Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

BLOG: The unintended consequences of forced BYOD

Galen Gruman | May 14, 2013
When personal equipment is required to handle business data and processes, say good-bye to traditional notions of corporate power

Even with the pretense involved, the foundational architecture skews toward protective separation of business and personal, whether through encryption, password and remote-wipe policies, app containers, VPN access, virtual machines, Web-based access to back-end-maintained data, dual-persona mobile devices, and/or any of the other mobile application and information management techniques available.

That foundation goes away when you require BYOD. Even if you tell an employee which smartphones and tablet models to choose from  similar to how "buy your own uniform" works  you can't tell the employee which personal apps and services to use on their device. Complex, ever-changing passwords also become unlikely requirements to enforce; after all, most of the day, that smartphone is used for personal activities. Who wants to keep entering a password to be able to tweet or see a family photo?

I suppose a very authoritarian company  they do exist  could get away with making employees pay out of pocket for a specific device and subject it to complete IT control so that no personal apps or data could be used on it. This is akin to not only buying your uniform from only this supplier, but also ensuring it is kept clean and pressed. But that kind of company will have problems keeping workers not otherwise desperate for a job or utterly lacking in self-respect. If a company wants that level of control, it needs to at least buy the equipment in question.

You might think the "use your own car for business travel" approach would fit a forced-BYOD environment. After all, companies routinely refuse to pay for company cars for most employees. Yet for customer-facing employees, they require liability insurance (sometimes even policies that indemnify the employer) be maintained. They sometimes even require the employee maintain a level of appearance for the vehicle. That sure sounds like BYOD, right? "Use your own smartphone, but make sure it meets our core security requirements, which we'll check when you connect to Exchange or our MDM server or by having you install our app container for work access."

But unlike a car, a smartphone, tablet, or PC intimately interacts with business data and processes. That smartphone, tablet, or PC becomes part of the basic operational framework for the business, but the business has ceded it to the employee. The relationship is now more akin to the business outsourcing IT, relying on it to protect its data and ensure its processes -- except that each employee is an independent outsourcer, creating a fundamentally unmanageable mix.

 

Previous Page  1  2  3  Next Page 

Sign up for CIO Asia eNewsletters.