BYOD in practice KPMG case study 13 March 2013

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 1 Agenda Aurelia Costache CIO KPMG Romania Tel: Page BYOD – why?2 Business Case for Mobile devices5 Implications7 Challenges11 Summary and lessons learnt13

BYOD – Why? Trend or necessity?

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 3 Global telecom sector: An overview Source: Ericsson; Informa Research 6.2 billion total mobile subscriptions as of March million net additions in the first quarter ending March 2012 Voice Data 966 1,014 1,054 1,087 1,114 Growing subscriber base: Mobile subscriptions at 6.2 billion in Q1 2012, ( ~87 percent penetration). Adjusted active subscriptions 4.2 billion Sharp decline in revenue growth – down from double-digit increases between 2005 and 2008 to just 5 percent in 2011 Mobile service revenue to grow at CAGR 3.2 percent during Data to drive revenue growth – CAGR 12.3 percent during , only partly offsetting the decline of voice revenues

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 4 BYOD – Whats the buzz? History Blackberry served the corporate world As of 2007 major growth market share of smartphones (iPhone, Android) Recent years Explosion of smartphone penetration Emergence of tablets Corporate and private phones get mixed: Bring your own device Main Drivers Intuitive/Usable interface Internet/cloud integration Affordable pricing November 2012 U.S. Mobile Subscriber Market Share Source: comScore MobiLens

BYOD in KPMG Business Case

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 6 Main elements Analysis of national and roaming traffic data Estimation of new traffic requirements for BYOD (national and roaming) The used fleet was almost 2 years old and replacement had to be planned CAPEX is lower (less devices acquired by KPMG) OPEX is higher (more admin staff to support the new users, MDM licenses, additional traffic) KPMG people (they can select the smart-phone they want) Staff need for mobility (business efficiency by accessing KPMG resources on mobile devices) The Business Case

BYOD in KPMG Implications

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 8 Implications – Broader then expected Implications KPMG Global Standards TechnologySecurityLegal Data Privacy

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 9 KPMG Global Standards, Technology and Security Main concerns Ensure the necessary security features to protect corporate data and prevent data loss as well comply with KPMG Global Standards – Security Requirements for Mobile Devices. What happens KPMG Approach KPMG limited the BYOD program to main OS on the market: Android and iOS and implemented dedicated MDM solutions: How will these security features be deployed? What happens when a device is lost or stolen? when the wrong PIN / password is entered too many times? What happens happens when a device is infected with malware? What What happens with the data saved to local backup or iCloud? GOOD for Android FAMOC for iOS

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 10 Legal and Data Privacy Main concerns MDM features may include activity monitoring, tracking, and remote lock & wipe. Employees must give explicit and fully-informed consent for any organization to access and process their personal data. Employee consent is also required should a business wish to install a MDM application on their device. KPMG Approach KPMG implemented a BYOD policy: addresses the above concerns formally communicated and acknowledged by all participants. Policies configurations enforced using the MDM were carefully reviewed to ensure compliance with legal and Data Privacy requirements.

BYOD in KPMG Challenges

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 12 BYOD – Challenges Security testing phase..included MDM solutions Internet facing components as well the client application installed on mobile devices: 1.Application security testing (web specific attacks, application logic attacks) Testing the network communication between clients and server Data encryption / protection MITM, spoofing, etc 2.Testing the client application (agent) Jailbreak Policy bypassing Local data storage / recovery Static application analysis, etc Vulnerabilities identified..for all components of the solution: for web applications front-end interface for client installed on smartphones. operational/ functional vulnerabilities (eg the application did not detect that a phone is subject to jailbreak) Operational challenges Complete testing & configuring of the MDM solutions Plan the enrollment: centralize all demands trough service desk application, increase of the data traffic Enroll all devices at the same time: activate the data services, install the MDM application on the device, configure the user account on the server and synchronize the KPMG data account.

BYOD in KPMG Summary & lessons learnt

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 14 Summary of BYOD in KPMG Romania Summary of 2012 BYOD program allowing employees to use their own smart phones to access relevant corporate data: In the past... Around 150 BB used by Managers and above Mainly used for corporate access Cloud based services (private cloud) Expensive solution, especially in roaming Drivers for change Proliferation of smart devices KPMG people Need for mobility Cost management Today 260 smart devices (phones and tablets) activated Traffic volume increased by 30%, costs reduced by 10% After 6 months review the business case was confirmed Legal and Data Privacy aspects considered and formalized in a BYOD policy MDM solution implemented but processes are complex and need time to stabilize Initiative well received by KPMG staff (user satisfaction increased) Behavior changed (efficiency & innovation)

© 2013KPMG Romania, a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. 15 Lessons learnt Enrolling mobile devices results in new risks Broader then expected, e.g. legal, technology, integration, backups Security controls work differently on mobile devices Technical Solutions Different security architectures to reduce risks of mobile devices No technical solution fixes it all, mitigate risks by people, processes and technology How to continue Perform risk assessment before implementation Consult with relevant experts Implement security controls for people, process and technology Test effectiveness of security controls Stay up-to-date with recent developments Structured approach, phase by phase Unexpectedly well received by users!

© 2013 KPMG Romania, a Romanian member firm and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved. The KPMG name, logo and cutting through complexity are registered trademarks or trademarks of KPMG International Cooperative (KPMG International).