Bring your own device policies: IT consumerism risks
Bring your own device (BYOD) is a trend which has taken South Africa by storm. Employees use their own smartphones, laptops and tablets in their daily work activities rather than company-issued devices. This trend is also known as IT consumerisation.
How will the BYOD trend affect your company?
Alexandra Zagury, managing director for South & Southern Africa Research in Motion (creators of Blackberry® solution), says:
“Compared to the top-down nature of technology deployment in enterprises in the past, today, we are seeing employees bringing their own productivity-boosting devices and services to work,” says Zagury. “This trend towards consumerisation is being driven by the advent of devices such as smartphones that allow people to access personal and work services seamlessly wherever they are.”
As a result of BYOD, there have been increases in productivity, efficiency and worker satisfaction and morale. It also proves to be cost effective for employers as they do not need to ‘splurge’ on brand-new devices or repairs to existing devices.
However, before companies embrace the trend with open arms, they must consider its negative implications.
The dangers of BYOD
For businesses, BYOD comes with a certain amount of risk. Companies do not have full control over the devices, which means that company information and records are not completely secure.
Organisations may also have to pay for employees’ phone bills outside of company time.
The press release ‘Bring your own device – it’s personal’ by Dana Jedrisko, states that this trend is a danger ‘not only for network access control and data security, but also employees’ privacy.’
Consequently, IT and HR departments began considering BYOD policies which would limit the privacy and security risks. According to CIO, companies who want to create effective BYOD policies should keep the following guidelines in mind:
1. Limit device types
In today’s business environment, various devices are available. In the past, you could only use, e.g., Blackberry phones for work. Now, your organisation must specify what will be included in the BYOD policy so that your employees know what type of devices you can access sensitive company information with.
2. Implement security policies for devices
Passwords and keypad locks are non-negotiable for personal devices. Although security measures may slow access, these are necessary to protect the sensitive company information accessed by these devices.
Passwords should be complex and contain numbers and letters. Here is an example:
Freef@ll#12>
3. Identify service policy for devices
Set boundaries regarding available services about personal devices. Remove any ‘grey areas’ for employees by answering the following questions:
- What support will you provide for initial connections to your organisation’s network from personal devices?
- What is your policy regarding broken devices?
- Are device applications supported?
- Will your helpdesk extend its ticket log to personal devices?
4. Clarify ownership of applications and data
Your organisation owns personal information stored on its servers and your employees connect to these with their devices. Problems arise when employees’ devices are stolen or lost. Some companies may stipulate that the lost device must be wiped (cleared of all information and data). Unfortunately, the wipe deletes all the content on the device including employees’ personal documents, pictures and/or music. In this situation, employees have paid for the information and/or applications, not organisations.
Your organisation must expressly assert ‘wiping’ rights in its policy. A protective measure for organisations is to provide a back-up system for employees so they can restore any information that was lost if a device is wiped.
5. Applications: Banned or allowed?
Examine all applications for social media networking, e-mail replacements and remote-access software.
Can employees download an application that could present a security risk to company information?
6. Align your BYOD policy with your acceptable-use policy
Company-issued devices will already be covered by the acceptable-use policy. However, personal devices that access your virtual private network may cause uncertainty regarding permitted and forbidden activities.
For example, what happens if an employee accidently broadcasts offensive material over your organisation’s network on their personal device?
7. Establish employee exit strategies
What procedure do you follow when an employee with a device on your BYOD network leaves the business? How do you ensure that an employee removes all access tokens, e-mail systems, data and applications?
One option is for companies to disable e-mail access as a requirement during the exit interview. High-security organisations may make it compulsory to wipe devices when an employee leaving. If you choose this option, provide the employee with a means of backing up his or her personal data.
Author: Frew Murdoch is the assistant editor of HR Pulse. She is currently studying towards her BA degree in Communications and English. "I stumbled across your review of our Ethics Guide published 28 June 2012 and wish to thank you for the positive and complimentary comments made – this was a lovely surprise and most rewarding. I will certainly pass this on to all co-authors of the Guide."
Christine Botha, co-author of 'Ethics in HR Management: A guide for HR professionals and line managers', had this to say:
