Imagine if fortress guardians, responsible for protecting valuables, get compromised?
It sounds like a script straight out of a science fiction novel but is actually the worst nightmare of an identity management tool that recently came true for Okta.

Okta suffered a breach of its customer support system in which hackers stole data for all customer support users. The stolen data includes HAR files that contained session tokens which could in turn be used for session hijacking attacks. The reason? An Okta employee's credentials were compromised on their personal device. 

The incident showcases potential risks associated with the intermingling of personal and work-related activities on a single device, which is a key concern in BYOD environments — and the current security infrastructure isn’t enough to support it. 

BYOD in the corporate world is one of those trends that surge like unstoppable tides, reshaping the very foundations of how businesses operate. The policy allows employees to use their personal devices, be it smartphones, tablets, or laptops, for work. The allure is undeniable; it offers flexibility, convenience, and a sense of ownership over one’s tools.

However, beneath the surface is a complex web of security concerns that cannot be ignored. As we witnessed with the Okta incident, the boundaries between personal and professional realms can blur, leaving sensitive information vulnerable to potential breaches.

‍With BYOD Comes Responsibility

Bringing your own device (BYOD) to work is like walking a tightrope. It gives workers a sense of freedom but can also open up risks we might not see coming. As someone who used to lead engineering projects, I know how hard it can be to mix flexibility and security, especially when there are billions of dollars on the line. In my experience, there are five big hurdles when it comes to BYOD.

• Data Security: Personal devices may lack adequate security tools and configurations compared to company devices, making them prime targets for hackers or viruses. If these devices access the company's network, they could facilitate unauthorized entry to sensitive business data.
• Device Management: It's an uphill task for the IT team to manage a multitude of devices. Each device comes with its own system, software, and potential security risks. Implementing uniform safety rules across all devices is challenging.
• Compliance Issues: Industries like healthcare or finance must adhere to stringent data protection laws. Ensuring each device's compliance with these regulations when employees handle sensitive data on their personal devices or vice versa is tough.
• Privacy Concerns: Striking a balance between an employee's privacy and a company's data security needs can be complex. Employees might resist their employer accessing their personal device, even if it's for implementing safety measures.
• Cost Implications: Although employers save on device costs, the long-term expenses of ensuring security, assisting with tech issues, and maintaining compliance may be higher.

VPNs and VDIs are Not Enough to Secure Personal Devices

Before implementing a BYOD policy, IT teams and companies should ask three questions: 

• How can you protect sensitive data being accessed through BYO devices?
• How can you prevent data compliance violations if you give a nod to BYOD and “work from anywhere”?
• How can you restrict access to company resources on a granular level?
• How can you protect sensitive company data without invading an employee’s privacy?

Solutions like VDIs and VPNs help partially solve the security challenges but none of them protects you against breaches without hindering your employees' access to company resources or hampering productivity. Moreover, implementing VDIs or similar solutions has significant IT overhead.

What if? Your employees or contractors are working remotely from a coffee shop or co-working spaces using public Wi-Fi. 

While a VPN can secure their internet connection, it provides full access to the enterprise network making it vulnerable to threats already present in the personal device.

‍What if? Your employee is using a personal device with outdated software and is vulnerable to attacks. 

A VPN or VDI can only help you run an application in the cloud, and not shield the device itself. VDIs also do not provide granular access control and data protection capabilities at the applications level. These solutions won’t prevent a user from clicking a phishing email, which could lead to malware installation or credentials theft. 

At Symantec Systems, I came across these limitations of conventional methods. It became clear that transitioning to more agile, cloud-based solutions that support conditional zero-trust access, and data containerization are crucial for dealing with the fast-paced, always-connected, and remote world we live in.

How to Make BYOD Work for the Future?

Though Okta is the most recent victim of cyberattack, it’s definitely not the first or the last authentication tool to be targeted. Given the limitations of VDIs and VPNs in securing enterprise applications and data and the added complexity of remote work, organizations must adopt a cloud-based solution that guarantees security for all SaaS, webapps, thick clients and even desktops in all circumstances.

Sonet.io’s air gap defense does just that by insulating apps, providing an additional layer of protection against compromised devices. Sonet.io air-gaps the Okta token by running the Okta dashboard in the secure Sonet.io cloud and rendering to any browser, on any device. Because there is nothing running on the local machine or in the browser, session tokens and cookies are no longer available for threat actors to use.

This means IT is better able to leverage BYOD strategies as users can use any device, while the organization has protection against untrusted devices. Its cloud-delivered no-code security policies can be updated in real-time to counter new threats and apps can be accessed from anywhere, making them perfectly suited for remote work.

Check it out here

‍Towards a Secure, Flexible Future

With the right approach and solutions, BYOD can indeed be an asset, rather than a liability. Drawing from my experience and the lessons learned along the way, I envision a future where businesses seamlessly integrate BYOD, without compromising security or efficiency. What are your thoughts on BYOD’s place in the “future of work”?