Adding Bring Your Own Device (BYOD) support is a common move at many organizations today, meeting the need for connected devices while allowing for flexibility in device choice. It can also create unforeseen issues related to security and network security workflows, meaning it’s not always a simple proposition.
Thankfully, these issues are typically resolvable, such as a recent case where a SecureW2 client encountered a frustrating issue with one element of their network security infrastructure, necessitating some creative problem-solving.
BYOD and Security Gaps
BYOD is an organizational policy that lets employees use personal devices, such as smartphones, tablets, and laptops, to access company networks and resources. With a BYOD model, employees can work from devices they already own, eliminating the need for company-owned hardware. Many users also prefer BYOD because it means they can use personal devices they’re already comfortable with.
BYOD deployments may be widespread (and increasingly popular), but many still rely on vulnerable password-based Wi-Fi authentication, such as a WPA2 pre-shared key (PSK) or individual user credentials. This is a serious network security gap, as passwords and credentials are vulnerable to a range of attacks, and stolen credentials can be used to carry out more damaging attacks once an attacker is inside a network.
Certificate-based authentication (CBA) is the best choice for both managed devices and BYOD, as it replaces passwords with certificates that can’t be easily stolen or misused as they are tied to a device. However, implementing CBA for BYOD brings a number of challenges.
MDM Platforms and BYOD
Mobile device management (MDM) solutions are integral to an organization’s network security. MDMs play a role in tracking enrolled or issued devices, procuring and deploying mobile devices, and managing endpoint security.
While some MDM solutions support BYOD, those devices aren’t fully managed and provisioned like company hardware, meaning the solutions don’t have access to BYOD device details such as serial numbers. For one SecureW2 client who needed to put a priority on every element of their network security, BYOD limitations posed a problem, even as they couldn’t afford to compromise.
A BYOD Device Lookup Solution From SecureW2
A SecureW2 client used Jamf, an Apple device MDM platform, for both managed and BYOD devices. However, Jamf didn’t store BYOD device details such as MAC addresses or serial numbers the same way it did for managed devices. This created an unusual situation that required an innovative solution.
Our existing device lookup with JoinNow Dynamic PKI allowed the client to search for managed devices by serial number to verify whether they are active and valid before issuing a certificate. But the same authentication flow didn’t translate to the BYOD devices.
A Request for Expansion
The client came to SecureW2 with a request: make device lookup possible for both BYOD and managed devices in Jamf.
The SecureW2 development team accepted the challenge. The result was code-level changes to our platform that expanded searchable values in device lookup so that customers now have the option to perform device lookup in several ways. Before, device lookup with Jamf was only possible by serial number, but the updates have added several searchable values, providing additional flexibility and expanded capabilities.
The Result
One of the new device lookup options is a device’s unique management ID stored in Jamf. This allowed the client to implement an authentication flow based on these IDs, letting them verify BYODs are active and valid in Jamf before issuing them certificates, just as they do with managed devices.
This isn’t a one-client solution: The expanded device lookup options are now available to all SecureW2 customers.
BYOD Best Practices
Many organizations offer BYOD today. But it’s important to remember that securing these devices can require additional steps and workflows, and entails distinct security considerations. Relying on an MDM like Jamf for device management is one step of the process, but choosing the correct protocols, configurations, and security systems is also necessary.
WPA2-Enterprise: The Secure Choice
WPA2-Enterprise is the industry standard for any BYOD system (as opposed to the less-secure WAP2-Personal). WPA2-Enterprise uses individual credentials, instead of a single Pre-Shared Key (PSK), and wraps in a Remote Authentication Dial In User Service (RADIUS) server to manage authentication.However, on-premises RADIUS configurations are costly and maintenance-heavy.
Solutions such as SecureW2 Cloud RADIUS can simplify and strengthen network security. It’s a fully managed cloud-native RADIUS service for certificate-based authentication flows that requires no on-prem setup.
Authentication Method Matters
It’s not enough to simply set up WPA2-Enterprise, however. Configuring devices for Server Certificate Validation (SCV) and choosing the proper protocol for doing so guard against fake access points and man-in-the-middle (MITM) attacks.
EAP-TLS is the most recommended protocol. EAP-TLS uses a TLS handshake, in which the device and the RADIUS server mutually authenticate with digital certificates. This protects against over-the-air credential theft attacks. Once a user onboards to a network utilizing EAP-TLS, the risk of connecting to an illegitimate network is almost zero.
Avoid Manual Device Configuration
Relying on users to manually configure devices can potentially compromise the entire network if they fall victim to an MITM attack.
An automated solution can prevent this scenario from happening by simplifying the process for IT admins and end users. With just a few clicks, end users can correctly configure a secure wireless network while mitigating security risks from misconfiguration.
SecureW2 solutions and onboarding technology ensure every device on the network is correctly configured for WPA2-Enterprise. Using the tools SecureW2 provides, you can implement a BYOD network that maximizes your company's productivity while protecting every device that connects.
See our solutions page to learn more about how SecureW2 can keep your network secure.
Frequently Asked Questions
What Does BYOD Stand For?
BYOD stands for Bring Your Own Device. BYOD policies (in business and IT contexts) involve permitting employees to use personal devices, such as smartphones, laptops and tablets, for work purposes.
Can employees enroll BYOD devices on WPA2-Enterprise networks without IT help?
Yes, with self-service solutions for BYOD onboarding (such as JoinNow MultiOS) that walk employees through the certificate enrollment process. End users authenticate with their corporate identity credentials. Then, the tool provisions the digital certificate and configures the 802.1X network profile on the device. Lastly, the end user connects to WPA2-Enterprise without manual configuration or IT involvement. This architecture makes certificate-based BYOD operationally practical at scale.
What is a WPA2-Enterprise network?
A WPA2-Enterprise network requires all devices to log into the wireless network with unique credentials. Every user has either their own username and password or their own digital certificate. It has several advantages. Namely, WPA2-Enterprise gives administrators more visibility of users connected to the network and can prevent the spread of compromise.
How does Wi-Fi RADIUS authentication work?
Think of RADIUS as a virtual bouncer at a virtual gate. When a user attempts to access the network, the RADIUS server checks whether their credentials or certificates are valid. It does so by checking them against a directory or Certificate Revocation List.
