Side by Side: To BYOD or not to BYOD?

For our third instalment, we’re looking at how growing numbers of firms are allowing employees to Bring Your Own Device (BYOD) to work.

It’s estimated that seven out of 10 small businesses in the UK now have a BYOD policy.

There is evidence that BYOD has cost and productivity benefits for businesses, but it does also raise potential problems, especially around data security.

Research has found an increase in the number of cyber security incidents reported by firms after they introduce a BYOD policy. This included being infected by malware and viruses, distributed denial of service attacks, data theft and phishing.

So, how can businesses make sure they benefit from all the advantages of BYOD, while also protecting themselves against the potential pitfalls?

We spoke with Mark Hill, chief information officer at global IT recruitment specialist Nigel Frank International, and Jon Fielding, managing director for Europe, the Middle East and Africa at Apricorn, which develops secure data storage solutions for business, to get their views on how organisations can make the best of BYOD.

BYOD is a no-brainer – if you stay safe

Mark Hill, chief information officer at global IT recruitment specialist Nigel Frank International, explains why BYOD was a no-brainer for his business:

“On the whole, we have a young, tech-savvy workforce who expect to be able to connect and work in a digital way from their own devices.

“Also, given that we have almost two thousand employees, it would be pretty costly to supply everyone with a second company device, that, in all honesty, they don’t really want.

“Allowing them to use their own devices, which they’re already familiar with and are personally responsible for, removes a huge burden for IT.

“However, it has to be done in a safe way, and you need to really consider what is important data.

The freedom of BYOD needs protection

“The solution we chose is fairly simple to implement and also mature - Mobile Device Management (MDM) security software that can be used by an IT department to monitor, manage and secure employees' mobile tech.

“There are many great MDM technologies out there, and by using these tools we’re able to enjoy the freedom of BYOD and the protection of company data, thanks to a range of methods including encryption and multi-factor authentication.

“Trust me — taking this road is a win-win. The only downside is that people need to accept a degree of company control over their devices, and you absolutely must ensure your staff sign up to the appropriate policies and procedures.

Education about device security empowers employees

“Education is also key; providing continuous company-wide updates and training on security threats helps empower employees to take responsibility for the security of their own devices, and that of the business at large. 

“For us mobile and tablet is only the first step. 

“We’re now looking at other ways to broaden the BYOD approach to further empower and enable the workforce to securely work anytime, anywhere, on any device.”

Balancing benefits with risk 

Jon Fielding, managing director MDEA at Apricorn, explains why making a success of BYOD is about balancing the concerns of the IT department with the expectations of users, without either side having to compromise the way they work or deal with increased risk: 

“IT departments have no knowledge of the security profile of users' own devices, and therefore have to manage and mitigate the inherent risk in allowing BYOD. 

“This could be by limiting the user to a selection of the services normally available, such as only providing email access, or by installing Virtual Desktop Infrastructure (VDI) on the employee’s hardware, where the desktop operating system is hosted on a remote server. 

“Neither approach is ideal as the employee is limited in the work they can perform. Plus, they can find themselves in a clunky User Interface that they’re not used to, while IT is potentially having to manage software deployment onto a range of different hardware and operating systems.

Enabling unfettered access

“The ideal scenario is to allow employees to bring in their own hardware, and to provide them with unfettered access to what they need via a working environment with which they’re familiar. 

“For this to happen, IT needs to be able to trust and manage the hardware as it would any endpoint it has deployed itself. 

“The IT department can achieve this by deploying its own desktop image, which includes all control and security protocols, to run on the user’s computer while their hard drive (which is by definition untrusted and unmanaged) remains offline.

A familiar working environment

“Today, IT can simply take the standard laptop build that it deploys onto the business’ laptops and place it onto a USB stick. 

“The user then loads the image from the USB onto their own hardware, launching a familiar working environment that has been locked down by IT. 

“The USB stick used needs to be robust enough to run a full desktop image; the data transfer rate is much higher than that required to write the occasional document, which can lead to devices burning out if they’re not built for purpose. 

“The USB should also be hardware encrypted so that the image is fully protected if the device is misplaced or stolen.” 

Read more practical advice for IT managers on how to keep business data safe.