-: Bring Your Own Device is a policy that
a lot of organizations have been adopting.
This means when you come to work,
you can bring your own device and use it on their network.
This may be your laptop, your tablet, your cellphone,
keyboards, mice, or any other type of device.
Some organizations have fully adopted Bring Your Own Device,
and others are fully against it.
We're going to talk about both, and why you should consider it,
or decide not to use it in your organization.
Now, when you use Bring Your Own Device,
it brings a lot of security issues for you to consider.
If I have somebody's laptop that
now gets plugged into my network,
I'm also introducing all of the
vulnerabilities that device had.
So, if you took your laptop home,
plugged it into your network, downloaded a game,
installed the game, and got malware,
and now you plug it into work the next day,
you can bring that malware into work with you.
This is a major concern with Bring Your Own Device
because as an organization, I don't control your device,
and so I don't know the security of it.
And that's one of the major risks with
Bring Your Own Device.
Now, on the flip side, a lot of companies really like
Bring Your Own Device because it means they
don't have to buy laptops, and cellphones,
and all those type of devices for their employees
because the employee is bringing their own.
And, while that might save them money,
and it's good for the bottom line, there are concerns.
When the data goes on your device, who's data is it?
Is it the company's data, or do you have rights to it?
Where do you draw the line between what's personal data,
and what's business data?
A lot of organizations that have adopted
Bring Your Own Device will use storage segmentation.
This will create a clear separation between personal,
and company data on a single device.
Now, there's lots of different
ways to create this segmentation.
There are highly technical solutions,
and then there's highly procedural solutions.
For example, you might have an application on your phone
that says work, and when you click on that,
it opens up a virtual environment, and all of
your work is done from within there.
And when you exit that, you're now
back into your personal device.
That would be a clear technological
limitation between the two.
Now, you don't always have to
use a highly technical solution.
In my company, we're very small,
we use personal devices as work devices,
and so on my phone in particular, I have two email clients.
I have one that's on Apple Mail that
I use for my personal email, and then I have another one,
which is Gmail, using the Gmail app that
I use for my company email.
That gives me a clear separation between my personal stuff,
and my business stuff and keeps them in separate buckets.
Now, again, there's nothing really that
would prevent me from loading up my business email
inside Apple Mail if I wanted to.
Except that we have a policy that says we won't do that.
So, we've chosen an administrative control,
as opposed to a technical control.
Another concern you have with mobile devices
under the Bring Your Own Device policy
is how do you ensure that device is always up-to-date?
We talked about how important it is for patches
and updates to be installed on your mobile devices.
Well, if I give you the device,
I can install Mobile Device Management on it.
That would allow me to have centralized software solution
for remote administration and
configuration of your mobile device.
I can push out software policies to you,
prevent you from installing applications,
and install updates remotely without your use.
But when I do Bring Your Own Device,
are you going to let me install Mobile Device Management
on your system?
You might not.
And, so this is why a lot of companies
are now switching from a Bring Your Own Device,
because of all those security issues,
into a Choose Your Own Device, or CYOD model.
CYOD gives the employee a choice of a couple of phones.
We might have four, or five models that we support,
and we say you can pick any one of these,
and we'll pay for it for you.
Now, on that device, we can install our
Mobile Device Management, we can create the technical
policies, we can say what is going to be used on that device,
and by doing that, we can prevent certain applications from
being installed on the device,
and we can make sure we're preventing data loss by
using DLP, or data loss prevention systems on that device.
We can also turn features on, and off as we want.
For example, I worked in one organization that
didn't believe anybody using
a mobile device should connect to Wi-Fi.
We were willing to pay for the cellular service
because Wi-Fi was untrusted,
and cellular was considered trusted
So, you couldn't connect to the free Wi-Fi at
the coffee shop, instead we had a mobile device policy that
pushed out through our Mobile Device Management solution
that made sure nobody could enable their Wi-Fi.
So, even if you took your mobile phone home,
and you were sitting on your couch,
you couldn't connect to your own Wi-Fi,
you still had to use cellular.
That is policy that we decided on.
Now, your organization is going to have to make sure
you decide on what your good security policy
for mobile devices looks like.
Every organization is going to make
that determination differently.
Are you going to use Choose Your Own Device,
or are you going to allow Bring Your Own Device?
It's up to you, but make sure it's a choice that
your making, and not just a default that's
happening because no choice was made.