(12), 5-8.
Moyer, J. E. (2013). Managing mobile devices in hospitals: A literature review of BYOD
policies and usage. Journal of Hospital Librarianship, 13(3), 197-208.

RISK ASSESSMENT 17
Oppliger, R. (2011). Security and privacy in an online world. Computer, 44(9), 21-22.
Pillay, A., Diaki, H., Nham, E., Senanayake, S., Tan, G., & Deshpande, S. (2013). Does BYOD
increase risks or drive benefits. Melbourne, The University of Melbourne.
Scarfo, A. (2012, November). New security perspectives around BYOD. In Broadband, Wireless
Computing, Communication and Applications (BWCCA), 2012 Seventh International
Conference on (pp. 446-451). IEEE.
Shim, J. P., Mittleman, D., Welke, R., French, A. M., & Guo, J. C. (2013). Bring your own
device (BYOD): Current status, issues, and future directions.
Song, Y. (2014). “Bring Your Own Device (BYOD)” for seamless science inquiry in a primary
school. Computers & Education, 74, 50-60.
Suby, M. (2013). The 2013 (ISC) 2 Global Information Security Workforce Study. Frost &
Sullivan in partnership with Booz Allen Hamilton for ISC2.
Thomson, G. (2012). BYOD: enabling the chaos. Network Security, 2012(2), 5-8.
Vijayan, J., & Hardy, G. M. (2015). Security Spending and Preparedness in the Financial Sector:
A SANS Survey.
Watkins, B. (2014). The impact of cyber attacks on the private sector. Briefing Paper,
Association for International Affair, 12.
Wiech, D. (2013). The benefits and risks of BYOD. Manufacturing Business Technology.
Zahadat, N., Blessner, P., Blackburn, T., & Olson, B. A. (2015). BYOD security engineering: A
framework and its analysis. Computers & Security, 55, 81-99.