I have worked closely with companies who have quite relaxed
policies on BYOD (Bring your own Device).
They liked the idea that if an employee wants an iPhone, this was OK,
as long as they paid for it. Personally;
I blame Ryanair. People are always telling me what a clever business Ryanair
is. They even charge their employees for
training and uniforms.
I’ll resist the Ryanair tangent for fear of this turning in
to a customer service rant and I have strong views on business culture. My point, however, is a simple one. A BYOD device is another device on your
network. It’s a MAC address with a set
of permissions. Allowing a BYOD access
to a network or allowing access to your corporate email system can be little different
from allowing an uncontrolled device to connect up remotely to your business critical
data.
Socially it is expected. It might be small and hugely featured but it’s easily lost
and exposes the weak underbelly of your whole business system. In short; it’s a disaster waiting to
happen. Your BYOD is possibly linked to
a cloud service such as Dropbox or iCloud.
It’s a high resolution camera which might be used to photograph that
White Board so you can write up the notes later.
Remember James Bond with his mini cameras in the classic Bond
movies? Well now we all carry one. Ours are better actually as they don’t need
developing and they transmit and sync our images almost instantaneously to the
cloud whilst our phone is in our pocket.
Now let’s look at email.
I know of situations where member’s of staff have had both personal and
work email accounts on the same BYOD. This
enabled them to forward work email to their home account (with attachments) with
no record on the business exchange server other than the email had been read! This is a security haemorrhage point and
nobody really seem that bothered.
Of course you will be thinking that the Cloud services,
email policy and even the camera could be controlled in a switched-on company. You are probably right and of course they
should be. My point is really one of
attitude.
We all carry these devices with Gigabytes of data on them in
and then out of our business worlds.
They soak up data and information about our habits and movements and
they record highly sensitive data.
BYOD need to be controlled – just like any other business critical
device. Ownership actually complicates
the situation. They need to be controlled,
audited and the risk assessed. Staff
need to be trained. Ownership of the
data needs to be considered with great care and attention. Policies need to be written, implemented and
measured. People need to be
trained. BYOD is not a panacea to cheap
technology infrastructure. BYOD could
become your worst nightmare.
Lastly; what happens when the employee leaves? Is the demarcation
of personal data and business data a clear one? – probably not. If their personal iPhone has been linked to
their home PC (and it probably will have been) then you don’t just have the challenge
of you data being on one device but probably many. Not only that but you probably have no idea
where your business data is.
By its very nature BYOD puts your data in an uncontrolled environment. Phones and tablets are lost and stolen in
huge numbers every day. On average a
London taxi has a phone left it in once every day! The disposal of data and devices upon leaving
the business is an HR minefield and a risk most businesses haven’t even
considered.
Bring you own device? - Bring your own Databreach!
