A secure BYOD policy at MasterCard? Priceless
- 16 May, 2012 06:44
- Comments
More than a year into its bring-your-own-device program, MasterCard Worldwide continuously assesses the security technology and policies that allow 30 per cent of its employees worldwide to use their personal iPhones, iPads and Android devices at work.
"Security is a high priority for us," says Edgar Aguilar, group executive of infrastructure and operation services at the $US6.7 billion credit card company.
Employees can get work email on their devices and merge their personal and business contacts and calendars. "We are giving them access to their own information in a form factor they feel familiar with," Aguilar says. (The company issues BlackBerrys, which aren't part of the BYOD program.)
For participants in the BYOD program, MasterCard sets strict conditions of use.
Data stored on or transmitted to or from the device is encrypted. MasterCard also requires passwords to lock the smartphone or tablet or to get on the corporate network. "It's essentially a secure container," Aguilar says.
If the device is lost or stolen, MasterCard can wipe just the corporate information. "It's up to the users to make sure they protect their personal information."
Best Practices
Janco Associates, an IT management consulting firm, says CIOs should consider reaching further into the home life of employees. A BYOD policy template it recently published stipulates that any personal device that synchronizes with a sanctioned BYOD machine must use antivirus software "deemed necessary" by the IT group. Also important: IT must install mobile virtual private network software on the device, or at least approve of the package the employee uses.
About 2000 of MasterCard's 6700 employees worldwide have signed up for BYOD so far, and that number is growing, Aguilar says. "We keep hiring new employees around the world and we see more requests for BYOD."
Aguilar's next step was allowing access to the corporate intranet on personal devices, a feature he enabled early last year. Whatever new applications it deploys, MasterCard, which does business nearly every country, wants to do it globally, not favoring any one country over another, he says. That means knowing how wildly different data privacy rules affect the use of personal smartphones and tablets.
MasterCard can simply tweak its policies for laptops, for example. But the difficulty with personal devices is being able to prove that the company complies with privacy regulations in the event of audits or lawsuits. MasterCard wants to have archiving and usage logs in place and tested before opening other applications to the BYOD program, Aguilar says.
Janco advises IT departments to store records of mobile device activity in a number of ways: based on files, individual users and groups of users, IP address, and material downloaded, uploaded and previewed. At MasterCard, an in-house attorney has been involved in the BYOD rollout from the planning stages. "They provide advice throughout the process, not at the tail end."
Contact Senior Editor Kim S. Nash at knash@cio.com. Read her blog, Strategic CIO.
Recommended
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
-
Australia suspected to have PRISM data: Ludlam
-
Australia Post’s mail business to lose $200 million this year
-
Australia Post’s mail business to lose $200 million this year
-
Microsoft's ambivalence about Office on the Web gives Apple shot with iWork on iCloud
-
3 Lessons Learned From a Failed Customer Feedback Test
-
Advanced Malware Exposed
This handbook shines a light on the dark corners of advanced malware, both to educate as well as to spark renewed efforts against these stealthy and persistent threats. By understanding the tools being used by criminals, we can better defend our nations, our critical infrastructures and our citizens. This ebook will provide readers with a new understanding of the rapidly developing cyber threat landscape and practical insights into how they can protect their data and computing infrastructures. Download now. -
Leading Through Connections – Insights from the Global Chief Executive Officer Study
IBM’s 2012 Global CEO study follows face-to-face discussions with more than 1,700 CEOs and senior public sector leaders from around the globe. The findings examine how CEOs are responding to the complexity of increasingly interconnected organisations, markets, societies and governments. For example, almost one-quarter of CEOs say their organisations operate below par in terms of driving value from data. CEOs have expressed frustration about their inability to capitalise on available information. This is because: “The time available to capture, interpret and act on information is getting shorter and shorter.” CEO, Chemicals and Petroleum, United States Given the need for deeper business insight, the best performing organisations are more adept at converting complex data into insights, and insights into action. Download Entire Report Now. -
Maximising productivity without sacrificing security
Advances in mobility and client computing technology combined with the ubiquity of the Internet and social media are creating a culture and desire for constant connectivity and anywhere access to information. As these trends extend from the home into the work place, IT managers should consider seriously the opportunities for increased productivity and communication with customers and constituents, as well as understand the increased security risks posed by online, anytime access to private networks and data. Read more.
Get exclusive access to Invitation only events CIO, reports & analysis. 
