If you saw a recently-fired employee wheeling a bulging filling cabinet out the front door of your office, you would be right to be concerned at the threat to your business.
But companies without a firm policy on letting staff bring their own technology to work with them are leaving themselves open to just this kind of threat. Because if someone has access to your corporate data on their privately held smart phone or tablet, just how are you going to stop them walking out that same door?
It is this kind of potential threat that is leading some commentators to re-christen the BOYD acronym from Bring Your Own Device to Bring Your Own Disaster.
As a trend, the consumerisation of IT has been around for a while and is showing no signs of slowing up. As the power of consumer-oriented technology continues to ramp up and the relative cost drops, there is no longer much of a functional difference between the processing power of the PC on the average executive’s desktop and the tablet or even smart phone in their pocket.
And if the company that executive works for has a virtualised desktop environment, then the odds are that their own devices are much more powerful than the thin client in front of them each day. So why not let them use it?
Complicated and dangerous
It’s a compelling argument-reduce hardware refresh costs by allowing people to use whatever devices they want and enjoy productivity increases as a result. It stands to reason that connected employees will be happier employees, so what’s not to like? As it happens, quite a lot.
"This is a complicated and dangerous area and people don’t realise the threats they can expose themselves to," said George Dowling of Ergo.
"There used to be a perception that you’d get a cost saving if you implemented a BYOD policy, and that can actually happen. But if you do it properly then it actually costs about the same as a refresh, because you have to invest in software and technology to do it responsibly. It’s only cheaper if you let everyone plug in without taking any precautions."
Dowling suggests that if companies don’t have a policy on how to handle people using their own devices at work, then they need to get one-and soon. "People will work the way that’s easiest for them to work, and usually companies are behind when it comes to keeping up with societal changes," he said.
iPad tip
According to Dermot Williams of Threatscape, the tipping point in the BYOD debate happened around the time Apple’s iPad device was released. "The iPad was the device that every senior executive suddenly seemed to have and want to connect into the corporate network with," he said.
"If you’re an IT manager and a junior ranking executive appears at the end of your desk with their latest cool new smart phone, wanting to use it to access work data, then it’s relatively easy to say no. But when the CEO does the same thing, wanting their iPad hooked up to the e-mail, then it’s a lot harder."
"For a lot of organisations, the real shift in this area happened when senior executives with the clout to demand rather than request that their devices be plugged in started to do just that. That was almost like a starter pistol, sounding out to the whole BYOD movement."
Before this point, Williams says the simple and easy solution to the problem was to just say no.
"We used to say ‘keep your toys at home and play with them there’, but now that isn’t an option anymore. We need to have a more nuanced conversation with our employees, to negotiate this territory and accommodate reasonable requests while at the same time safeguarding the security of the organisation," he said.
"After all, for an IT manager to lose control of where data is being accessed from and what it’s being accessed on is actually a very big deal."
This is something that Michael Conway of Renaissance understands only too well.
Agenda pressure
"There is huge pressure on organisations to accommodate the BYOD agenda. Everyone in the IT department knows that once Christmas comes, there will be a fresh batch of smart phones and tablets landing on their desks with requests to plug them in," he said.
"There are some benefits to embracing the idea-there is a lot of good technology out there that otherwise might not find its way into a corporate setting. People undoubtedly work hard and longer if they are able to make use of mobile technology. But if it’s not done right, then you end up with a load of different technologies that the company doesn’t own but which contain corporate data."
Conway suggests that the average company probably already has staff using Apple, Blackberry and Android smart phones as well as tablets, laptops and PCs at home, and even though some of these devices might never come near the office, the odds are they still used to access data.
"The thing to do with BYOD is embrace it, but also control it. It’s none of your business what’s happening on someone’s iPhone or iPad-that’s a private matter- but it is your business how well your data is looked after. You have a duty of care to shareholders or other people if there is identifiable personal information in there," he said.
"If you give an employee full access to a data base or mail history and they’re accessing it on a mobile device or remotely from the office, then if you fire that employee, or they leave to go to a competitor, then potentially they still have access to all that data. That could be commercially very damaging."
"If you lose that data, then you have a problem with the data protection legislation that governs such matters. Your disaster could be that you lose your corporate data base, or that you end up with an action against you for negligence, or that the data protection commissioner is knocking on your door-all over a device that you have absolutely no control over and no ability to demand control of."
Popularity
A survey of 4,000 enterprise employees across 16 countries carried out by Accenture in December last year produced observations that will not surprise observers of the trend towards BYOD – lots of people are doing it and the number is growing. The Consumerisation of Enterprise IT research found that despite employers’ concerns around data security and IT protocol, almost one in four (23%) people regularly use personal consumer devices and applications for work-related activities.
Employees claim that such technologies enhance innovation, productivity and job satisfaction, and more than a quarter (27%) said that they would even be prepared to pay for their own devices and applications to use at work. A further 45% of the employees surveyed said that that personal consumer devices and software applications are more useful than the tools and applications provided by their IT department.
Disengagement
"Some companies have a policy of just not allowing any kind of private devices to have any interaction with corporate resources. In effect they’re trying to just not engage with the issue. They look at it and don’t see an upside to the organisation so they don’t do it, and as a consequence they’re avoiding the debate," said Paul Pollock, senior executive in Accenture Ireland’s technology practice.
"But this is a debate that is happening whether you’re involved in it or not. And the reality is that if you don’t engage with it, your employees will. They’ll find ways around restrictions because they’ll do what makes their lives easiest. They’ll use consumer cloud services to move data around to allow them to work at home or on their tablet, and when that happens that means your data is no longer resident on your hardware. That’s the risk you run-that employees who are trying to do the right thing to get the job done, to further the goals of the business, will breach your policies."
So if it’s inevitable that people are going to use their personal devices while doing their jobs, what’s the best way to handle the security issues involved? Let everyone use whatever they want, let some people use some of what they want, or let nobody use any of what they want?
Do what thou wilt
"There are two different audiences in terms of mobile security requirements. The first audience is using devices that are owned, supplied and intensively managed by the company. They are not hard to manage. If you own the device, then effectively you can choose to manage it any way you like-you can set the rules," said Williams.
"So if the person who uses the device leaves it in a taxi or it’s stolen, then you can remotely wipe everything on it without too much thought."
But if you do not own the device, if it is someone else’s personal property that they just happen to use company applications and data on, then things are not that simple. "In that kind of situation, you can’t really remotely wipe it-what if they find it the next day and realise that half their life has gone with the data wipe, personal phone numbers and pictures of their kids?," said Williams.
The solution lies in the latest generation of mobile device management systems that are capable of distinguishing between different kinds of data on mobile devices. Some, like those offered by Symantec’s recent acquisition Nukoma, offer data and app wrapping capabilities.
"This allows people to use their own devices to access company data, wrapping around those apps an extra layer of security governing whether or not they can store files remotely, what level of encryption is involved or adding an extra layer of authentication. Companies can set up their own private app stores where employees can download apps that are wrapped this way," said Williams.
Part of the challenge facing companies putting in place an IT-based solution to keeping their data safe in the wild is how to handle the wide variety of operating systems and platforms out there. The average corporate workplace has iPhones, iPads, android devices, Windows devices, BlackBerry devices and more-how can one solution manage all these?
MJ Flood Technologies uses a platform-agnostic product from the US-based Zenprise to do the job.
"In the past, when companies took on Blackberry devices or if they deployed Windows Mobile, then there were management tools that suited the management of those devices. But there is a lot more variety in the market now and we have seen real consumerisation of the technology in the average business person’s pocket," said Guido Marchetti, a mobile device management specialist with the firm.
"The tool that we use is Zenprise and it allows companies to introduce policies around the way these devices are used. You can take personal devices into your corporate environment and separate the personal profiles that exist on those devices from the corporate profiles needed to access systems like e-mail and Sharepoint."
"This separates the two and gives you ownership over the data on those devices that directly affects you. In the event that, for example, the employee that owns the devices leaves the company, at the click of a button you can extract all the corporate data off the device including contacts and calendar data and leave the personal profile intact," he said.
Fujitsu too has developed a similar service based on the Zenprise system whereby any corporate data downloaded to a managed device can be tagged. In the event of that device no longer being managed, for whatever reason, it can be remotely wiped of all corporate data, without any impact for the rest of the device.
Systems like this work regardless of the platform on which the personal device is running.
Ltd
