Mobile Security - How BYOD Affects your Small Business IT Security Policy - IT Services in Denver | Denver IT Support

Like many business owners today, you’re probably delighted with the increased mobility among your team, thanks to the ever growing use of smartphones, tablets, notebooks, and lightweight laptop computers. The increase in productivity alone, when you and your employees become more mobile, is enough to make any business owner smile; while the thought that they have bought their own devices to use for your business can make you grin all the way to the bank. The money they’ve saved you!

However, as your Denver IT services experts, we feel the need to warn you that there may be unintended consequences to the use of BYOD (Bring Your Own Device) for businesses; consequences which may be harmful – and expensive.

Are your Employee’s Personal Devices Compatible?

The trend toward BYOD is so strong that many companies are doing more than merely permitting the use of personal devices for their employees, they are encouraging it, with subsidies for the use of personal smartphones: for example, where the company pays a portion of the employee’s monthly cell phone bill. Other companies are also subsidizing the cost of internet access for mobile employees using personal tablet or laptop computers to stay connected for work purposes.

Of course, the beauty of BYOD is that your employees will be able to use devices with which they are comfortable and familiar, making them more productive, regardless of location. On the other hand, many of the most popular devices on the market today simply do not play well with each other. For example, the OS for the Apple iPad may not be compatible with your server software, requiring a series of fixes and tweaks that will only add to the cost of IT; while the latest Surface tablet technology from Microsoft may be fully compatible right out of the box. What to do, what to do?

What does BYOD Mean for Mobile System Security for your Small Business?

As a result of the increase in the use of personal devices for business, many companies are now scrambling to develop comprehensive plans for BYOD programs. BYOD, which stands for “bring your own device,” is a simple way of describing a scenario in which employees of a company use their own devices, such as smartphones and tablets, to access the company’s network. It’s very common in many industries that employees will have their work email or work documents on their mobile phone or laptop. While this may initially simply seem like a very dedicated way to get extra work done, it actually represents a significant security risk.

If your company’s computer network can be accessed through an employee’s device, then your network is only as secure as the employee’s device. Confidential client information, such as health records, invoicing and payment history, or other confidential records, could potentially be released to the public if a mobile phone, tablet, or laptop is lost and falls into the wrong hands. Companies have needed to develop response plans and protocols for the management of these critical security issues.

Mobile Device Management, or MDM, is one method that companies may use to reduce the risks inherent in BYOD. MDM systems offer the opportunity to create different types of security policies relating to particular types of devices. This creates an additional layer of security between an employee’s device and the company network, and it means that the link between the employee’s device and the network can be severed at any time. Disgruntled employees that have separated from the company are one of the leading causes of information breaches.

Device usage and security protocols must be established, and put into place, to control exactly what an employee is allowed to access on their personal devices, and what they need to do to access them. Proper password maintenance, for instance, is absolutely essential no matter how secure the network itself may be. Employees need to be taught to use different passwords for their work accounts and to change their passwords regularly. Employees should also be taught about which types of passwords are difficult to crack and which are unsuitable.

Overall, it’s impossible to entirely remove a BYOD program. Employees will almost always wish to do some work on their personal devices, and the ability to do work on a personal device increases an employee’s productivity overall. Rather than focus on limiting or removing BYOD programs, companies need to create clear and strict protocols regarding the use of these systems – and follow them.

Above, we introduced the concept of “Bring Your Own Device” for companies with employees using personal devices for business purposes: smartphones, tablet, and laptops which are owned by the employee, yet used to increase productivity at work. While many businesses appreciate the ingenuity and commitment of employees willing to indulge in this practice, as your Denver IT support specialists, we are familiar with the drawbacks of such a system.

Beyond the security questions discussed in our earlier, there are also ethical questions regarding BYOD which must be asked – and answered. Obviously, if you, as the owner of a business buy and distribute mobile devices to your employees, you have every right to install the applications and software they will need, as well as restricting access to apps you do not wish them to access. This goes without saying. Yet, what if your employees begin to use their own devices to enhance their performance? What rights do you, the employer, and they, the employee, have when it comes to internet access, productivity tools, email services, texting, and/or instant messaging, etc.?

The Ethics of BYOD for Business

Using a personal mobile device for business creates questions that may not be quite as simple to answer as, say, using a personal vehicle to visit clients, with a car allowance paid by the company. Obviously, if your employee uses a portions of said car allowance to install new tires, those tires remain with the car if he or she should leave your employ. What happens to the version of Office you installed on their laptop though, if they should happen to leave? Who retains the license and, will you even be able to get it back if you uninstall the app from their personal computer? These are just a couple of the questions that cry out for answers when your employees bring their own devices to work.

If your employee owns a mobile device, who owns the license to the software and apps you install for them to use on your behalf?
Can you restrict the numbers and types of apps your employees are allowed to use on a device they have purchased for themselves, in an effort to keep your network secure?
Can you “force” employees to buy certain devices, as personal property, to be used exclusively for your business?
Can you shield your employees’ personal devices from certain activities for security purposes, such as accessing their Facebook or Twitter accounts, when they are working on a personal device?
Does your IT staff have the right to fiddle with and probe the internals of the personal property of your employees?
Does company email remain company email of accessed on a personal device?
Do you, as their employer, have the right to “wipe” the personal device of an employee if they should leave your employ?
If you do wipe the employee’s personal device, how can they protect their personal data?
Who is responsible for lost data if a device is lost; the company or the employee?

These and many other questions must be asked when employees begin using personal devices for company functions. The trade-offs between, and ramifications of, increased productivity vs. personal property rights, not to mention personal security vs. company security, are both broad and deep. With these things in mind, the only possible solution that we can see is to structure a comprehensive agreement between the company and any and all employees who choose to use personal devices for business. While this may not cover every eventuality, it will certainly help to clear up some of the confusion inherent in a BYOD business relationship.

Earlier, we discussed some of the security and ethical ramifications of permitting employees to use their personal devices for business. While we fear we may have asked more questions than we’ve provided answers, we must admit we have a few more to offer about this increasingly popular practice and we hope to offer you those answers.

North Star offers Mobile Device Management solutions for this ever-expanding dilemma.

If you’re struggling with what to do in your small business, North Star has a few solutions that are for your Mobile Device Management. Denver area businesses can call us at 303.552.0018 to schedule an appointment to develop your custom internal Mobile Device Policy.

Another solution we offer is for your business mobile security and management needs, and for just pennies per day.

Protects against device loss and theft
Tracks devices

Empowers BYOD employees – staff work quicker, more efficiently, more effectively and flexibly through devices of their choice, accessing company systems and data securely
Enables cost control with asset visibility and expense management
Doesn’t compromise productivity or privacy for either your business or employees

It’s one solution for what you need –

Tracking of mobile devices
Device lock, wipe and reset
Pin control and automated configuration
Works across a range of mobile devices – iOS and Android

BYOD and Your Small Business IT

Far beyond the security and ethical questions of permitting, or even encouraging the practice of BYOD for business, there are broad questions of the practical use of myriad devices in an effort to increase the mobility and productivity of your team. For many companies, the overwhelming argument in favor of BYOD is found in cost saving; the reduced capital investment for the company when employees purchase their own devices for business use.

At first, this seems to be a no-brainer, for if the company is not forced to buy a dozen $1000 tablets for their sales team for example, the saving is obvious. However, if your 12 person sales team should purchase 12 different devices, which may have diverse and conflicting operating systems and apps, your IT team will be forced to spend untold hours creating fixes and resolving compatibility issues that may easily run into dozens of hours – and thousands of dollars; reducing your savings to nil, and possibly increasing the cost of your investment.

As an example of this, let’s take a quick look at the inherent difficulty of using Apple devices in a business network. Despite the loyalty of Mac and Apple users, networking these devices in a Windows-based system for example can be incredibly difficult. The simple reason for this is – Macs, iPhones, and iPad tablets are all built with different operating systems. As crazy as this may seem to those of us who have been in the IT business for a while, this can make networking Apple devices difficult among themselves, much less networking them to Windows and Android-based mobile devices.

Allowing your employees to feel comfortable using their favorite mobile devices may be a good thing indeed, keeping productivity levels high but, if your IT team is forced to spend multiple hours maintain a network of incompatible devices, the savings you had hoped to realize may instead be lost very quickly.

What are the Biggest Hassles for BYOD and your Small Business IT needs?

Beyond the sheer lack of compatibility between the various devices your employees may choose to purchase for business use, your IT team will be forced to deal with a number of other problems as well:

Operating systems which do not “play well together.”
Fixes do not work for every device, forcing your IT team to figure out a “new fix” for each device.
Lack of consistent performance parameters and capability among devices.
When an employee leaves, what happens to any licenses, and what happens to the data owned by the company?
Can the device be “wiped” remotely if the employee leaves under a cloud?
Can company data be wiped without harming personal data storage?
If all work is saved to the company server or in the cloud, rather than the device, it remains secure and does not require wiping; but, how can you guarantee this will be done on each and every personal device?
Personal information may be stored on the device, along with secure business info.
The employee’s entire family may be using the device at home, with apps that have nothing to do with business, but may interfere with the operation of the device, inhibiting productivity.
Can the employee be trusted to protect company data on a personal device?

There are, in fact, many more practical questions which require answers when you allow or encourage your employees to use personal devices for business. Setting up protection of company data alone may be cost prohibitive in a BYOD environment, beyond the other practical problems outlined above.

For more information on BYOD, as well as the rewards and pitfalls for small business owners, see these articles:

· BYOD: 10 reasons it won’t work for your business

· BYOD security strategies: Balancing BYOD risks and rewards

· ‘Bring Your Own Device’ trend poses problems for businesses, employees

· Scary BYOD Data Protection Trends: 10 Common Problems

· Can organizations implement BYOD policies and still keep sensitive data secure?

If you are looking for help answering questions like these, or help in the implementation of a BYOD network for your small business in the Denver area, please do not hesitate to contact us with your IT service request for help with your operating system, apps, servers, or any other IT issues you may have.