A Policy-Based Framework for Preserving Confidentiality in BYOD Environments: A Review of Information Security Perspectives

Abstract

Today, many organizations allow their employees to bring their own smartphones or tablets to work and to access the corporate network, which is known as a bring your own device (BYOD). However, many such companies overlook potential security risks concerning privacy and confidentiality. This paper provides a review of existing literature concerning the preservation of privacy and confidentiality, with a focus on recent trends in the use of BYOD. This review spans a large spectrum of information security research, ranging from management (risk and policy) to technical aspects of privacy and confidentiality in BYOD. Furthermore, this study proposes a policy-based framework for preserving data confidentiality in BYOD. This framework considers a number of aspects of information security and corresponding techniques, such as policy, location privacy, centralized control, cryptography, and operating system level security, which have been omitted in previous studies. The main contribution is to investigate recent trends concerning the preservation of confidentiality in BYOD from the perspective of information security and to analyze the critical and comprehensive factors needed to strengthen data privacy in BYOD. Finally, this paper provides a foundation for developing the concept of preserving confidentiality in BYOD and describes the key technical and organizational challenges faced by BYOD-friendly organizations.

Understanding employees' adoption of the Bring-Your-Own-Device (BYOD): the roles of information security-related conflict and fatigue

“…Mobile devices contain a wealth of data that users might deem private. However, technological countermeasures for organizational security, such as monitoring and tracking, elicit privacy concerns among employees (Vorakulpipat et al , 2017). For example, e-mail filtering technology can monitor the content of private messages.…”

“…Organizations may face internal and external threats such as computer viruses and employees' inappropriate use of information assets and data (Li et al , 2019; Xu and Guo, 2019). Employees' adoption of BYOD in the workplace may increase such challenges for enterprise information security management (Scarfò, 2012; Vorakulpipat et al , 2017). In a recent survey, 39% of companies cited security concerns as the primary barrier to BYOD adoption, including employees' unauthorized access to company data, the ability to download unsafe applications (apps) or content and stolen and lost devices (Deyan, 2019).…”

Determinants of Intention to Participate in Corporate BYOD-Programs: The Case of Digital Natives

“…If the user keeps passwords for e.g. social networks stored in the browser, the employer may be able to get access to this very private area (Vorakulpipat et al 2017). Also modern smartphone have GPS systems and the employer may be able to track the employees location and travel paths (Vorakulpipat et al 2017).…”

“…social networks stored in the browser, the employer may be able to get access to this very private area (Vorakulpipat et al 2017). Also modern smartphone have GPS systems and the employer may be able to track the employees location and travel paths (Vorakulpipat et al 2017). Capturing these issues, privacy risk (PR-PR) is defined as the Bpotential loss of control over personal information^ (Featherman andPavlou 2003, p.1036).…”

The Dangers of Rooting: Data Leakage Detection in Android Applications

“…Notice that users obtain superuser access privileges to change the current Android version, to get access to the file system without restrictions, to install modified apps and gain more privileges, to improve performance, and so on. However, these access privileges may affect the security of installed applications [12,13,15], providing an access door to many sensitive information [16][17][18]. In this scenario, unintended data leakage flaws may exist.…”