Bring Your Own Device is a policy
that a lot of organizations have been adopting.
This means when you come to work,
you can Bring Your Own Device and use it on their network.
This may be your laptop, your tablet, your cell phone,
keyboards, mice, or any other type of device.
Some organizations have fully adopted Bring Your Own Device,
and others are fully against it.
We're going to talk about both and why you should consider it
or decide not to use it in your organization.
Now when you use Bring Your Own Device,
it brings a lot of security issues for you to consider.
If I have somebody's laptop
that now gets plugged into my network,
I'm also introducing all of the vulnerabilities
that device had.
So if you took your laptop home,
plugged it into your network,
downloaded a game, installed the game and got malware,
and now you plug it into work the next day,
you can bring that malware into work with you.
This is a major concern with Bring Your Own Device
because as an organization, I don't control your device,
and so I don't know the security of it,
and that's one of the major risks
with Bring Your Own Device.
Now, on the flip side,
a lot of companies really like Bring Your Own Device
because it means they don't have to buy laptops
and cell phones and all those type of devices
for their employees
because the employee is bringing their own.
And while that might save them money
and it's good for the bottom line,
there are concerns.
When the data goes on your device, whose data is it?
Is it the company's data, or do you have rights to it?
Where do you draw the line between what's personal data
and what's business data?
A lot of organizations
that have adopted Bring Your Own Device
will use storage segmentation.
This will create a clear separation between personal
and company data on a single device.
Now, there's lots of different ways
to create this segmentation.
There are highly technical solutions,
and then there's highly procedural solutions.
For example, you might have an application
on your phone that says work.
And when you click on that,
it opens up a virtual environment,
and all of your work is done from within there.
And when you exit that,
you're now back into your personal device.
That would be a clear, technological limitation
between the two.
Now, you don't always have to use
a highly technical solution.
In my company, we're very small.
We use personal devices as work devices,
and so on my phone in particular, I have two email clients.
I have one that's on Apple Mail
that I use for my personal email,
and then I have another one, which is Gmail
using the Gmail app that I use for my company email.
That gives me a clear separation between my personal stuff
and my business stuff and keeps them in separate buckets.
Now again, there's nothing really that would prevent me
from loading up my business email inside Apple Mail
if I wanted to,
except that we have a policy that says we won't do that.
So we've chosen an administrative control
as opposed to a technical control.
Another concern you have with mobile devices
under the Bring Your Own Device policy
is how do you ensure that device is always up to date?
We talked about how important it is
for patches and updates to be installed
on your mobile devices.
Well, if I give you the device,
I can install mobile device management on it.
That would allow me to have
this centralized software solution for remote administration
and configuration of your mobile device.
I can push out software policies to you,
prevent you from installing applications
and install updates remotely without your use.
But when I do Bring Your Own Device,
are you going to let me install mobile device management
on your system?
You might not.
And so this is why a lot of companies are now switching
from a Bring Your Own Device
because of all those security issues
into a Choose Your Own Device or CYOD model.
CYOD gives the employee a choice of a couple of phones.
We might have four or five models that we support,
and we say, you can pick any one of these,
and we'll pay for it for you.
Now on that device,
we can install our mobile device management.
We can create the technical policies.
We can say what is going to be used on that device.
And by doing that, we can prevent certain applications
from being installed on the device,
and we can make sure we are preventing data loss
by using DLP or data loss prevention systems on that device.
We can also turn features on and off as we want.
For example, I worked in one organization
that didn't believe anybody using a mobile device
should connect to Wi-Fi.
We were willing to pay for the cellular service
because Wi-Fi was untrusted,
and cellular was considered trusted,
so you couldn't connect
to the free Wi-Fi at the coffee shop.
Instead, we had a mobile device policy that pushed out
through our mobile device management solution
that made sure nobody could enable their Wi-Fi.
So even if you took your mobile phone home,
and you were sitting on your couch,
you couldn't connect to your own Wi-Fi.
You still had to use Cellular.
That is a policy that we decided on.
Now your organization is going to have to make sure
you decide on what your good security policy
for mobile devices looks like.
Every organization
is going to make that determination differently.
Are you going to use Choose your Own device
or are you going to allow Bring Your Own Device?
It's up to you, but make sure it's a choice
that you're making, and not just a default that's happening
because no choice was made.