Excellent point, Jason. There really is no good way of controlling it these days. Either you allow BYOD and implement a policy and simply prepare for the worst or you disallow it. It really seems to be as simple as that, at least for now. It's a lot cheaper for businesses to allow BYOD though, sense they don't have to supply the device and often don't pay the plan, so it's a risk I can easily see being taken.

@Kim

That's a fair point.

I would say, though, that there's a big leap from allowing employees to bring their personal device for personal/entertainment purposes, versus inviting them to officially bring their personal device onto work WiFi, to conduct official business on their personal device, to have your IT dept. manage their personal device, etc.


I think the former is, as you say, simply inalienable reality.  The latter, is more of a choice.  If you choose to embrace managing employees' personal devices, at least be prepared for legal fallout when one of your IT folks snoops on some employees personal pictures, etc. and you get smacked with a suit.

Disclaimer: from a cynic of managed/for-work BYOD...

Dr T, you're right on the money.  With the exception of some high security, high awareness enterprises, BYOD is a fact of life.  It's not a question of whether you want it; it's a question of how you manage it.  Unless you're going to shake down your employees every morning and confiscate their phones.

@DHCIR

Interesting link, definitely agree with most of it.

I think the real problem is the fact that BYOD is so beloved by so many employees who don't really understand it.  If you don't explain things in a clear and concise way ("Maybe you want us to manage your own personal iPhone, but do you really want pictures of your romantic vacation mixing with your work account?") you're just going to get backlash.

Or worse yet your policy leaks and media pundits patronize your company for being "backward", again not realizing the valid reasons not to mix private, possibly insecure devices onto secured business networks.

That which some might label as phobia others might consider a prudent desire to avoid decisions before analyzing all the factors, combined with realization that the enterprise has other priorities than analyzing the factors surrounding BYOD. 

Disclaimer: I've already confessed to being a BYOD hypocrite.

Thought provoking article Jason, good job. Decent article here along these lines: http://blogs.technet.com/b/trustworthycomputing/archive/2012/08/17/don-t-let-byod-backfire-on-your-business.aspx

RE: "As for companies that never go there in the first place, it's important to establish a clear logical justification for your beliefs." Hmm, definitely agree. How about simply this, let's say coming from your average Corporate BYOD Opponent\Security Nazi:

"KEEP ALL THAT SH*T OFF THE COMPANY NETWORK because I (or IT Security team) say so!" With all the technological issues with trying to secure all this...stuff, shoddy code, backdoors, unsecure software & devices right out of the box, why induce EVEN MORE risk than necessary to allow BYOD just to satisfy the fidgety ADHD technophiles in your organization?    

When I joined my company, I already had a phone and a tablet. I don't even know my company's BYOD policy -- although I'd imagine we have one. But I haven't pursued it because we have a family plan, for one thing, that wraps all three phones and one iPad together. Plus, although I often use my cell for business calls, texts, and social media, I don't do any other work on it. It would be an additional headache for me to even consider requesting either a second phone for work, or worrying that corporate IT had the right to monitor my cell phone. 

Thank you for the information, Jason. The way I see it, BYOD is already a reality for many organizations without a proper MDM, so what is lacking is management of it. BYOD is not a technology, it is a trend and that goes with human nature quite well. Many organizations are not even aware of the fact that they are living through it. For security of BYOD; conventional security practices would not be addressing it properly. What needs to be secured could not be the device itself, that is not practical and too much restriction on a personal device. What is important is to find a way to implement a MDM policy that can isolate personal and work data and applications and focusing on securing work related application and data rather than device itself.

I'm not surprise that there are still a lot of BYOD holdouts, but it is getting harder to separate between work/life. As an example of this, we're seeing more people than ever carrying two phones and two laptops, one for each. That seems a bit ridiculous to me, but has to be done in many circumstances. 

I'm sure BYOD is driving CIOs to BYOB!  We've heard CIO after CIO being interviewed right here on IE say that the #1 issue keeping them up at night is security, especially pertaining to customer data.  BYOD flies in the face of that.  It's only a matter of time before there's a huge security breach from BYOD, if it hasn't happened already.