ITPEC FE Morning October 2018 Question 44
Which of the following is an appropriate description concerning BYOD and the associated information security risk?
Explanation
An employee uses a personal terminal for business, with the risk of infection from weak security settings — BYOD (Bring Your Own Device) means private devices doing company work.
Under BYOD the company does not own or fully control the device. Its security settings, patch level, antivirus and installed apps are the employee's choice, and the device is shared with private use, so malware can get in more easily and company data on it can leak. Controls such as MDM, a usage policy and access restrictions are needed to manage this.
Answer (c)
Why not others:
- •(a) — a company-provided terminal used privately is the reverse direction, sometimes called COPE; the device is not the employee's own
- •(b) — a company terminal used on the move is mobile working, and shoulder hacking is a risk of working in public, not of BYOD
- •(d) — using one's own device privately during breaks involves no company work or data, so it is not BYOD at all
Key rule: BYOD needs both halves: the device belongs to the employee, and it is used for company work.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.