2. Impact of IT Consumerisation on Enterprise Security
Rajesh Thapar CISO
YES Bank

3. IT Consumerization
As per Gartner :
“Consumerization is the specific impact that consumer-originated technologies can have on enterprises. It reflects how enterprises will be affected by, and can take advantage of, new technologies and models that originate and develop in the consumer space, rather than in the enterprise IT sector.”
Usage of Technologies developed for Consumer’s personal use making pathway into enterprises.
BYOD ? IT Consumerization is beyond “hardware”
Its more than only a device…… Its about CONTROL

4. IT Consumerization : Characteristics
It’s different than traditional Enterprise IT
Consumer’s Mobile Devices and applications
Public data networks
Organization cannot make rigid rules for IT interactions
Outside Perimeter and Parameters
Consumer driven IT

5. Factors driving IT Consumerization
Huge growth of personal computing devices
Social Media as tool for customer service improvements
Cloud based services
Workers are mobile
Users ask for instant gratification
Benefits
Empowered Users
Improved Productivity
Lower Purchase and support costs

6. Impact of IT Consumerization
Increased User control… User freedom can lead to reputation damage
Corporate network extends to ……..
No standardization of Assets
Anytime… Anywhere access – Diminished contextual security
Rework Security policy
Enterprise data spread far and wide….monitor real time?
Increased number of systems attacking
How to manage upgrades and replacements?
Legal implications of data lost from consumer device. 3rd party data loss?
What is actual liability of employee owned devices for business?
Consumerization of software – more user friendly, adapt to user needs, real time collaboration with any device.

7. Security Concerns Consumer owned devices which can’t support policies
Acceptance criteria and virtualized access
Data loss
MDM, DLP, DRM
Continuing check : compliant devices and settings
Visibility into device. Insulate if non compliant
Personal data segregation
Controls only on business data
Privacy protection
Disable location tracking unless lost device reported
Security policy as to how IT can or cannot use information collected.

8. Additional Controls Device Registration and Strong authentication
Sandboxing / Containerization
Context and Content aware capabilities
Information Protection / Encryption
Remote wipe
Built in device controls
Which applications to allow
End user Awareness
Source code review
Malware protection
Protect against Jail broken / Rooted devices
Mobile Access Management (MAM)

9. “Can’t avoid IT consumerization ………..…
Lets Accept it, plan to embrance it and capitalize the benefits it brings while balancing against the applicable risks.”

10. Rajesh Thapar
YES Bank