Developing a NATO BYOD security policy

Abstract

Mobile devices have an important role to play in the private as well as the professional activities of working people. However, their use can pose a serious threat to the security of the working environment. Many organizations therefore establish a specific bring your own device (BYOD) policy. This paper presents a proposal for how to foster a secure, policy-aware BYOD work environment. Our solution involves enforcement of fine-grained security policies for personal devices while relieving owners of having to make critical decisions and take responsibility for behavior of applications installed on their devices. We report our experience in developing and applying a security policy based on the existing guidelines of the NATO Communications and Information Agency (NCI Agency).