BYO? Better get used to it

Do you let your staff use their own computing devices on your network?

If so, do you have a policy to control what they do?

Just saying “no” to the first question is not going to be an acceptable response much longer, according to Joel McDonnell, a director of Greentree partner Vision Business Solutions.

“Mobile devices are becoming ubiquitous, and the use of tablets is continuing to expand,” he says. “The operational guys in sales and service want their iPads and they want them now.”

As we reported recently, use of portable devices to access the internet is set to outstrip PCs within a few years. Businesses worldwide are realising that if they don’t want to go to the expense of supplying staff with phones or tablets, they’re going to have to let them bring their own, and use them on the company network. The convenience of taking work data wherever you go is just too pressing to resist.

An online survey conducted in June of this year for security company Trend Micro questioned 600 IT personnel responsible for endpoint operational management and/or messaging and collaboration operations in companies in the USA, Germany and Japan. More than half the respondents said they approved of the practice (known as consumerisation of IT or ‘bring your own device – BYOD). Larger companies tend to favour the practice more; up to 65% of businesses employing around 1500 people are permitting BYOD. In all, 74% of respondents said they already allow employees to use personal devices for work-related activities.

Thirty-one percent of the mobile devices connecting to the corporate network are owned by the employees in organisations that open up to consumerisation: 66% are laptops, 25% smartphones and nine percent are tablets.

And it’s not just sales and service staff who are opting for BYOD – middle and senior management are also big users of single, ubiquitous devices that hold both their personal and business data (Greentree can be used on iPads – read more here).

Tablets and smartphones are now favourite tools of frequent travellers. Joel formerly worked for Concur, which markets a phone application that handles expenses claims for busy people on the move. He estimates that up to 25% of all corporate travellers use it. The software handles receipts and expenses claims, and even manages itineraries.

“This is corporate America saying ‘this is a tool that needs to be in the hands of my users’,” says Joel, “so they are letting that person buy their own equipment. They’re probably reimbursing them for their data point and their cellphone plan, which they would anywhere, and they’re letting them use the tools that are going to make them their most efficient, and most effective.”

YES, BUT...

Naturally there are detractors, particularly when it comes to data security. However, one writer recently also pointed out that for the business, the cost of subsidising an employee’s connectivity for when they use their device for business purposes is an issue that needs careful thought.

“Mobile devices typically need network contracts, unless relying on pay-as-you-go or free wi-fi for connection,” wrote Rob Bamforth, Principal Analyst for research and analysis company Quocirca Ltd. “All-embracing corporate contracts come with many financial economies of scale that a chaotic collection of independent employee ones will lack.

“For smartphones and tablets, content includes both software and data. The line is often blurred, and despite many technical and religious discussions, the underlying issues of enterprise control of costs and risks apply either way. The convergence of work and personal content on one device, no matter who purchased the hardware or pays for the connection, raises the issues of content security, suitability and diligence.”

If the employee is a bit casual about personal use of their device after hours (going online through any handy wi-fi network, for instance), they run the risk of someone unauthorised being able to access whatever is stored on their device – including sensitive company information.

Joel describes the security issue surrounding BYOD as “a volcano waiting to erupt”.

“There’s an underlying current, even to the point of what IT can and cannot control,” he says. “The risks exist and IT is struggling to find ways to control and manage them. Inevitably there will be some challenges.

“Security risks need to be addressed, just as they’ve always been, but I don’t envy the folks trying to keep their arms around all those potential risks.”

Every business should have a sensible network security policy that is read and understood by all employees as a matter of course, regardless of whether they’re using personal devices. Portable storage is another security problem, since there is malware in circulation specifically designed to be transmitted via such devices as flash drives and USB sticks. Network security applied to company computers should always query any device plugged into the network, and automatically scan it for threats before allowing any files it contains to be opened.

For more tips about managing devices on business networks, and BYOD, see the boxout below.

For businesses, it’s not a case of if they will have to accommodate BYOD, but when. Joel McDonnell says that genie is out of the bottle.

“We can’t close it up, we can’t take it back; it’s there, and even your more conservative firms and firms under regulatory control like banking eventually will have to face the tide,” he says, “and it’s a relentless tide.”

HOW TO HANDLE BYOD

Managing the use of mobile devices

More BYO security tips

Tips for an ideal BYO policy

Security issues explained

Add Comment