Endpoint Security Complete

Are you reading this on your personal iPad at work? Congratulations, as you’ve joined a group bigger than the North Korean and Chinese armies put together who are drawn to the premise of BYOD. And why not? BYOD and the trend to consumerise IT promises many benefits, such as greater innovation, a better work-life balance and improved productivity.

Let’s not get too carried away though. As my physics teacher taught me, for every action there is an equal and opposite reaction. And however appealing the concept of consumerisation and BYOD might be, it’s the impact we need to think about.

Let’s look on the plus side first. It used to be that IT departments drove technology, but that has changed dramatically in recent years. The consumerisation revolution and BYOD have shifted the IT culture so that the users are the ones getting the latest, cutting-edge technologies first, and they want to bring those devices to work.

Maybe they are right. Businesses that embrace BYOD have some advantages over competitors. For a start, BYOD programmes generally shift costs to the user. With the employee paying for most or all of the costs for the hardware, voice and/or data services, and other associated expenses, the capex costs are reduced (although the  support opex costs may grow, as the IT department has such a plethora of different devices to support).

You might expect users to revolt against paying for the devices and technology they use at work. Not so. The majority of companies with BYOD models require employees to cover all costs—and they are so elated to be using the appealing devices, they are happy to open their wallets.

Not content with BYOD the momentum is also moving to BYOE: bring your own everything. As BYOD matures, organisations need to be prepared to accept any type of personal and corporate-issued device that may appear in the workplace, in the future. They need to move away from a device-centric approach to an information-centric world. A device-agnostic organisation focused on enabling productivity rather than enabling specific hardware will reap the rewards of mobile innovation and competitive advantage.

The companies who are most prepared for a mobile device policy that makes sense for the business—one that allays financial, legal and security requirements—are employing Mobile Device Management, or MDM, in the business model. This allows them to extend full network-like controls to devices outside the network and, in doing so, addresses security concerns, especially around corporate applications access.  See here for some top considerations Symantec put together around implementing BYOD in your organisation.

It doesn’t stop there: staff satisfaction increases with BYOD too. The staff member walked into an Apple store or ordered online the iPad, laptop or smartphone they preferred. They paid with their own cash. They would rather use the devices they enjoy and get satisfaction from, than be hampered with the corporate laptop or mobile device issued by the IT department. When was the last time you heard someone say, “I love my BlackBerry”, for example?

Remember that equal and opposite reaction? Here are the pitfalls to the consumerisation of IT and BYOD. By embracing the trend (and let’s face it, you can’t fight it), companies lose much of the control over the IT hardware and how it is used. Company-issued IT typically comes with an acceptable use policy, and it is protected by company-issued security that is managed and updated by the IT department. It is a little bit trickier telling an employee what is, or is not, an acceptable use of their own laptop or smartphone.

Companies also needs to have a clearly defined policy for BYOD that outlines the rules of engagement and states up front what the expectations are. It lays out minimum security requirements, or even mandate company-sanctioned security tools as a condition for allowing personal devices to connect to company data and network resources.

There is also an issue of compliance and ownership when it comes to data. Businesses that fall under compliance mandates such as PCI DSS have certain requirements related to information security and safeguarding specific data. Those rules still must be followed even if the data is on a laptop owned by an employee.

In the event that a worker is let go, or leaves the company of their own accord, segregating and retrieving company data can also be a problem. Obviously, the company will want its data, and there should be a policy in place that governs how that data will be retrieved from the personal laptop and/or smartphone.