BYOD Without BYO(In)Security Cardinal Health
February 28, 2012, RSA Conference, San Francisco—Implementing changes in security are much more difficult in today’s environment where people are bringing in their own platforms. The speakers address some of the facets of this new environment.
Goran Auramov and Dan Houser presented the perspective of Cardinal Health, a healthcare and pharmaceuticals distributor. In addition to distribution and manufacturing they also are a cloud services provider for many of their clients. As a result, they’re moving more information into cloud services as part of their normal functions.
Some of the challenges in the industry are related to increased consumerization and the availability of very powerful platforms running either Android or iOS. These types of devices are increasing the challenges of providing security due to their growth in numbers and to the changes in technology they are using. The drivers for these changes are costs, client satisfaction, productivity increases and increased collaboration and communications. The increasing number of mobile users just makes security a more difficult area than ever before.
This environment needs security that is dictated by regulatory compliance requirements. For Cardinal Health, their general network has 71 basic IP addresses, and is expected to grow to over 12,000 device IP addresses in the next three years. The increasing number of users bringing their own devices will account for 10,000 of those new addresses and will include both tablets and smart phones.
Some of the controls they are developing will enable remote wipe, screen lock, and device level encryption. Their vision is to put a virtual desktop on all private devices. They will store all data in the data center, but to allow for more flexibility and choice, they will implement a self-service model to deliver data and apps to those platforms.
Some of the principles the being implemented in their security protocols include: no ability to download from or save data at remote sites, and no direct access to the network through a third-party device. The security controls are being designed to have minimum impact on personal devices, however they will not allow e-mail archives on those devices.
Their approach for implementation is to operate with their users. IT will take care of desktop machines as well as a software, architecture, security, and network for all users independent of their platform. They hope to work together with their users to integrate security while providing universal access for operating system, and provide a common software platform for all operations.
Their beta tests started with 200 people and was used to evaluate outside vendors while adjusting risk and policy. After two additional pilot programs, they built out the system for all users. Now, 65 percent users have been in this deployment for over three years. The network has 13,000 people working on company machines and an additional 2000 people with their own terminals. They made changes to user tools to improve communications functions
They segment BYOD traffic into guest, authentication with full access with tokens, or authentication with guest privileges only if no tokens are available. Segmentation also goes to the worker level, and includes geographic, role, and applications criteria. Many parts of the system are still under development and the various functions and applications are being developed and added over time. Mobile apps present some unique challenges in this environment, as some are actually used in a person’s work while others are not.
Due to security needs and healthcare regulations, corporate and personal data are partitioned and not allowed to overlap. They have made efforts to virtualize or isolate all apps, and have classifications of all information from the network to the individual devices. BYOD does not mean one size for all, but requires diverse services and platforms as well as security operations for the different platforms.
