- [Narrator] The consumerization of technology
leads to a situation where an organization's employees
often own personal computing devices
that are comfortable and familiar.
Employees want to bring those devices
into the workplace and use them
with corporate information
to make themselves more productive.
This environment, where users bring their own devices
to a corporate environment, is known as
bring your own device or BYOD.
BYOD is a radical change in the computing environment
from a time when employers always provided
employees with computing devices,
to the current environment where many employees
choose to supplement employer-provided devices
with their own technology.
Industry analysts expect this shift to continue.
In fact, Gartner recently estimated
that within the next few years
half of all employers will require
employees to bring their own devices for use at work.
The growth of BYOD practices
brings a variety of new policy issues to the forefront.
Organizations must have clear guidelines
about BYOD that specify who may bring
devices to the workplace,
what types of devices they may bring,
and how the security configurations
of those devices are managed.
How will the organization ensure
that BYOD devices comply
with the security requirements necessary
to safeguard sensitive information.
The use of BYOD often requires
significant adjustments to an organization's
acceptable use policy.
The core issues around BYOD relate to ownership.
In the old environment, the company owned
both the data and the device
and clearly had responsibility for supporting both.
In a BYOD environment, the user may own the device
and both the user and the company
may own the data.
Unless policy is clearly defined,
IT staff may find themselves
in a situation where they don't know the scope
of their support services.
These ownership issues also bring legal
and privacy concerns to the forefront.
Users should understand what monitoring will take place
and consent to any monitoring software
installed on their personally owned devices.
It's unlikely that users will accept
the installation of intrusive software
on a device that they purchased themselves
anymore then they'd accept
the company installing security cameras
in their cars or homes.
These privacy concerns may also have a legal basis,
and organizations implementing BYOD policies
should consult with their attorneys
to determine what requirements may exist
in their industry and jurisdiction.
When an organization decides to adopt
a BYOD policy, it should develop clear guidelines
for the onboarding and offboarding of devices.
These should specify what data may be stored
on personal devices and how it may be used.
During onboarding, IT staff should ensure that
the device meets organizational security requirements
and is safely configured.
When a user leaves the organization
or is preparing to dispose of a device,
IT staff should then conduct an offboarding process
that ensures all sensitive corporate information
is removed from the device.
This may be a time-consuming process
but it is vitally important
to ensure that corporate information
doesn't fall into the wrong hands.
Finally, IT staff developing BYOD policies
should consider the technical implications
on their architecture and infrastructure.
When the organization purchases devices,
it's easy to standardize on hardware,
operating systems, and applications.
When users bring their own devices, however,
this standardization is often impossible.
BYOD organizations must be prepared
to support a wide variety of hardware,
operating systems, and applications.
Some of the specific technical issues
for BYOD devices include whether the organization
will use mobile device management
to control the configuration of BYOD devices,
how the organization will ensure that BYOD devices
are regularly patched and contain
appropriate antivirus controls,
whether the cameras on BYOD devices
will be permitted to take photos and/or video
in company facilities,
and what procedures the organization will follow
in the event of a BYOD device compromise.
For example, will they perform forensic analysis
on personally owned devices?
BYOD is a trend that is here to stay.
Every organization, whether it intends
to allow BYOD, require BYOD,
or ban personally owned devices entirely,
should have a clear, written policy
on the matter that is known to all employees.