BYOD Policy Research Articles

BYOD security behaviour and preferences among hospital clinicians – A qualitative study

Background/ObjectiveThe use of personal devices for work purposes (Bring-your-own-device) has increased in hospitals, as it facilitates productivity and mobility for clinicians. However, owing to increased risk of leaking patient information, and heavy reliance of patient data privacy on user actions, BYOD is a major challenge for hospitals. There has been a dearth of empirical research studying clinicians’ BYOD security behaviour. Therefore, the study’s aim was to attain subjective understanding of clinicians’ attitudes and preferences towards protecting patient data on their devices through a qualitative study. Methods14 semi-structured interviews were conducted among Australian hospital-based clinicians. A hybrid thematic analysis was conducted using the framework method to explore socio-technical themes pertaining to the clinicians’ BYOD security behavioural practices. ResultsLimited use of secure tools like antivirus and passcodes, and inadequate separation of patient and personal data on BYOD devices was found. Key technology concerns included malware introduction into hospital network, inadvertent patient data sharing, and slow remote access. Hospitals lacked dedicated BYOD policies and training, resulting in unsafe practices. Participants also cited misalignment of BYOD policies with workflow needs, privacy maintenance challenges and fears of personal data breaches, while calling for improved communication between technical and clinical staff and a strong cybersecurity culture. ConclusionThis study provides a comprehensive understanding of BYOD related user behaviour and the usefulness of security controls used in time-sensitive and complex hospital environments. It can inform future policies or processes by advocating for secure and productive BYOD use.

Systematic Literature Review on Security Access Control Policies and Techniques Based on Privacy Requirements in a BYOD Environment: State of the Art and Future Directions

The number of devices connected within organisational networks through ”Bring Your Own Device” (BYOD) initiatives has steadily increased. BYOD security risks have resulted in significant privacy and security issues impacting organisational security. Many researchers have reviewed security and privacy issues in BYOD policies. However, not all of them have fully investigated security and privacy requirements. In addition to describing a system’s capabilities and functions, these requirements also reflect the system’s ability to eliminate various threats. This paper aims to conduct a comprehensive review of privacy and security criteria in BYOD security policies, as well as the various technical policy methods used to mitigate these threats, to identify future research opportunities. This study reviews existing research and highlights the following points: (1) classification of privacy and security requirements in the context of BYOD policies; (2) comprehensive analyses of proposed state-of-the-art security policy technologies based on three layers of security BYOD policies, followed by analyses of these technologies in terms of the privacy requirements they satisfy; (3) technological trends; (4) measures employed to assess the efficacy of techniques to enhance privacy and security; and (5) future research in the area of BYOD security and privacy.

BYOD usage and security behaviour of hospital clinical staff: An Australian survey

ObjectiveHealthcare professionals are known to use their personal devices extensively for work purposes (Bring-Your-Own-Device). However, it is also a source of major concern for healthcare organisations, given the heavy reliance of patient data privacy on clinician’s usage behaviour and higher risk of data breaches. Previous research into hospital BYOD security has been scarce and fragmented. Therefore, the aim of this paper is to understand the preferences, behaviour, and knowledge of Australian hospital clinical staff with respect to BYOD security through a survey. MethodAn online survey was conducted among clinicians working in Australian hospitals, asking them about their BYOD related user behaviour, knowledge of best practices, and support received from their hospitals. Descriptive statistical analysis and cross tabulation were carried out on the survey data. ResultsMajority of the surveyed clinicians used BYOD (87%). Some of the good behavioural practices found included use of passcode: (91.95%), never disclosing password (67.82%); strong passwords (63.22%) and no storage of patient data (59.77%) on BYOD devices. However, several risky practices were also found, particularly when usability or clinical workflow mattered to clinicians including use of personal/social apps for clinical communication (e.g. SMS: 57.47%, WhatsApp: 39.08%); connecting BYOD devices containing patient data to public hotspots (40.23%) and use of a common data backup platform for personal and patient data (79.93%). A large proportion of surveyed clinicians were either unaware or didn’t receive BYOD related security training (74.71%) or policy (39.08%), but those who did were more confident across all aspects of BYOD security asked in the survey, indicating their importance. ConclusionBy taking a wholistic and socio-technical view, this study helps us to better understand BYOD related security behaviour of hospital-based clinicians and its consequential implications. It can therefore provide important insights for both technical and clinical stakeholders of BYOD within hospitals.

A longitudinal study on improving employee information protective knowledge and behaviors

Research shows it is challenging to ensure that individuals use information protective behaviors (e.g., secure passwords, turning off tracking features), especially on smartphones. Concurrently, employees increasingly use their own devices for work (BYOD), but with limited compliance with BYOD policies. This research studies the role of knowledge in increasing employees’ use of information protective settings, and explores how exposure to security and privacy news can increase such knowledge. A 10-month field intervention with 826 corporate trainees who received daily newspapers covering privacy and security articles. Our findings show that it is possible to increase employee knowledge of security and privacy, and in turn positively affect their usage of information protective settings over time through repeated, perceived-to-be-mandatory information exposure. The study contributes to a better understanding of the importance of measuring actual knowledge in studies of employee behavioral actions towards protection of organizational information. The results suggest organizations need holistic employee compliance programs, where in addition to developing policies, as well as compliance testing and sanctions, they provide repeated information exposure.

Exploring information systems security implications posed by BYOD for a financial services firm

This study explores information systems security implications posed by Bring Your Own Device concept in financial services firms. Thus, the findings and recommendations from this study will help financial services and other organisations to be cognisant of the importance of BYOD policy formulation. The use of BYOD has become prevalent in the workplace due to the increased dependence on the Internet and advancements in technologies. It is beneficial to the organisation in that employees buy, use and insure their own devices, thus, the organisation does not bear these costs. However, there is a huge cost to the company if the use and connection of BYODs to the company’s Information Technology infrastructure is not regulated and monitored. BYODs expose information and information systems assets to threat actors. Financial institutions handle very sensitive information, making them a target for data breach and the adoption of BYODs more hazardous. A qualitative research method was conducted with eight (8) purposefully selected participants working in the Risk, IT and Information Systems Security departments of the financial institution. Telephonic interviews were conducted in line with the national protocols of the global Corona Virus Disease-2019 (COVID-19) pandemic. The study revealed the absence of a BYOD policy and employees could use any number of personal devices without restrictions. Users were aware of information systems security policies and protocols because of the annual training and awareness programmes.

Vulnerability assessment as a service for fog-centric ICT ecosystems: A healthcare use case

Modern ICT ecosystems such as healthcare environments (hospitals, care-centers etc.), operate in different abstraction layers (cloud, fog, extreme-edge) and comprise large numbers of network entities such as terminals, devices, sensors or even specialized appliances (virtual or physical). It is common in such environments, that several network entities with intermittent connectivity, join and leave the network in an unstructured and unsupervised manner (Wi-Fi access-points, BYOD policies, IoT, etc.). Such devices of frivolous nature, or even trusted devices/terminals, are prone to security vulnerabilities, since they are operated by regular, non-expert users who are not aware of any security aspects whatsoever. To effectively manage and proactively protect such large, complex and multilayered networks, dedicated personnel (system administrators, security specialists etc.) must be employed and specialized appliances must be deployed. On the other hand, modern cyber-warfare has become even more elaborate and insightful. Thus, ICT infrastructures must continuously evolve and adapt to the everchanging cyber-threats, which is a rather cumbersome and expensive task to accomplish. Towards addressing the above-mentioned issues, this paper proposes a cross-layered system, which leverages the Software Defined Networking (SDN) paradigm and the distributed Fog architecture, for network slicing and task offloading to provide dynamic, security-aware Vulnerability-Assessment as a service for large ICT infrastructures. The presented system provides seamless assessment for all existing and newly introduced network entities against all known security vulnerabilities, certifies them through a Common Vulnerability Scoring System (CVSS), classifies them according to the cyber-threat they introduce, and finally assigns them to a connectivity-appropriate VLAN. The presented system was preliminarily evaluated under a controlled-conditions simulation environment.

A survey of student and instructor perceptions of personal mobile technology usage and policies for the classroom

This study explored student and instructor perceptions of personal mobile device usage and policies for appropriate practices in the classroom at a Brazilian higher education institution. The study also explored significant differences in perceptions, and relationships between perceptions and demographic data. A total of 176 undergraduates and 13 instructors completed a survey. Descriptive statistics, t-tests, and correlations were performed. A thematic approach was used to analyse the open questions from the survey. Results suggested students' occasional use of WhatsApp or similar applications to engage in content and non-content activities, and a tendency for occasional use of a few other applications for content, despite the strict policies adopted by many of the instructors, and student awareness of disruptions. Participants' perceptions significantly differed regarding a number of policy statements and device usage. Significant correlations were found between student age, usage, and some of the policy statements. The study suggests ongoing discussions between instructors and students, and among students themselves to develop acceptable BYOD policies for the classroom to help minimize distractions and promote effective learning.

THE FUTURE OF BYOD IN ORGANIZATIONS AND HIGHER INSTITUTION OF LEARNING

B.Y.O.D. (Bring Your Own Device) or B.Y.O.T. (Bring your own technology) is a new trend that has been perceived where staffs and students bring their personally-owned mobile devices to their study and workplace to access institutions resources such as email, file servers , databases, do other academic work or research as well as their personal data. The conception of ‘Bring your Own Device’ is gaining trust at the workplace and also study environment. According to Priya C. N. (2012), stated that most of the institutions and organizations abroad have started to implement this policy since the year 2012. A well organized questionnaire was distributed among 70 students and staffs chosen from various FTMSGlobal Departments of the College under study with response rate of 50 percent. The present study demonstrates and elaborates the various aspects of BYOD use, such as awareness of BYOD, the frequent use of BYOD, purposes for which the BYOD is used, collaborative tools used for academic purposes, concerns/problems faced by the users and satisfaction level of users with the BYOD facilities provided in the College. Using personal devices at work or study is beneficial in some ways like more productivity, flexibility, freedom and choice etc. Though, the policy has some risks as well like the prime issue of data security. It can be seen in the literature reviews that the organization who clasps BYOD policy have seen that their employees and students are happier, productive and collaborative. Henceforth it was conducted with the primary objective of finding the views of respondents from different sectors and institutions.

Modifying Security Policies Towards BYOD

Abstract In the IT Consumerization phase, the organizations permit their employees to bring their personally owned device to workplace. This is achieved through enforcing policy or agreement - Bring Your Own Device. The BYOD policies adopted in numerous organizations are vague and generally immature. The prevailing security policies in BYOD are no more supportive for mobile devices like smartphones, tablets and laptops. The security policies must be modified to suit these devices. To mitigate this downside, 3-tier enhanced policy architecture is proposed which specifies the policies to be followed by the device, applications and organizations.

The "Bring your own device" conundrum for organizations and investigators: An examination of the policy and legal concerns in light of investigatory challenges

In recent years, with the expansion of technology and the desire to downsize costs within the corporate culture, the technology trend has steered towards the integration of personally owned mobile devices (i.e. smartphones) within the corporate and enterprise environment. The movement, known as “Bring Your Own Device” (hereinafter referred to as “BYOD”), seeks to minimize or eliminate the need for two separate and distinct mobile devices for one employee. While taken at face value this trend seems favorable, the corporate policy and legal implications of the implementation of BYOD are further complicated by significant investigatory issues that far outweigh the potential benefits of integrating a BYOD policy. In this paper we first set a context for the BYOD conundrum, then examine associated corporate policies, highlight the limitations to the digital investigator’s reach regarding digital evidence and review the investigatory challenges presented to the involved parties (such as the forensic examiner) from a BYOD environment. We conclude by offering recommendations such as implementing finely crafted policies and procedures (such as incident response), utilizing Mobile Device Management and other software, corporate owned devices, and enforcing signed agreements.

From COWs to BYOD

From COWs to BYOD