Businesses Now Driving "Bring Your Own Device" Trend

snydeq writes "Companies are no longer waiting for users to bring in their own smartphones and tablets into business environments, they're encouraging it, InfoWorld reports. 'Two of the most highly regulated industries — financial services and health care (including life sciences) — are most likely to support BYOD. So are professional services and consulting, which are "well" regulated. ... The reason is devilishly simple, Herrema says: These businesses are very much based on using information, both as the service itself and to facilitate the delivery of their products and services. Mobile devices make it easier to work with information during more hours and at more locations. That means employees are more productive, which helps the company's bottom line.' Even those companies who haven't yet embraced bring your own device policies yet already have one in place, but don't know it, according to recent surveys."

Comments

also reduces IT costs

[Trepidity]

Adds some information-security problems, but reduces a huge IT problem with procuring/managing/repairing the devices.

Re:also reduces IT costs

[sycodon]

This will not end well.

Re:also reduces IT costs

[vlm]

Doesn't add any problems if you were already accessing software as a service over the internet, or if you were already providing software as a service to outsource partners etc.

Merely allowing employees access to the courtesy wifi internet access doesn't create new problems. Merely allowing employees to log into "internet" apps just like the contractors already do doesn't create any new problems.

Basically, its just a concept of getting rid of the "trusted" LAN and everyone and everything lives in the DMZ, both servers and clients. Once you reach the tipping point of moving your "IT" stuff into the internet DMZ, the process accelerates until its all there, and you are basically a colocated software as a service shop and a really small time ISP.

Re:also reduces IT costs

[MichaelKristopeit420]

once the first IT manager is fired for a data breach caused by a mismanaged virus-laden "bring your own" device, the regulations will return.

Re:also reduces IT costs

[crow_t_robot]

This reduces cost in the short-term but it will be a cost increase in the long-term.

It just takes 1 piece of malware on your network or one security event to loose all the financial benefit. Or how about when someone has a piece of pirated software on their personal machine that they are doing company work on? Or how about when someone loses a personal laptop without WDE that holds sensitive company information?

It just takes one event.

Re:also reduces IT costs

[rickb928]

Ditto. We've had one virus infestation here in six years. All it cost me was two weeks reduced productivity as I rebuilt my notebook, finding 'latent' backups of source code and such to replace what was damaged and rendered unusable by the infestation, and a few customer complaints about delays. Overall, for me, I probably lost 20-30 hours of useful time.

Times >3500 other users similarly affected. For that shared drive only.

And they know how it got in. Not a BYOD, but a corporate device, misused. Unfortunate.

Had this been a BYOD, more people over in the security group would have been on the carpet then already were.

Re:also reduces IT costs

[vlm]

Sounds like you brought your own source code management server, and apparently no backup policy (whoops). In the model in the article, employees were supposed to act like contractors. So IT would have been responsible for running a GIT server, having it available 24x7 over the internet via SSH keys vetted by their security group, and backing it up daily, all you need is a new box to run "git clone" on and keep on running, worst case you also have to submit your new SSH key to them via their internet accessible ticketing system asking them to add it (probably they're running gitolite to provide your GIT access, aside from security checks thats a good 30 seconds work to add the new key)

Being a one man service provider is a whole nother separate topic, nothing to do with the original article.

If they had a "contractor" design like that, and you hadn't "git push" or equivalent with IT in over "20-30" hours as you describe, that could be a workflow or access issue, or maybe a scheduled maint issue, that is way beyond the article topic. IT refusing to back up corporate owned data, for whatever stated reason, is an internal IT management failure, not your problem.

Where I work its forbidden to work outside a corporate controlled SCMS, partially for audit reasons, security reasons, logging reasons, access control, and as seen in your example, data loss.

Re:also reduces IT costs

[Belial6]

Which is why we should all ditch our PCs and go back to green screens on the mainframe?

Re:also reduces IT costs

[AliasMarlowe]

This will not end well.

Indeed; there would be no escape from work-related calls, for instance. One reason I don't volunteer my personal phone for work purposes is because I ignore the work phone outside work hours (except by prior agreement such as a conference call with people in the US or Asia). I leave my personal phone on, and don't get any work-related calls on it.

Re:also reduces IT costs

[joebagodonuts]

A.K.A "To the Cloud!" into today's marketing lingo...

Re:also reduces IT costs

[anonymov]

"Green screens on the mainframe"? Surely you mean "Hicolor screens on Citrix server"? They are already here and easiest possible way to let them tablet-lovers on the net.

Re:also reduces IT costs

[hb253]

Agreed. It may or may not be beneficial to the business, but if upper management wants it, there's no point in fighting it. Pesky details such as the need for new policies, new infrastructure, ongoing support costs, etc, are meaningless. Oh, and if you can't implement in 1 month using your already overburdened staff, they'll outsource and eventually get rid of you.

Re:also reduces IT costs

[Anonymous Coward]

One danger to watch for, courtesy of my company's policy - I can put my iPhone on the network, but it requires allowing them to modify (and wipe!) the device whenever they like, including any backups. So when you leave the company, kiss all your other data goodbye as well.

Make sure you're not screwing yourself when you let them play with your personal equipment. (Or as our local folks say - we don't trust them to keep their own equipment working right, why would we give them our own stuff to fsck up?)

Re:also reduces IT costs

[jbolden]

It will end with recentralization, a push back towards higher IT budgets. As less and less of a company's crucial systems are under its control the fragmented IT maintenance costs skyrocket to keep systems in sinc with one another. Suddenly centralization becomes a source of obvious savings....

Re:also reduces IT costs

[Spazztastic]

If you're on call it makes it easier to carry one phone at a time. The IT department where I work got mad because I had my blackberry forwarding to my personal cell, so we compromised by just using a Google Voice number for my work number. With that I can set hours to accept calls, easier to manage voicemail, and incoming calls. Also means that I can just turn it off when I'm on PTO.

Re:also reduces IT costs

[sjames]

Give them a choice, give you a work phone or respect the autonomy of your personal phone if you allow it to be used for work.

Re:also reduces IT costs

[stewbacca]

This will not end well.

...for those with years of self-preserving A+/Net+ style certifications... Thankfully. Now we can move forward as an information society, as opposed to being limited to what that-guy-with-the-certification-recommends-based-on-his-own-job-security.

Re:also reduces IT costs

[Obfuscant]

Give them a choice, give you a work phone or respect the autonomy of your personal phone if you allow it to be used for work.

You aren't respecting the "autonomy of your personal phone" if you allow it to be used for work, why should they? You've given it away for free, why should the company buy the milk?

Of course, a phone cannot have autonomy, but we'll overlook that...

Re:also reduces IT costs

[datavirtue]

It seems that they are encouraging people to use these devices because they realized they will work all the time. When communications flow in and out of your phone you will constantly be working, therefor handling time consuming communications on your own time (after work and weekends). I tried a smart phone but found that I didn't like not being separated from work communications when I was you know, not working. Some may say, "well don't get your work mail on the phone." Then it doesn't make sense to have the damn smart phone then. The first thing people do is run to IT with their new phone to get exchange mail setup. It is unhealthy.

Re:also reduces IT costs

[lucm]

I heard that there is an app for that

Re:also reduces IT costs

[lucm]

Which is why we should all ditch our PCs and go back to green screens on the mainframe?

I think I'll start working on AAJAX
(Amber Ajax)

Re:also reduces IT costs

[Anonymous Coward]

Negative Bueller - it increases costs all around. Still have to support the end-user, still have to manage viruses, malware, etc - only more of it as the user won't let you install corporate controls on it. It doesn't protect the corporate data from being snooped on by malware / viruses installed in rootkits on the infected personal devices. Doesn't prevent screen capture or key-stroke logging on iPhones / android devices / tablets / etc...

It's IT suicide to do this.

Re:also reduces IT costs

[Gideon Wells]

My company's policy is that any out of hours call to an hourly employee is a "call in". The minimum time for that type per day is three hours. Per day. On the other hand, I've once had them contact a family member to come over to my apartment and yank me out of the bathtub during "emergency".

Re:also reduces IT costs

[QuantumRiff]

A large accounting firm I used to work at was looking to do virtual desktops with Citrix. They wanted to make it harder for data to 'leave' the network. They quickly realized that they could require the contractors they hire by the busload to bring in their own devices, and not have to deal with the cost, or setup time... (of course, they seem to forget about security, but oh well)

Re:also reduces IT costs

[Rich0]

One danger to watch for, courtesy of my company's policy - I can put my iPhone on the network, but it requires allowing them to modify (and wipe!) the device whenever they like, including any backups.

That's assuming the API does what they think it does. Considering that the source code to half of the smartphones out there is available to everybody, there are no guarantees there.

Re:also reduces IT costs

[lgw]

How is that different from today. Any computing device that users have physical possession of will get viruses. The right solution is desktop virtualization - they brind the device, but you send it only pixels, not text. No email should ever live on the endpoint, nor any corporate documents.

Sure, eventually there may be malware that screenscrapes, but for now it's pretty foolproof, so you can bask in the downtime before someone invents a better fool.

Re:also reduces IT costs

[lgw]

It just takes 1 piece of malware on your network or one security event to loose all the financial benefit.

But BYOD is better from a security perspective - those deveice are never on your network! The whole point is to move everything a user can pohysically touch into the DMZ, and limit the "trusted LAN" to the datacenter itself. It's a far, far better security model.

And if these BYODs actually hold any sensitive informaiton, you're doing it wrong. The end-user devices get only pixels! All the email and documents stay in the datacenter, the end-user devices only ever see a remote desktop.

Re:also reduces IT costs

[sjames]

I don't think autonomy means what you think it does.

A phone most certainly CAN have autonomy from centralized administration. If *I* personally choose to use a personal phone for business but maintain local administrative control, it most certainly has maintained autonomy.

Re:also reduces IT costs

[Grishnakh]

You're thinking too black-and-white. If the company wants to save the cost of giving you a work phone, then you're allowing them to "borrow" your personal phone for work purposes, but only if they adhere to certain rules; this is basically a contract, though you really should get it in writing if you do any such thing. Why would you do this? Mainly so you don't have to bother with carrying around a second phone everywhere, having to manage that second phone, etc. Why would they? So they don't have to manage your work phone, so they don't have to pay for it (and the expensive monthly service), etc. In some situations, it can work out fine, as long as both parties respect the boundaries. You don't have to go whole-hog and refuse to use your personal phone for anything work-related; there is a middle ground, as long as the other side respects this.

Personally, I use my personal phone for work, but my situation's a little different as I'm a telecommuter. My company has provided all my other equipment, but my phone is my own. In practice, I almost never use it for work (we do everything over email and Skype most of the time, except for the occasional conference call), except for those rare occasions I have to travel for work, in which case I end up using it quite a bit for talking to coworkers while I'm at a customer site, for instance. Since my company's never abused it, I don't see any downside to this arrangement.

Re:also reduces IT costs

[EdIII]

Then in the end they get their asses handed to them hard, and by hard, I mean reaalllly hard .

No competent IT person will ever agree to allow BYOD to propagate through the workplace. Not with access to any kind of sensitive data whatsoever that is not already passing through secured portals.

Secured websites that allow access, that they themselves are limited in what they can show, is one thing. That allows functionality not just in the workplace, but in the field. It also allows a lot more freedom in what kind of devices can be used. Tablets, phones, computers, etc. Freedom in operating systems is great too. If the employee can get everything done in a web browser, then you don't need the expensive Windows fat clients.

Bring your own personal computer in to work? Only the executives would think of something so "full-retard" like that.

I have always locked corporate down harder than East Germany. Nobody even knows the wireless passwords to access the corporate network, and executives who demand business laptops, get them configured by IT. Some places even get the Ethernet locked down further so that unauthorized devices cannot connect. They don't know the passwords either. No stupid Facebook, Twitter, etc. from within the corporate network.

To make it easier, I just provide a public wireless network with a simple password for all the employees to use. Separate IP address space, and not even remotely connected to the corporate network and VPNs. If they want Facebook, Twitter, and all the Social Media crap plus media streaming of YouTube, Pandora, etc. they can do it on another network that won't impact corporate operations. I make it a clear policy that they can use the public network with their own devices in any way they want because it is safer. The only thing they are not allowed to do is directly transfer or connect their devices to corporate hardware. You make it reasonable like that, and the vast majority of employees are happy and not trying to bypass your corporate security to get to Facebook while on break.

Security and Usability is a balancing act.

If the company execs want to shove Usability down IT's throat, despite common sense and valid warnings, and at the expense of security, just to gain some perceived ability to work employees harder for the bottom line ... then get your resume ready to jump ship.

You will have to jump ship. I have to be skeptical about this. Financial institutions and highly regulated companies doing this? I have to doubt this. Any security company that comes in to audit them or evaluate their security is going to have a field day killing several trees with reports to the execs about how insecure and vulnerable their network is. Would it pass PCI compliance? Doubtful.

All it takes is one really bad screwup. Lose a half million credit numbers (with full info) and then the executives might really understand the cost of letting employees bring in their tainted malware infested, porn overloaded, crap equipment from home.

I write this while downloading an ISO to fix an executives business laptop that they crapped up with malware.

It's already a never ending battle for IT to keep the corporate network and assets from being owned by hackers and malware. Handcuffing us and force marching us down a path to the 9th level of IT hell is just an oh-so-good idea. There is a really really good reason why IT has to control all hardware connected up to corporate. Any hardware we don't control is not just a point of failure, but a security vulnerability waiting to be exploited.

How many hacking groups out there are just waiting for that "big fat gold nugget" that is a laptop being connected up to a major financial institution from the inside?

Re:also reduces IT costs

[stewbacca]

Woah, easy there...you should get out more.

There's a continuum of security and usability that is akin to the continuum of alcoholism and prohibition...problem is, your post is so far out there, it is off the scale somewhere beyond prohibition, going full circle and coming back towards alcoholism.

Re:also reduces IT costs

[stewbacca]

How do they wipe "any backups" of your iPhone when you have an iCloud account or you save the backup to a personal device not on their network, or use disk encryption?

Re:also reduces IT costs

[CAIMLAS]

Are you kidding me? End user devices are a marginal cost compared to everything these days.

20 run-of-the-mill workstations with Office and a monitor will cost you about $12,000, or roughly the cost of one decent server. This is also probably about the cost of employing a single sysadmin (after you factor in HR and taxes) for a month.

In contrast, how much does it cost in man hours to get all those different systems set up, maintain them, fix them when the users fuck them up or the user can't work because their personal device broke, deal with different software versions as they relate to the network equipment, and so on?

The only reason divergent devices like tablets work at all is because of standards. Standards which were put there in the first place to make things uniform and improve interoperability. The fact remains, however, that this interoperability is not uniform: any sufficiently complex environment will require very specific versions of specific software. (Anyone have to deal with sites/applications which -still- require IE6 or IE7, for instance?)

Re:also reduces IT costs

[LDAPMAN]

The problem is it's not 20 devices. It's 10s of thousands or more. You almost had the idea when you mentioned standards. The idea is to make your systems work in a standards based way and make it easy to define what is your problem and what is the devices problem. You make supporting internal users more like supporting users on your external web sites.

Re:also reduces IT costs

[Shifty0x88]

Standards which were put there in the first place to make things uniform and improve interoperability. The fact remains, however, that this interoperability is not uniform: any sufficiently complex environment will require very specific versions of specific software. (Anyone have to deal with sites/applications which -still- require IE6 or IE7, for instance?)

So true!!!

I also believe this will make the IT people spend more time on getting some CEOs iPad to play Bloons at work then to make the servers work efficiently and effectively.

Or why doesn't my iPad/Android/Whatever have X program or have Y plugin... it just makes IT professionals' jobs harder, and frankly not what they should be spending their time on.

Then of course there is gunna be, this device doesn't work, fix it... I'm sorry I don't work for Apple, Samsung, or whoever you made your device, but I did go to school for Windows, I can help you with that....

Re:also reduces IT costs

[Ihmhi]

Your post sparked quite the thought in me.

*ideal* UI design doesn't involve a GUI looking pretty - it also has to be functional. In recent years this has evolved to doing things like tracking eye and muscle movements to try and create GUIs that are physically comfortable to use.

Is modern IT taught how to do what you just said? Do they learn how to strike the right balance between Security and Usability? They should. There'd certainly be enough to at least fill one semester's worth of material, i.e. here's the network and the employees, balance it out.

Re:also reduces IT costs

[Anonymous Coward]

To make it easier, I just provide a public wireless network with a simple password for all the employees to use. Separate IP address space, and not even remotely connected to the corporate network and VPNs.

Are you sure? If employees can access their email from their private devices (even if through a public-facing webmail client) and can also do so from their corporate desktops, then there is some form of connection between the networks (however indirect or well-protected).

Re:also reduces IT costs

[Anonymous Coward]

If the company execs want to shove Usability down IT's throat, despite common sense and valid warnings, and at the expense of security, just to gain some perceived ability to work employees harder for the bottom line ... then get your resume ready to jump ship.

For 2 reasons

A: Your work is about to turn into IT Hell.
B: When management gets their asses handed to them HARD, who do you think they are going to blame, and fire, first?

The other option is the BOFH Method handling things; document everything and slip the information to the authorities so they can prosecute management and put them in jail when the data breech does occur.

Re:also reduces IT costs

[The Archon V2.0]

Well, if some employers are demanding Facebook passwords from interviewees, it doesn't seem so long a step to demanding passwords to cloud services. Does nothing for offline backups, but....

Re:also reduces IT costs

[EdIII]

Not really. It depends on your point of view and where you see yourself in the balance between security and usability.

Remember, we are talking about corporations here. Not just small businesses here either, but large ones implied by the term "financial institutions".

Medium sized businesses to Enterprise businesses have serious security issues to address. Fail to address them, or to even understand them, is what leads to security "incidents" that compromise your customers, impact your current operations, tarnish your reputation, and are costly to fix.

"An ounce of prevention is worth a pound of cure".

You may say I am being overboard here, but that really does depend on the environment and situation. With financial data I would never even allow branch offices or executives direct access to any data at all. If they want something with credit card numbers or soc#, I would give them the bin/last4 of the credit card and last4 of the social.

I guess what it really comes down to is you are serious about the security of your system. You seem to have an impression that I am out of balance and a tyrant running IT whipping the employees.

Not so. If you read my post, I actively work with the employees to reach an understanding on what is dangerous and can hurt us. Locking down the network, gluing USB ports shut, and participating in a cold war with employees is fruitless. It just makes them resent you, and executives can override you anyways.

Give them options that make sense that still allow them to have a good experience. Public network access that does not represent a security risk is a good start. It not only allows employees a place to safely interact with the rest of the Internet, but guests of the company as well.

I have advised executives countless times to ignore personal email, Facebooking, etc. As long as work is getting done and you don't see them doing it more than the amount of their break times, leave it alone. If the employee can responsibly balance their time while responding to txt's or twits, or whatever, while accomplishing their tasks, deliverables, etc. let them have that leeway.

How are so lenient policies so far out there? If anything it is pragmatic with respect to human behavior. Offer a path of least resistance.

Re:also reduces IT costs

[tftp]

it requires allowing them to modify (and wipe!) the device whenever they like

For completeness of the discussion, here is the list of policies taken from property pages in Exchange 2010:

1. Require a password and specify its complexity, expiration periods and timeouts
2. Require encryption on the device and on the storage card
3. Allow or disable removable storage, camera, WiFi, infrared, tethering, remote desktop, desktop sync and Bluetooth
4. Allow or disable the browser, 3rd party email, unsigned software and unsigned install packages
5. Allow or disable any applications (using an open-ended list)

In other words, by BYOD you simply surrender control over it to the company. It would be much fun if you suddenly discover that your phone now requires a 32-character password that you must enter after 60 seconds of inactivity. The password, of course, expires every 3 days, and the password history depth is set to 100.

And indeed, the device can be remotely wiped if it ever connects to the server. Backups, of course, aren't likely to be erased if you don't want them to (and if you use CD-R; good luck erasing from those.) However if the content was encrypted and the key is destroyed they might be of limited use to you.

Re:also reduces IT costs

[EdIII]

Now you are talking about data security.

Employees are advised that access to personal email on corporate equipment is expressly prohibited and punishable all the way up to dismissal. Follow through on it. Corporate networks have active firewalls to prevent access to most personal email portals and log the crap out of everything. Follow up on the logs. Identify employees that have done so, and punish them severely . Make an example.

I have gone so far as to have a white list only intercepting proxy between the corporate machines and the Internet that prevents most of what you are concerned about.

Depending on how far you want to take it, there are many security concepts like data diodes, and advanced security platforms that you can implement with respect to data.

Like I said in another post.. path of least resistance. You can go full TOP SECRET security level practices, or just have an intercepting proxy with logging. Employees from workstations should never ever have access to the full database. Just systems that are secure themselves performing API calls to back-end database servers that do not have any direct access to corporate/branch office networks.

In the end, of course there is some form of connection. Balance between security and usability.....

Re:also reduces IT costs

[rnturn]

"...if some employers are demanding Facebook passwords from interviewees..."

At that point, the interviewee should be saying "Thank you for your time. I'll be posting my interview experience online as soon as I get home" and walking the hell out.

Re:also reduces IT costs

[The Archon V2.0]

At that point, the interviewee should be saying "Thank you for your time. I'll be posting my interview experience online as soon as I get home" and walking the hell out.

Well, someone did: http://yro.slashdot.org/story/11/02/19/1746256/employer-demands-facebook-login-from-job-applicants

Re:also reduces IT costs

[Anonymous Coward]

oh really? Ha. Well, lets see................. no competent IT person should have EVER agreed to work one minute of OT without pay. Plumbers, Lawyers, Doctors, Electricians, Garbage Collectors, et al all get paid for every moment they're working.

no competent IT person should have EVER agreed to give away work for free either (Open Source).

no competent IT person should have EVER agreed to outsourcing their jobs to China and India and Estonia and Vietnam and Costa Rica and every other place other than THEIR OWN NATION.

no competent IT person should have EVER agreed to signing non-compete agreements limiting their ability to put food on the table for their families.

no competent IT person should have EVER agreed to writing software from NO SPECS, or limited specs written by people with "degrees" from University of Phoenix or Devry, to name a few.

in my estimation there are no competent IT persons, at all anymore. We're the most overworked, underpaid (going by hours actually paid for working), under-appreciated group of workers in modern times.

So dont think this BYOD wont fly because good ole corporate america will dangle 2 extra floating holidays and you'll take it. Just like we've all gotten used to mindless middle managers dictating project timelines which are unreachable and we still do it.

Maybe its time for a change. Just say no, now, like we're saying NO to the new gmail look.

Re:also reduces IT costs

[uninformedLuddite]

I am a hoarder. Even though my purple tie-dyed flares haven't yet come back into fashion there is still hope for the near new mux in the pocket.

Re:also reduces IT costs

[pete6677]

Bla bla bla, we've heard it all. People said the same thing about PCs in the enterprise in the early 80s. Sure, some of the problems the "IT High Priests" foretold did end up coming true, but the high priests lost the PC battle and overall PCs in the workplace were much more of a benefit than a hazard. Even if IT could no longer control everything with an iron fist.

The same battle is being replayed with smart phones and BYOD. And the IT High Priests will lose again.

Strike a BALANCE between APPROPRIATE security and usability, or your IT department will be outsourced.

Re:also reduces IT costs

[pete6677]

Only in your wildest IT Nerd dreams could you punish a user severely just because they found a way to check their GMail account from "your" network. Try having the VP of Sales fired for that. Even if he does cause a data breach, he'll just make sure you get blamed for that because he is far more skilled in organizational politics then you could ever be.

Re:also reduces IT costs

[pete6677]

I've seen many virus outbreaks at companies where I have worked. ALL were caused by corporate-owned and managed equipment and Microsoft software exclusively.

I love it when IT management thinks that devices are inherently secure just because they supplied them.

Re:also reduces IT costs

[pete6677]

Yep, this is by far the best way to do it.

Laptops/tablets and even most desktop machines should not store sensitive company data, regardless of who owns or supplied the device.

Re:also reduces IT costs

[EdIII]

Only in your wildest IT Nerd dreams could you punish a user severely just because they found a way to check their GMail account from "your" network.

I already have. 1st time was a warning. 2nd time involved Hamachi installed on a corporate machine to try and get around the corporate firewall and controlling a home PC. 3 days suspended without pay and a complete rebuild of the workstation from the ground up.

Try having the VP of Sales fired for that.

Punish severely does not mean fired. If it comes to a VP, I just talk to the VP and explain what the legal liabilities are and how much it costs when they screw up. You must have missed the part about providing a path of least resistance. If I give the VP a way to conduct personal actions that don't put the company at risk, a VP is generally smart enough to want to do it.

Even if he does cause a data breach, he'll just make sure you get blamed for that because he is far more skilled in organizational politics then you could ever be.

That won't make one bit of difference when the logs show otherwise. A 3rd party audit from a security firm will only validate what I have said anyways. Sure the veep might not get fired, but behind closed doors, there will be hell to pay if he really exposed the company to that level of liability, and more hell to pay it it tarnished the reputation of the company and clients/customers had to be notified. Even worse in a regulated industry.

Now if you are talking about the levels of corruption to the point where all the execs cover up each others fuck ups and lie to regulators.... well then you would be pretty stupid to stay at that company if you had any knowledge of what was going on. I quit a company that I thought *might* be doing questionable things and you can bet your ass I took evidence with me that I was in compliance with all regulations and dotted every "i" and crossed every "t".

Re:also reduces IT costs

[EdIII]

I don't know what "battle" you are referring to.

The same battle is being replayed with smart phones and BYOD. And the IT High Priests will lose again.

There is your first problem. Calling IT "High Priests". You make them the enemy and fight every single thing like a complete idiot, "just because", and you are making things worse. IT is there to enable the other employees to get their work done, but they are also there to protect to the company.

Strike a BALANCE between APPROPRIATE security and usability, or your IT department will be outsourced.

That is not balance and BYOD is not appropriate. The threat of outsourcing creates duress, which automatically creates the absence of balance.

It is impossible to have even an adequate level of security with BYOD. It does not even make any sense in Enterprise cases anyways.

You can have a defeatist attitude, but stopping BYOD is so easy you don't even have to have the confrontational battle you so desperately seek. The idea of BYOD to replace corporate equipment is just retarded. It will be a fad, and then there will be the absolute fucking horror stories with price tags attached to steep, that even the most pointiest of the pointy haired bosses will think twice before pushing it.

BYOD, that accompanies corporate equipment is entirely possible in the ways that I outlined. Keep it on separate networks and keep it from interacting with corporate hardware.

Path Of Least Resistance.

Why have the employees fight you? The idea is to be the people they come to for answers. The people that can tell them how to solve problems, how to be secure, etc. How to best accomplish something with the least amount of effort.

I get called over sometimes for something as simple as help with an Excel spreadsheet formula and advice on a home system. I don't really mind if I have the time.

By building such strong relationships built on trust and mutual respect, the employees want to cooperate. They don't see you as the dickhead trying to prevent them from hitting a website up during lunch, but the guy that gives them a safe alternative and is willing to stand up to the execs to allow their personal phones to connect to Facebook without issue.

The employees that just don't get it, I come down with the wrath of the gods on them and make their little lives so fucking miserable that when I show them the path of least resistance they run towards it and never screw with me again.

Truth be told, I have only had to make an example a couple of times and the word gets out even to the new people about the right way to do things.

Re:also reduces IT costs

[Neil Boekend]

I am not an IT-er, I am an electrical engineer. I am a user.
I wouldn't have any trouble with the policy he is using, assuming everything is done well (IT responds fast if something goes amiss on the "closed" network, file transfers work and have enough bandwith, things like that).
Why?
1. Because he offers a way around it. I could use the "open" network if I need to have a break and read /.
2. I prefer my credit card details handled well. He works in a financial institution. This implies the credit card details of millions of people. That is a fat gold nugget for any hacker. I'd accept a lot of hurdles between me and my work to protect those details. I'd hope others (who actually work at a financial institute) to feel the same way.
3. .....
4. Profit.

Re:also reduces IT costs

[Ice Tiger]

This is the best comment I've seen on Slashdot regarding BYOD. The only sane thing to do in the modern world.

Re:also reduces IT costs

[Intrepid imaginaut]

To be honest I'd like a list of those companies that allow users to bring their own devices, so I can never do business with them.

Re:also reduces IT costs

[tehcyder]

Plumbers, Lawyers, Doctors, Electricians, Garbage Collectors, et al all get paid for every moment they're working.

Garbage collectors, yes assuming they're paid an hourly rate. Plumbers and electricians, maybe, depending on whether they're self-employed or not. Lawyers and doctors, definitely not.

Re:also reduces IT costs

[Anonymous Coward]

So let me get this straight. If I am working with some finance guy and we are bouncing back and forth MY financial numbers there is nothing preventing him on a company approved device (all-be-it his own) to just simply leave and all my data is on HIS phone leaves with him. Who in their right mind thought this was a good idea? Once the person who OKAY'ed this is found please send them to me to be executed...I'll make it look like an accident...honest.

EdIIl's post is quite well written below and those comments seem to echo mine as well.

Re:also reduces IT costs

[stewbacca]

Yes, his reply was far more measured than his initial post...or...more likely, I read a bevy of over-the-top IT control freak posts yesterday, and this one was lumped in together in my head.

The response is much clearer and I wish more IT people were as rational.

Re:also reduces IT costs

[Fri13]

I hope millitaries would take same trend, everyone would bring their own weapons.

Yeah sure.... it adds some security problems, but reduces a huge budjet with lower gear maintenance, storing and teaching weapons.

(Okay, I don't know how many does have fighter-interceptoprs or even battle tanks in reserve, but at least almost every person in US has some kind weapon and transport vehicle).

Re:also reduces IT costs

[poopie]

> Is modern IT taught how to do what you just said? Do they learn how to strike the right balance between Security and Usability?

The enlightened ones know about DevOps and design thinking. Everyone else who believes draconian IT desktop control is the right solution is simply wrong.

People are more productive when they have an environment they like / want / choose.

IT simply can't control all tablets, phones, home computers, and more and more workers telecommute and work remotely, so... the battle is already lost for total control. Next best thing it to step back, take a holistic view on priorities, risks, the new status quo, and how IT can HELP your customers and business succeed... and plot a new course based on making PEOPLE productive first.

Re:also reduces IT costs

[pete6677]

Lots of IT morons think this. I've met plenty. The devices in question are secured by major vendor software with numerous well-documented hacks. But this makes the morons feel safe enough to put client data on them.

Don't secure the device - secure the data. Truly sensitive data should not exist on a portable device. It should be kept on a server and made available by display only to the remote device. As soon as the network connection is broken, no more access to the data unless the network itself is hacked.

Re:also reduces IT costs

[Anonymous Coward]

cower in my shadow some more, feeb

Offloading IT cost onto employees

[crath]

Unless the employer provides ongoing cash payments to compensate the employee for use of thier device, this is a way of offloading IT cost onto the shoulders of employees. Add to that the fact that here in Canada, an employee of a company is not allowed to treat the cost fo a computer as a business expense (for tax purpoes), and the reduction in salary experienced by the employee is even greater than the benefit received by the employer.

Re:Offloading IT cost onto employees

[vlm]

The way I've personally seen it work out is the company provides junk, if you want to bring your own, better stuff, thats OK.

I love it. The company doesn't buy me clothes, or shoes, or my commuter car, either. Where I work, I can get "company clothing" but its fairly hideous, I do much better at Target and don't have to look like a corporate advertising billboard.

The junkiest computer I use on a regular basis, is, no surprise, at work. The junkiest keyboard I use on a regular basis, is, no surprise, at work. The junkiest mouse, monitor, desk, chair, lighting, blah blah is all at work. Even climate control is better at home, seriously. Everyone seems to know someone who gets great smartphones paid for by work, but the rest of us get no phone at all, or a hideous recertified featurephone from the 90s, or at best a monthly $25 "cell phone use credit". One of my employers offered either $20/month flat rate for my own cell phone bill, or I could bring in an itemized detailed bill and collect the exact amount (handy if I spent hours on the phone talking to Kenya that month, otherwise I just took the default $20 for the month)

This is business as usual in the "real world", my diesel mechanic cousin owns all his tools... That wrench is his, not his bosses. Same with my electrician buddy and his tools. Its just how grown-ups do things.

In a way it all makes sense. If you provide a firewalled, isolated internet connection for your onsite contractors to VPN back to their home office over, why not let your own employees use that connection for their own purposes? If you provide your internal ticketing system / CMS / fileserver as a "software as a service" over the internet for your outsource partners, does it really matter if your employees access the same SaS apps over the internet instead of the LAN? Combine them both, and you got the guy bringing his ipad into work, connecting to your locally provided internet access, using the SaS ticketing system, no big deal.

Re:Offloading IT cost onto employees

[Mojo66]

This fits nicely into the discussion we had here yesterday: How To Thwart the High Priests In IT. From TFA:

As the 'consumerization of IT' phenomenon grows, such IT people are increasingly clashing with users, who bring in their own smartphones, use cloud apps, and work at home on their own equipment.

Re:Offloading IT cost onto employees

[cdrguru]

If the business has a clear policy of not providing tools, such as a lot of auto repair shops, then US income tax deductions are possible. Just barely possible but there can be complications.

In the usual commercial business world if you want to buy an iPhone for use at work there is no way it is going to be tax deductible unless you get the company to give you a letter stating it is a requirement of your job to buy the iPhone and that it will be used only for business purposes.

Absolutely the reason this is popular is cost shifting. You have 50 employees that you want to have iPhones... so the company can spend $25,000 or nothing. Gosh, who would have thought of that?

Now, if everyone buys iPhones there is very little problem with IT support. If 30 people buy iPhones, 10 people buy Android phones and the remaining buy a mix of Windows phones, Open Moko phones and something new that came out last week the IT job will be a nightmare. Same kind of problem happens where everyone buys a different tablet device brings them all to a meeting and someone has instructions for using some iPad-only app for displaying something important. Guess what? The help desk may not be able to resolve this to everyone's satisfaction.

This sounds like a lot of short-term thinking that saves some direct money immediately with a lot of long-term consequences and long-term expense. Mostly, it is really dumb move.

Re:Offloading IT cost onto employees

[vlm]

Now, if everyone buys iPhones there is very little problem with IT support. If 30 people buy iPhones, 10 people buy Android phones and the remaining buy a mix of Windows phones, Open Moko phones and something new that came out last week the IT job will be a nightmare. Same kind of problem happens where everyone buys a different tablet device brings them all to a meeting and someone has instructions for using some iPad-only app for displaying something important. Guess what? The help desk may not be able to resolve this to everyone's satisfaction.

It creates a contractor relationship. We do not provide equipment to our contractors, and we do not care what they use as long as it works and they don't hurt anyone else. We also demand they wear clothes and occasionally bathe, but we do not buy them clothes nor hose them down if they cannot handle it themselves. We assume they are big boys and they can take care of themselves. IT makes our things work, they do not teach you how to use your things. Much as the janitor is paid to keep the toilets unclogged, not teach us how to unclog. WRT contractors, the only help desk interaction is verifying our courtesy internet access is up for them, and our internet accessible apps such as webmail are available to them. The days of hand holding people who don't know which side of a mouse is up, are over.

We provide a courtesy wifi internet connection for contractors to use at our workplace as they see fit. The apps the contractors need access to are already internet accessible because we sure as heck are not giving contractors access to our internal LAN. Allowing the employees the same freedoms the contractors already have for many years, is not a big stretch.

It turns out that most (although perhaps not all) employees job requirements "fit" with the contractor IT model.

Re:Offloading IT cost onto employees

[Anonymous Coward]

Add to that the fact that here in Canada, an employee of a company is not allowed to treat the cost fo a computer as a business expense (for tax purpoes), and the reduction in salary experienced by the employee is even greater than the benefit received by the employer.

Actually, Canadian tax law says that almost all expenses incurred by an employee and not reimbursed by their employer are not deductible, even if they are related to their job.

There are some exceptions, such as if the employer requires the employee to maintain an office at home and doesn't reimburse the employee. In this case, the employer can fill out form T2200.

If your position requires you to maintain a professional designation required by law (such as a chartered accountant), those fees are deductible if not reimbursed by the employer.

There are a few others, but employees in Canada get very few tax breaks.

Re:Offloading IT cost onto employees

[ottothecow]

You need to find a new job. If they are only willing to provide you junk (unless you don't actually require computers specifically to do your job), they probably don't value you much more than junk.

My company provides us good computers and takes requests if you need something (e.g. I wanted to switch to a MS ergonomic keyboard so they ordered me one).

They used to provide phones for the higher-ups, but now they do it for everyone with a business need (which is basically everyone except the mail room). The way it works is like this: If you don't want to deal with it, they buy you whatever the latest blackberry is and cover the service. The phone is yours to use as you please and you never even have to see a bill (although a lot of people who go this route just have a work phone and a personal phone which seems like a PITA).

If you want to handle the billing yourself, you get a $200 purchase allowance towards any smartphone that can synch with an exchange server plus a max of $100 a month towards the bill. You have to submit your bill every month for reimbursement but you don't have to carry a blackberry (and people who *really* want an iphone don't have to carry 2 phones).

It doesn't save the company money...they still pay the costs and if anything support costs might go up since they now support ios/android/blackberry/etc...but it makes the workers happy (though it does make them more available).

The situation is a little different than a mechanic with his tools...when I worked at a dealership, they owned their own tools (often with a small allowance and a huge discount though) but they also owned wrenches that they had been using for their entire 30 year career. Given a reasonable upgrade cycle on my laptop(plus lots of $$$ in software)/monitor/phone, you far exceed what would be reasonable for any employee to personally pay for. Plus, unlike tools which I could use at home or at other similar jobs, a lot of expensive software licenses that I need for my job would be replaced with different expensive licenses at another similar job (and unlike a case of snap-on, most of those licenses have zero resale value).

Re:Offloading IT cost onto employees

[ATestR]

Not only does this dump the IT costs on the employee, it often interferes with the employees private usage of the equipment. Eg: tech hardware that interfaces with the systems at work have to be locked down with the company security software, and all data on those systems is subject to inspection/audit by the company. This is at my wife's company (fortunately not mine). Needless to say, she doesn't bring any equipment to work. (I have, on occasion.)

Re:Offloading IT cost onto employees

[Lumpy]

Your cousin wont have his tools stolen from him when he leaves, IT will confiscate your laptop as it holds company secrets.

Also your cousins tools are not locked from him, your laptop you will join it to the domain and give up admin control of it.

Work wants me to have a laptop of my own? they either buy it and control it, or compensate me every paycheck for it for trying to control it.

Re:Offloading IT cost onto employees

[Anonymous Coward]

This is all well and good until a BOFH boss decides you're not working out, and that "privileged information" may reside on your personal smart phone, and uses the association with Exchange or any other company structure to remotely wipe your phone.

Re:Offloading IT cost onto employees

[vlm]

Plus, unlike tools which I could use at home or at other similar jobs, a lot of expensive software licenses that I need for my job would be replaced with different expensive licenses at another similar job (and unlike a case of snap-on, most of those licenses have zero resale value).

Ah yes my wife has a similar experience where their IT dept is responsible for keeping some microsoft remote desktop server machine for her up and operational and backed up and software updated and accessible via the internet VPN 24x7. That's the demarc point between IT and her. Its got some weird VOIP PBX software on it that's like five (maybe six?) digits cost. They do not care what hardware she uses, or how she accesses it, as long as it speaks "cisco vpn" at the network level and this funky microsoft remote desktop client thingy at the presentation layer. Almost no one at her employer knows anything about macs other than her, but as long as demarc points and standards are respected, no one cares or needs to know. Her IT neither knew nor cared when she upgraded to her new mac mini. She just plugs into a firewalled internet access port and works away. Apparently it works very well for all concerned, or at least her complaints are about completely different subjects, anyway.

I suppose VOIP PBX programming tools are more amenable to remote desktops than, perhaps 3-D CAD software. That kind of app would indeed be a puzzle, although with ever increasing speed and bandwidth, I've heard CAD can be slowly done over VNC, so who knows.

Re:Offloading IT cost onto employees

[Anonymous Coward]

This is business as usual in the "real world", my diesel mechanic cousin owns all his tools... That wrench is his, not his bosses. Same with my electrician buddy and his tools. Its just how grown-ups do things.

The difference is that if they don't take care of their wrenches and wire cutters, unless they are the only tech, it only effects them. In the business network environment, however, you not taking care of your device can very easily end up impacting the entire company (either in cleaning up viruses or dealing with lost sensitive data).

Those that believe IT and InfoSec policies are just getting in their way are too short sighted to see beyond their own nose.

If you believe that you need Item X to do your job and the company doesn't give it to you, you need to make it clear what the impact of not having it is. If there is a real impact (beyond "I'm going to pout and not be productive") and they hold you accountable for it, then I would suggest finding a better place to work.

The other issue most people don't consider when they want to BYOD is that once you start using it for business purposes, the company has legal backing to search it and monitor it. I've known people that have gotten burned by that, so thank you I'll continue to carry 2 phones day-to-day and 2 laptops when I travel.

Yes I was young once, thumbed my nose at my corporate overlords, and did these types of things. I've grown up since then and life is simpler now with a clear delineation of ownership and responsibility.

Re:Offloading IT cost onto employees

[onyxruby]

Your horribly, horribly wrong. This is not a cost shift to employees, not even remotely. When you buy a device you think, I paid $600, it costs $600. When IT buys the device they think, I paid $600, it's going to cost me another $1200 to support it - if it's one we already have the support hammered out for.

If you bring in your own random device that isn't yet supported than support costs rise even further. You see if everyone has an iToy than the IT department knows how to support it, has the software to manage it and can bring down these costs with economies of scale. If everyone has 20 different versions of an iToy than achieving economies of scale becomes difficult and there are a lot of hidden support costs.

The idea that simply shifting this hardware costs to employees will save money could not be further from the truth. This is done as a service for employees for their convenience.

Now, if you want to know what is shifting costs to employees it is allowing work from home. I worked for a large (75,000) healthcare company and we had roughly half our work force working from home. It was a convenience to the employees and it was estimated to save the company hundreds of millions of dollars per year in things like office buildings and similar costs.

It also happens to be an incredibly green thing to do with a significant impact for the environment by keeping all of those people off of the roads etc.

Re:Offloading IT cost onto employees

[MikeB0Lton]

Have you forgotten about virtualization and SaaS? Why would your computer have to be on a corporate domain to connect to a VMware View session or load an app through Citrix? This comes down to corporations controlling data, not devices, which was their primary concern all along.

Re:Offloading IT cost onto employees

[ottothecow]

I frequently use arcgis (mapping software, not really any less graphic intensive than cad I shouldn't think...not 3d but constantly changing visuals) over RDP.

I think it actually works better over remote desktop...the computer I connect to is a couple of xeons faster than my laptop and has a shorter hop and fatter pipe to the fileserver that stores most of the shared mapping data. Of course that is straight RDP over 100mbps ethernet. When I do it from my home computer and cable modem (first connecting to a citrix desktop and then using the remote desktop client from there) the graphics refreshes occasionally get a little laggy but it is perfectly functional aside from the fact that my monitor at home is a lot smaller (removing the citrix layer would probably speed it up more but we can only join the VPN from trusted hardware and I don't like to bring my laptop home when I could just RDP into it)

Re:Offloading IT cost onto employees

[s73v3r]

No. If they are going to expect you to do work, then they should either provide you with an excellent machine to do said work on (not "junk"), or they should compensate you for the use of your device.

This is business as usual in the "real world"/quote.

Offloading costs to employees should not be seen as "business as usual", but rather of employers trying to fuck their workers one more time.

Re:Offloading IT cost onto employees

[mjwalshe]

Just because vocational trade jobs like your diesel mechanic own their own tools (in some anglo saxon countries) does not follow across into the professional / white collar world.

Re:Offloading IT cost onto employees

[s73v3r]

We also demand they wear clothes and occasionally bathe, but we do not buy them clothes nor hose them down if they cannot handle it themselves

That is just a plain stupid argument.

Re:Offloading IT cost onto employees

[jbolden]

IT will confiscate your laptop as it holds company secrets.

That's called theft, he can call the police and get it back. IT has to request the secrets be disposed of properly they can't sieze the laptop anymore than they could break into his house and steal files he kept at home.

Re:Offloading IT cost onto employees

[Anonymous Coward]

Unless the employer provides ongoing cash payments to compensate the employee for use of thier device, this is a way of offloading IT cost onto the shoulders of employees. Add to that the fact that here in Canada, an employee of a company is not allowed to treat the cost fo a computer as a business expense (for tax purpoes), and the reduction in salary experienced by the employee is even greater than the benefit received by the employer.

I once brought (actually, bought) a laptop for work, and while in hindsight it probably wasn't the brightest idea, it did save my sanity. Some counterarguments.

1. You can't claim it as an expense, but my company does interest-free loans for personal computers.

2. Due to some PHB's higher up the chain, we were short on computers, so the option was to have *no* computer for several hours a day.

3. It was my personal computer, and thus it came home with me for my own use (and ten years later, although the screen is long since burnt out, it still lives happily hooked up to an external monitor for my daughter - not a bad investment all told).

4. Since it was my own machine, I retained control over what was installed. That's actually how we finally got proper work machines purchased - IT wanted to start running audits and installing software, and when informed that it was my personal machine (and thus they were not installing cruft on my machine), magically money was found for work-owned PCs were found (they also replaced the dual-terminals that everyone else was forced to use).

Re:Offloading IT cost onto employees

[cayenne8]

This is business as usual in the "real world", my diesel mechanic cousin owns all his tools... That wrench is his, not his bosses. Same with my electrician buddy and his tools. Its just how grown-ups do things.

What you're describing here...sounds very much like 'contracting'.

And, if you're gonna be contracting, you'd better be doing it for contractor rates to balance out the risks.

Not that I mind it, I prefer that method, gives good tax breaks, more automy, etc.

But once you start having to provide your own tools, etc....you should not be still working W2...incorporate yourself and start managing that money and career, and have >1 more client lined up too.

Re:Offloading IT cost onto employees

[stewbacca]

How is it a cost for people who would own the devices anyway? I have an iPhone and and iPad on my own accord. It's nice that I can use them for work as well. Otherwise, you get the dumb companies like the one I used to work for that would buy me an iPad and an iPhone, even though I already owned one each, all in the name of 'security'.

Re:Offloading IT cost onto employees

[stewbacca]

This is business as usual in the "real world", my diesel mechanic cousin owns all his tools... That wrench is his, not his bosses. Same with my electrician buddy and his tools. Its just how grown-ups do things

This is quite possibly the best statement of 2011 on slashdot.

Re:Offloading IT cost onto employees

[ZiggieTheGreat]

Sounds great, but I want contractor pay to make that happen.

If you are hiring me as an employee, provide me the tools I need to do my job - being an employee brings certain benefits from me with it - such as loyalty, caring about the company I work for, etc.
If you are treating me as a contractor, pay me as such and I'll bring my own tools to do the job. But when the next big thing comes along, I'm going to move on - there is no reason to stay loyal to a company that wants to treat me like a contractor.

At the end of the day, we don't expect the accountants to provide their own computers, nor do we expect sales to provide their own computers. The receptionists don't bring their own equipment to work. Why should IT be treated any differently?

Re:Offloading IT cost onto employees

[stewbacca]

Work wants me to have a laptop of my own? they either buy it and control it, or compensate me every paycheck for it for trying to control it.

Or they'll just hire someone else, like the 99%of us who already own our own laptops for personal use. My old job wouldn't let us use our own gear. My new job gave me a better computer than my personal one. Guess where I'm happier? Seriously, with every other profession on the planet, pros bring their own tools, or work provides "pro" tools. Companies who plop down $199 for the latest outdated Dell Shitbox can be expected to excel as about as well as they outfit their work force with computers.

Re:Offloading IT cost onto employees

[stewbacca]

Those that believe IT and InfoSec policies are just getting in their way are too short sighted to see beyond their own nose.

It's not short sightedness...it's the fact that IT and InfoSec policies should be behind the scenes, and not bugging me/disallowing me access every two minutes.

Good IT and security is invisible to the user.

Re:Offloading IT cost onto employees

[tompaulco]

We also demand they wear clothes and occasionally bathe, but we do not buy them clothes nor hose them down if they cannot handle it themselves.
I assume that since you demand they wear clothes and don't buy them clothes that you also don't hold them to any particular style or type of clothes?

Re:Offloading IT cost onto employees

[tompaulco]

The idea that simply shifting this hardware costs to employees will save money could not be further from the truth. This is done as a service for employees for their convenience.
So, IT has to spend more to support these devices and the employees have to spend more to obtain these devices. Why are we doing this?

Re:Offloading IT cost onto employees

[tompaulco]

Actually, Canadian tax law says that almost all expenses incurred by an employee and not reimbursed by their employer are not deductible, even if they are related to their job.
Wow. I guess there ARE pluses to the US's tax system.
Although, I would say there should be no need for this. No one should ever have to file anything under "unreimbursed business expense." It should instead be filed in a police report.

Re:Offloading IT cost onto employees

[tompaulco]

The company that I used to work for (in the Banking industry) changed is policies about BYOD about three years ago. They used to issue everyone a cell phone and pay for a certain monthly minute plan depending on your position. Then, they changed it to where they no longer issued you a phone or paid for a plan or reimbursed the plan, but you were required to have a cell phone so that they can contact you 24/7. Quite clearly was just a cost cutting move. They did not pay the employees any more money when they stopped providing phones.

Re:Offloading IT cost onto employees

[sociocapitalist]

Contractors (or their agencies of which they are employees) also get paid more than employees in order to cover such costs themselves. I know because I've been doing this since 1990.

My vote is with the 'This is cost reduction by the companies and nothing more' opinion.

Logically speaking, if I were an employee my attitude would be 'You give me a shit computer and that's what I'll use and you'll get whatever I can provide with it. If you want want to provide me with something better then you'll get more out of me'.

You employees who are buying such things yourself should be thinking about what that money could buy you and your families.

Re:Offloading IT cost onto employees

[starfishsystems]

It turns out that most (although perhaps not all) employees job requirements "fit" with the contractor IT model.

Having been tried, it turns out not to be so, not as a practical matter and not in law. I've worked in several countries, all of which have extensive legislation whose effect very much depends on whether you are an employee or a contractor. Taxation, holidays, medical and pension benefits, workplace protections, insurance, liability, intellectual property: they all depend heavily on this distinction.

As a practical matter, any contractor engaged by an organization has to have a contact point within the organization who is trusted by that organization to safeguard its interests. The employee and contractor may work side by side on the same project, and may bring very similar skills to bear, so it's worth examining the differences between then in such a case.

Legislation aside, the relationship between contractor and organization is loosely coupled by means of whatever contract is agreed by the two parties, most often initiated by the contractor. Conversely, an employee doesn't present the employer with a contract. It's invariably the other way round, and seldom negotiable, and in general expressed in tightly coupled terms.

Now, people are people no matter what hats they happen to be wearing, so of course there is always the possibility of malfeasance, incompetence, or actions in bad faith by anyone. However, the legal and sociological expectations are very different for the employee who functions as a contact point and for the contractor as the counterpart in the relationship. Organizations which respect this distinction can develop and enforce effective security policies. Those which don't, quite simply, can't.

Re:Offloading IT cost onto employees

[crath]

This is business as usual in the "real world", my diesel mechanic cousin owns all his tools...

The caveat is that those professions are able to deduct the cost of tools as business expenses (for tax purposes). IT tools need to be deductable if we're going to fully embrace a BYOT model.

Re:Offloading IT cost onto employees

[QuantumRiff]

Does your diesel mechanic buddy worry that if Snap-On audits his office, and finds he has a counterfeit wrench, his company could be fined $100,000 per counterfeit wrench?

Does his company MANDATE exactly which tools he buys, how often they are inspected, and tell him when to go buy new ones?

If he doesn't clean his tools regularly, does it take down the shop for the day?

I will bring my own computer, when I can USE my own computer.. (I don't run AV on my linux laptop, and since their is no AV compatible with their NAC software, it won't go on the network)

Re:Offloading IT cost onto employees

[Rich0]

It turns out that most (although perhaps not all) employees job requirements "fit" with the contractor IT model.

Sounds great, boss. You tell me what you want done and I'll go ahead and write up a task order and give you a quote. Oh, you need it done a few days sooner - no problem, I'll go ahead and write up a change order for you and the deadline will be measured from whenever you get me the new PO.

Oh, your boss asked for a couple of words to be tweaked? No issue at all - I'll get another change order out on that right away.

You want somebody at your beck and call - hire an employee. You want to pay fee for service, great, I'm happy to be your contractor.

Re:Offloading IT cost onto employees

[Renraku]

"Welcome to your first day at the office. What kind of computer will you be bringing in to do your work on? You're only allowed to buy from Dell from this short line. Also mention our company code when you buy so they can confirm with us that you purchased. Failure to buy from Dell means immediate termination. Also, here are some great offers from our partners."

Re:Offloading IT cost onto employees

[certain death]

I keep hearing people say the same thing you have just said (probably just parroting stuff you have heard someone else say, I would bet). "Good IT and Security is invisible to the user". Pure bullshit. If I were to block your from inserting a USB thumb drive into your computer and not pop up a little window telling you why and who to contact if you REALLY need to insert it, then you would be screeching to desktop support about how your "puter" was busted. Tell me...how many people would pay attention to IT or Security policies that were "behind the scenes"? If you had no idea that you were violating the policies, you might be making ignorant statements...oh, crap, nevermind. Pull your big boy pants on and quit expecting the world to hand you every fucking thing you want on a silver platter, if you want to use a shiny new laptop, fee free, but do it at home and use the one you are given for work, STFU and get some work done.

Re:Offloading IT cost onto employees

[LDAPMAN]

They are deductible in the exact same way the mechanics tools are deductible.

Re:Offloading IT cost onto employees

[LDAPMAN]

Actually, in some cases they DO mandate what tools he buys. For example, a BMW mechanic I know is required to buy a specific laptop, diagnostic software, and a number of specialized tools.

Re:Offloading IT cost onto employees

[LDAPMAN]

The idea is that they don't support it in the same way. They support the interface points like VPN, mail server, Citrix, etc. They DON'T support the device itself. They also no longer need to worry about lifecycle management of the device. The idea is to also reduce CAPEX.

Re:Offloading IT cost onto employees

[Grishnakh]

You need to find a new job. If they are only willing to provide you junk (unless you don't actually require computers specifically to do your job), they probably don't value you much more than junk.

My company... The way it works is like this: If you don't want to deal with it, they buy you whatever the latest blackberry is and cover the service

So, you're telling the OP that his employer sucks because they only provide him with junk, and then you talk about your own employer, which provides you with junk as well? Pot... kettle...

Re:Offloading IT cost onto employees

[Karl Cocknozzle]

Good IT and security is invisible to the user.

Spoken like someone who has never had to provide either one... Those policies exist so you can continue to have a job and paycheck when one of your less-educated coworkers downloads the latest malware because IT "got out of his way." And when that malware allows corporate spies from China to steal your company's advantage, or maybe even their entire reason for being in business, remember this conversation on the unemployment line.

Re:Offloading IT cost onto employees

[Em Adespoton]

My mod points appear to have just expired. But I have to say, "Hear Hear."

However, Good IT and Security SHOULD be invisible to the user. It should be invisible not because IT services and InfoSec is invisible, but because all users should be following best practices out of pure habit. When this is the case, you should NEVER have to see anything IT or InfoSec has to handle, unless it's a cataclysmic network failure.

Of course, the downside to this is that if you're bringing your own kit to work, IT and InfoSec will need to have complete access to it, and the ability to lock you out of doing things they don't want you doing on your equipment.

If this happened, what they do should be invisible to you (assuming work is investing enough in IT and Security to enable them to do their jobs appropriately... this rarely happens in real life), but at the expense of you no longer having a private life on those devices.

Where I work, you can connect to the local network with your personal Android or iOS device, but to do so, you must have a non-jailbroken device that has had the corporate security policy applied to it. If you do this, IT will monitor the device for you and fix/prevent what it can in the background, alerting you if there is something you personally have to do (like bring it in for repairs).

You can not have invisible support and privacy; you have to pick one or the other.

Re:Offloading IT cost onto employees

[Anonymous Coward]

No. If they are going to expect you to do work, then they should either provide you with an excellent machine to do said work on (not "junk"), or they should compensate you for the use of your device.

No they don't need to provide you an excellent machine, especially since excellent and junk are pretty arbitrary terms when it comes to describing computers. All I need is something that provides me a reasonably larger monitor so I can have multiple shell windows open as well as reading my mail and using a modern web browser. A graphic artist would call such a machine junk...

What the company needs to do is provide you with a machine that is capable of fulfilling the tasks of your role or accept the draw backs of not doing so (e.g. takes 6 hours instead of 2 to convert video, etc..). A system that meets those basic needs is not junk.

To the average corporate user, however, such a system would be junk because it would be slow and mostly unusable after they got done loading all the mouse pointers and screen savers that they have no need for on their work computer.

Re:Offloading IT cost onto employees

[stewbacca]

Actually, your expert commentary goes against my anecdote. I left a company overburdened with red tape and security policies. They went from 500 employees to under 200 now, mostly due to the inability to actually meet contractual obligations due to regressive IT policies. Furthermore, talent like myself just went to other companies with more forward-looking policies that will ensure longer business stability. One of which is the ability to use our own gear, the other being no ridiculously complex security policies that don't let yo do simple things like fill out a timecard while traveling. When you CAN'T do your job without having to file an IT ticket then wait several days for resolution, you can't be productive. No IT policy should be so restrictive.

Re:Offloading IT cost onto employees

[Karl Cocknozzle]

How is it a cost for people who would own the devices anyway? I have an iPhone and and iPad on my own accord.

Wear-and-tear: There are only so many "taps" in a touch-screen's usable life. Do you want to use them getting laid with your girlfriend or deleting bullshit "forwards" from your idiot co-workers?

Consumable services: Your data plan is in the process of no longer being "unlimited." Every byte you burn for the company potentially puts you into an "overage" situation where you're paying through the nose for "extra" bandwidth. Will your employer reimburse for that? Or are you just "on your own" for the balance of the bill that month?

Re:Offloading IT cost onto employees

[stewbacca]

Wow, thank you for solidifying our stereotypes about IT people.

Let's start with your thumb drive example...what use is a thumb drive if you can't use it? Yeah, yeah, I know that's over simplified, but seriously...anything a computer CAN do, you IT types try your hardest to not allow it.

Here's a more mature discussion. When I say it should be transparent, I'm talking about how I shouldn't have to call the "help desk" a couple times a month to reset my password because the Active Directory locked me out for no reason. I know you IT types think we users are just dumb and lock ourselves out at random (and to be fair, I'm sure a good many do), but when I call and say, "I tried to log on this morning and the first time I entered my password it tells me my account has been locked and I need to contact IT support". That is not transparent.

Another example would be that I have some work-related/work-created materials on network A and it needs to be on network B...but since you've disabled my USB ports, and you won't give me credentials to be on network B, now I have to put in an IT ticket and wait days to do something I could do myself in 5 seconds that posed very little risk (malware via thumb drive).

But anyway, those days are behind me. I work in an environment that is a free-for-all/download what you need (from vetted sources, hosted by our IT folks, so no legal shenanigans). Maybe it's because it's an OS X environment, or maybe it's because we don't have network accounts, but we are much more productive than any sort of hyper-controlled IT environment I've worked in before, but with the slight loss of the convenience of a roaming profile.

I'm not sure I came here for a fight about security. I'm not sure what I posted was incendiary, but I should have guessed the IT types would come crawling out of their server farm to tell us users how stupid we are.

Re:Offloading IT cost onto employees

[stewbacca]

I'm perfectly fine with invisible support an no privacy. Productivity at the price of privacy is fine with most of us. If I wanted privacy, I wouldn't be such an advocate for us bringing our own gear to work. I know it's a cliche, but since I really don't have anything to be afraid of in my personal life, I don't mind it mingling with my professional life on one portable computer. Part of that trust stems from knowing I don't do anything illegal/stupid like run a meth lab ingredients macro and the other part stems from my trust that my employer is very cool and only cares about results, and not personality quirks.

Re:Offloading IT cost onto employees

[stewbacca]

My coworkers aren't idiots and I have a wife, not a girlfriend, so I guess the lifecycle of my iDevices is longer than most.

My phone data plan isn't charged when I use the company campus-wide WiFi signal. My iPad doesn't have a data plan.

And yes, my company would reimburse me for data usage I incurred while away from the company WiFi network. It's called an expense voucher...most major companies will do that for you.

Re:Offloading IT cost onto employees

[ottothecow]

I have heard of this happening...my suggestion would be to keep your phone synced/backed up. The inconvenience of having to do so (to me at least) far outweighs the inconvenience of having to carry around 2 phones.

Also, I have not tested this, but I am pretty sure that the Touchdown exchange client for android will only wipe its own stuff on a remote wipe. At the very least, I know it has a setting to not wipe the SD card that is not attached to group policy (so you could just make sure to store photos and other important bits on the internal "SD" or an actual SD card)

Re:Offloading IT cost onto employees

[ottothecow]

I don't see that working well. Maybe in an environment where your users are a bunch of picky linux programmers who are so particular about their systems that they would never let anyone touch them...

For most places however, you would get a bunch of people with no idea how computers work (often even if their job involves heavy use of computer software and specialized programming). They buy a shiny new dell and connect to citrix or the VPN (although this seems like a great way to get a virus on your network). When the shiny new dell stops working right, they are going to call IT. Sure the problem is probably with their personal Dell, but IT is going to have to fix it.

IT might say "no, we don't support personal systems" but when bossman's Dell breaks (or bossman's employee who can't finish their work because their dell broke), they are going to order them to fix it anyway because they are losing precious billable time to a broken computer.

Re:Offloading IT cost onto employees

[CAIMLAS]

Do mechanics have to drop 3-4 thousand dollars (or more) for their tools annually? How about electricians? Sure, if they're running the shop on their own and they've got a stake in things, it makes sense. Most IT people are fairly powerless and low down the chain. We're not seen as 'producers', we're seen as cogs that cost money.

Re:Offloading IT cost onto employees

[LDAPMAN]

VPN in this case only gets you to the Apps/Citrix. The whole concept of inside vs outside changes. User machines are NEVER inside in the traditional sense.

Yes, there will be cases where you have to help the user anyway but there are many, many issues that go away. Do you provide in-depth hardware support for people accessing your web site? Same concept. Limit the scope of what your responsible for.

Re:Offloading IT cost onto employees

[Anonymous Coward]

IT will get a bullet in the brain if it touches my laptop. kill yourself you fucking nerd.

Re:Offloading IT cost onto employees

[ottothecow]

If every user of your website was worth more than your salary (and you wouldn't have a job for long if your company didn't think you were worth more than they pay for you to stick around), you would probably provide pretty in-depth support to make sure they keep accessing your website.

Would you want to pay someone 80k a year to troll tech support forums from the public library because they can't seem to get their network adapter to work right?

Re:Offloading IT cost onto employees

[LDAPMAN]

No, you pay somebody to be there to help him. You no longer pay other people to manage the workstations and you don't spend capital on HW.

Re:Offloading IT cost onto employees

[vlm]

You need to find a new job. If they are only willing to provide you junk (unless you don't actually require computers specifically to do your job), they probably don't value you much more than junk.

Wow I missed this yesterday... Its a megacorp thing. There are at least 12 levels between me and the top multimillion/yr CEO and board members. Therefore I must be provided "status symbols" on my desk that are 12 levels beneath what they have on their desks or else they can't feel superior.

That said, to a multimillion/yr CEO a rack of servers is not a status symbol. So I have whatever I want, heck almost whatever I can dream of, WRT to virtualization quotas, NAS quotas, etc. What I don't have, is a brand new 2011 computer to run putty/ssh on. Its more like 2003, an early 4000 series nvidia card, etc. I do have multiple monitors, which is really nice. And a airgapped linux desktop machine that lives on the production network as opposed to the IT network, because I need access to the production network. My desktop is little more than a ssh client and a web browser for me, so I don't particularly care, and in my job position it simply doesn't matter... Reducing putty ssh latency from 2 microseconds to 0.2 microseconds would have no effect. However I can only imagine the nightmare a peon CAD operator would go thru, since they're several social and salary levels beneath me, therefore they must be using old 386dx-40 to do their job...

Buy your own devices

[betterunixthanunix]

FTFY.

Really, why buy equipment for your employees when you can just make them buy it on their own?

Re:Buy your own devices

[0123456]

Really, why buy equipment for your employees when you can just make them buy it on their own?

And get them to work for free in their own time because they're now 'mobile'.

DOUBLE WIN!

One day all those people demanding that the IT department let them connect their phone to the network will be feeling nostalgic for the days when they didn't have to.

Though perhaps it would allow the Slashdot admins to build a site that works; I've had to turn Javascript off because of randomly vanishing 'Reply' buttons that do nothing other than say 'Working' when I press them.

Re:Buy your own devices

[betterunixthanunix]

Though perhaps it would allow the Slashdot admins to build a site that works

By my recollection, we had such a site just a few years ago. Somehow, we were not dealing with a bunch of 503 errors, javascript issues, and other failures that make the new /. a pain in the ass to use. I guess all that code was deleted or something...

Re:Buy your own devices

[Lumpy]

My employer knows that the second I leave the office my work iPhone is set to mute. it will be unmuted when I arrive the next day. IF I am on call then it does not get muted.

I got a call on my personal phone once from a manager at 11:00pm one night about a stupid question, the next morning, I billed his department for 1 day of On call tech and the hours from 5pm to 11:30pm as well as added that to my timesheet.

He freaked out but was told that once again he was supposed to call the NOC like he had been told 20 times before and they will have the on call guy call him back. Every time he calls someone other than the NOC his department will be charged for the emergency on call even and all the hours from 5pm until the call was resolved.

Solved the problem instantly. Once in a while we get another nimrod in the company that finds someone's cellphone number and bugs them after hours... the guys enjoy the once or twice a year $300.00 bonus in their check for answering a phone off duty because an idiot manager cant follow the rules.

Re:Buy your own devices

[Oligonicella]

Been there. I got a call at 2AM from an operator. To report? "It says there were 0 disc errors in the backup. What should I do?" I very much enjoyed (in a malicious way) highlighting this occurrence with his boss Myrna, at the Thursday VP meeting. Crap stopped when they instituted cross department billing.

Re:Buy your own devices

[stewbacca]

Who works in tech that already doesn't have a bunch of personal tech that is most likely better than the crap their companies will provide?

In my last two jobs, I wish they HAD made me buy my own gear...I'd probably still be working there.

Re:Buy your own devices

[markjhood2003]

It depends upon how well your employer is doing and how much they value their employees. At my previous gig we all had nice shiny new MacBook Pros that were purchased before the Great Recession started, but they sure weren't going to replace those 2007 MBPs with newer versions the way the business was going.

At my current gig I was outfitted with a brand new max-spec 2011 MacBook Pro along with a beautiful 27" Apple Cinema LED monitor, and they told me I could get a MacPro tower as well if it would make the builds go faster. I thought that was overkill so I opted for an SSD for the MacBook Pro instead.

The equipment I use at work has almost always been better than I could afford at home, going all the way back to when I was developing on VAXen.

Spam

[Anonymous Coward]

What's with the Infoworld spam about this subject?

Today, report that businesses are encouraging users to bring their own devices.

Posted yesterday, how to get around businesses preventing bringing your own device: http://it.slashdot.org/story/11/12/18/2154224/how-to-thwart-the-high-priests-in-it

Am I imaginging things, or is somebody there trying to drive some agenda? (No, I didn't read either FA - I refuse to visit their website.)

Related: Businesses loosing more customer data

[who_stole_my_kidneys]

with users bringing their own devices and loading sensitive data on them , customer data is lost in so many directions, its hard to point out the who actually "lost" the data in the first place.

Re:Related: Businesses loosing more customer data

[blue_teeth]

From The Fine Summary "'Two of the most highly regulated industries -- financial services and health care (including life sciences) -- are most likely to support BYOD".  Give me the names of banks who are encouraging this BYOD.  If my bank is in the list, I will close all my accounts.

Re:Related: Businesses loosing more customer data

[mikehilly]

I think the main reason that those industries are interested is that a lot of the tools/apps the user base works on is through a secure web portal. Any data access behind the portal is limited so that it can not come down to the local device. If you think about it a good example is employees who use a "thin" computer like a Wyse terminal. If they can access the same apps/session behind a secure web portal from a DMZ based wifi network on their personal equipment who cares? The data that matters (financial or medical records) is still secure and only available inside the company data center and it never really leaves the secure environment. Obvious downsides are any local keylogger program and/or spyware that takes screenshots but there can be additional checks/scripts run from the web portal to minimize the threat of those attacks.

Re:Related: Businesses loosing more customer data

[Anonymous Coward]

^^^^^

This exactly. I have worked in IT for far to long and see the idiocy of far to many people to trust them and their home devices with any of my data. Between their surfing of sheep porn and downloading from Kazaa. I dont trust them or their devices and I will do everything in my power to keep it that way where I work. Sure in theory VDI is cheaper but only if you stop buying devices for your employees AND you stop supporting whatever they use. What happens when john is down for a week because his hard drive crashed and his boss is yelling at IT because you wont help poor john. He isnt doing his job for a week lets say he makes 1500 a week. A 1000 dollar laptop provided by the company which is support, warrantied, and secure or a 400 dollar wally world special with no warranty, god knows whats on it, with no support- but hey dont worry he accesses VDI which already costs us just as much or more than providing the laptop ourselves thanks to back end infrastructure and licensing being essentially the same or more....

Am I missing something?? I have done this 500 times in my head for my job and the numbers never come out in the BYOD/VDI camp. Its a short term gimmick with to many problems. There are reasons for VDI etc like someone else said maybe allow more telecommuting so people can work from home saving on building, security for consultants, maybe heat or production room constraints. But for simple remote access?? Id rather they have a company laptop with firewall,AV, remote management, FDE and VPN.

Re:Related: Businesses loosing more customer data

[tsotha]

I don't see how scripts on the web portal can protect against keyloggers and other spyware.

Re:Related: Businesses loosing more customer data

[ottothecow]

You're forgetting that the article (and summary) are really focused on phones, and to a lesser extent, ipad type toys. This isn't about your primary workstation where the numbers never make sense.

Most people prefer to have their own phone and from an IT standpoint, they are pretty low support (configure exchange and you are pretty much done) and not as essential as a workstation (if you can't get email on your phone for a day it probably is just an inconvenience...if your laptop fails you could be screwed). Most companies also know that its better to keep your workers happy and letting you carry a single phone of your choice and play with your ipad during meetings is a good way to keep you happy while at the same time making sure you stay in contact.

Obvious

[AmiMoJo]

Productivity = profit, and profit is more important than looking after customer data.

Fuck you, No. Pay me more.

[Jackie_Chan_Fan]

Anything required for work, the employer pays for, or I simply wont buy it. Not my business, not my problem.

Re:Fuck you, No. Pay me more.

[betterunixthanunix]

The problem is that there is undoubtedly someone at your job who does not feel that way, and who is willing to buy their own equipment -- and then they are going to get promoted while you are being laid off. This assumes, of course, that you are not a member of union or that if you are in a union the union does not have the backbone needed to stand up to your employer, which I think is a fair assumption in this day and age.

Re:Fuck you, No. Pay me more.

[vlm]

You've got to be kidding. No Clothes? No Shampoo? No Nail clippers? No Haircuts? No Shoes? jpeg or it didn't happen...

How about a home phone? My local HR was freaked out about my temporary lack of a landline, "Are you homeless? In Jail?". They're not willing to pay for it, but they assume you have it if you're going to work there. Ended up listing my cellphone as both home and cellphone. Not seeing it as a huge problem.

Re:Fuck you, No. Pay me more.

[betterunixthanunix]

My local HR was freaked out about my temporary lack of a landline

They need to reach you instantly, at any hour of the day? Then they need to buy you a cell phone. Maybe you spent the past few nights at your new girlfriend's house, or you had to accompany your spouse to a funeral, or you decided to spend a few hours walking along the beach to center yourself.

Ended up listing my cellphone as both home and cellphone

So you are basically paying by the minute when your employer calls you. Yes, I know modern cell phone plans sell you blocks of hundreds or thousands of minutes, but the point here is that you are paying to make yourself available to your employer when you are not even at your office/job site. It may be rude to say this, but this is not really a situation that you should be in.

Re:Fuck you, No. Pay me more.

[vlm]

They need to reach you instantly, at any hour of the day? Then they need to buy you a cell phone. Maybe you spent the past few nights at your new girlfriend's house, or you had to accompany your spouse to a funeral

I suppose if I told my wife I was at the girlfriend's house, and I told the girlfriend I with with the wife at a funeral, I might finally have the spare time to get some stuff done in the lab without interruption... I think you're on to something here...

So you are basically paying by the minute when your employer calls you. Yes, I know modern cell phone plans sell you blocks of hundreds or thousands of minutes, but the point here is that you are paying to make yourself available to your employer when you are not even at your office/job site. It may be rude to say this, but this is not really a situation that you should be in.

Ah its not so bad because I am in a rather weird/unique situation of not being salaried as my current employer categorically will not go salaried for non-management employees, and being a tightward cheapskate I have the worlds most expensive pay per minute cellphone service, which even at its inflated rate is something like one nineth my hourly hourly rate at time and a half overtime... Work is paying me nine times what I'm paying the phone company for the privilege of talking to me, so I'm all good with that profit rate. When the phone rings with a call from work, I almost feel my wallet getting heavier as I talk... makes me want to speak slower, sometimes. I can see why a salaried guy would be pissed off, but theoretically they are paid more to make up for calls like that, theoretically at least.

Sometimes, at home, without being paid for it, I even read computer books. Weirdly enough, I like Knuth. I know, I'm a sick, sick man, etc etc.

I am very happy not to have to carry two cellphones, and sometimes being always available is an inherent part of the job... which is probably partially why my pay rate is so high to begin with.

Its like arguing that the company should pay for the detergent used to wash my work clothes an extra time if I come in to work on a Saturday, after they cut me a check for overtime around the size of a decent car payment... geeze don't look a gift horse in the mouth, take the money and run.

Re:Fuck you, No. Pay me more.

[s73v3r]

No, the clothing and grooming argument is simply retarded. Drop it.

Re:Fuck you, No. Pay me more.

[Belial6]

I know that I also wouldn't want to have to carry two phones. I telecommute, so it isn't really a problem for me, as leaving an extra phone on my desk isn't a huge deal, but if I was more on the move, it would be a hassle. I wouldn't want another PC on my desk tough.

What often gets missed by the "work and home are separate and never two shall meet" folks is that there huge opportunities for life that they miss because of it. Last summer I was able to take a 6 week road trip with my family because I don't draw that line. I simply could not have rationalized the cost of 6 weeks of lost pay, the expense of the trip itself, and the lowered value I would bring to my work by having a 6 week absence that could leave them inconvenienced for weeks while I was gone.

Would it have been physically possible to take the trip without working during it? Sure. Would it have happened? Would I be able to do thing like that as often? Definitely not.

On top of not having to take the 6 weeks off, I was able to tether my phone to my laptop and work from the back of the mini-van during the long stretch between interesting sites. There is no way that the company would have set me up for that. I need all new equipment because I want to take a 6 week road trip with my wife and kid just isn't the kind of argument that tends to work on most employers. If I didn't use my own equipment, not only would I have not taken the trip, the idea that the trip was even possible would not have even come up.

Re:Fuck you, No. Pay me more.

[anyGould]

You've got to be kidding. No Clothes? No Shampoo? No Nail clippers? No Haircuts? No Shoes? jpeg or it didn't happen...

How about a home phone? My local HR was freaked out about my temporary lack of a landline, "Are you homeless? In Jail?". They're not willing to pay for it, but they assume you have it if you're going to work there. Ended up listing my cellphone as both home and cellphone. Not seeing it as a huge problem.

I got some funny looks from my HR, but I simply told them that my manager (at the time) had abused the privledge of knowing my home phone number one too many times, we had it changed, and I didn't see a compelling need for them to know it - my address is correct, mail is a wonderful thing.

I suspect this panic will wane, though - a lot of folks are going cell-only ("I'm never home, why do I want to pay for a phone there?"), so it will become more common as time passes.

Re:Fuck you, No. Pay me more.

[betterunixthanunix]

Sometimes, at home, without being paid for it, I even read computer books. Weirdly enough, I like Knuth. I know, I'm a sick, sick man, etc etc.

Two things:

1. Right there with you, brother! I am actually looking forward to TAoCP 4B.
2. Nobody is requiring you to do this; if you wanted to stop and take a nap, or switch from reading to vegging out with Youtube, or just go do whatever else, it would be perfectly fine. The point here is that when you are home, you are theoretically free from your work obligations; in some cases, this is not true e.g. you might be on call for something, in which case I would argue your employee should provide you with a cell phone or radio of some sort by which to reach you. It might just be that I have a different take on the philosophy of employment.

Re:Fuck you, No. Pay me more.

[sociocapitalist]

Legally (IANAL) you might also be due overtime pay if your employer requires you to be available outside of working ours, especially if they actually expect to be able to reach you.

Re:Fuck you, No. Pay me more.

[Anonymous Coward]

... your country sucks
where i am, you don't pay to receive calls
only to make them
same with sms

Re:Fuck you, No. Pay me more.

[Grishnakh]

It depends on your profession. If you're a software engineer or other IT person, that assumption is totally wrong because it's an employee's market right now. Of course, a bunch of people want to point to the fact that the economy's in the toilet and unemployment is high, and then infer that this is true for ALL professions, when it could not be further from the truth. If you're a barista, yes, the job market is pretty bleak right now. If you're an experienced software engineer, the job market is excellent right now. Of course, as usual, the pay is fairly mediocre, but if you get laid off, you'll have no trouble finding a better job within a week.

Re:Fuck you, No. Pay me more.

[Grishnakh]

How about a home phone? My local HR was freaked out about my temporary lack of a landline, "Are you homeless? In Jail?".

They were freaked out about you not having a landline at home? What year was this? 1995?

The only people I know who have landlines any more are all over 70 years old.

Re:Fuck you, No. Pay me more.

[vlm]

How about a home phone? My local HR was freaked out about my temporary lack of a landline, "Are you homeless? In Jail?".

They were freaked out about you not having a landline at home? What year was this? 1995?

Its a big company dilbertian thing. "The form Must be Filled Out Completely". If I submit incomplete paperwork, and she accepts it, it might be her job for not enforcing corporate standards of paperwork completion accuracy, etc. I know that I did not ruin her chances at getting the top scale 2.5% raise by lowering her paperwork accuracy completion metric score, because if she was on the edge of getting higher pay, she would have argued with me endlessly and/or tossed out my paperwork to hide it, so she's probably soundly positioned in the middle of the 2.4% pay raise scale, with no need to care other than keeping up appearances. If they ever decide to get rid of me, Then falsification of corporate records will probably be the charge used, because I provided no home phone number I would have my unemployment claim categorically denied, fired for cause. Kind of like cops love making everything illegal, so they can selectively jail anyone they want because absolutely everyone is guilty of something now a days.

Perhaps in 25 years someone will reorg the dept and redesign the corporate standard record form to not include "home phone number" because its been an obsolete concept for decades, at which time I'm sure the new corporate standard will be mandatory required documentation of your ICQ number or perhaps AOL screen name, all completed forms must include your eleven digit compuserve account number or else you are guilty of a corporate SOX violation or something.

Re:Fuck you, No. Pay me more.

[Anonymous Coward]

When you make it past grunt level peon you'll realize that the success of the organization dictates your success.

Re:Fuck you, No. Pay me more.

[Jackie_Chan_Fan]

Its not that simple, you act as if there is no value in a specific employee.

You might be firing your BEST most capable employee... and finding a replacement of equal or greater talent may be very difficult.

Re:Fuck you, No. Pay me more.

[Grishnakh]

Its a big company dilbertian thing. "The form Must be Filled Out Completely". If I submit incomplete paperwork, and she accepts it,

Yes, but it's neither your nor her fault if the paperwork has fields which are Not Applicable. For instance, what if there's also a field for your middle name, but you don't have a middle name? Lots of people don't have middle names, especially people who aren't American by birth (I'm pretty sure middle names are nonexistent in India, for example). What then? It's the same with a "home phone" number: a huge portion of the population no longer has one of these. Why so many places still insist on this, I have no idea. Surely the people writing the forms aren't all in their 80s.

Next time someone asks me for a "home phone number", I'm going to ask if that's like those phones that you had to spin a crank to talk to an operator.

Extrapolating isn't always good

[regular_guy]

The article discusses health care as the main industry that's important to have 24hr information connection, and by utilizing mobile devices that information and connectivity can be available 24/7. This is then generalized, saying because it works there all companies should utilize this opportunity to get a high ROI on employee efficiency. While we've all seen these posts before, what other industries require 24 hr access from all employees? I know managers and the like in most all businesses often are required to be on-call, but this seems to be addressing the lesser employees, as in the manager contacts his/her subordinate, making the subordinate more or less be on-call. Does anyone have such circumstances (besides power plants/industry and manufacturing)? Is it often outlined in your contracts?

If you want something right ..

[ackthpt]

You bring it yourself. Yeah. Brought in my own software so I could get things done. It's not just smartphones, people.

Re:If you want something right ..

[Anonymous Coward]

And you also brought in your pirated movies, trojans, and worms and god know what else. Maybe not you specifically but sally from accounting, and john from sales did.

Yes in some cases the IT literate may be better off, but in most cases we are not protecting our companies from the tech savvy... its the ones who think because they bought a mac they cant bring in a virus or the ones who think the 1 year version of norton is good enough that we spend all our time protecting against.

Re:If you want something right ..

[Anonymous Coward]

And when your ill-behaved shit takes down a server because the VisualBasic/Java fuckwad who wrote it doesn't comprehend shared resource locking strategies, that's fine?

When you get fired and have a truckload of company data on your property, my unilateral remote-wipe of your property is fine?

When you've done nothing wrong, and someone accidentally initiates a full remote-wipe of your property, that's fine?

When some fuckward in HR gets fired and has all of YOUR personal data in their tab, and I CANNOT remote-wipe it, that's fine?

Stop being so myopic.

Re: Preventing

[ackthpt]

What's with the Infoworld spam about this subject?

Today, report that businesses are encouraging users to bring their own devices.

Posted yesterday, how to get around businesses preventing bringing your own device: http://it.slashdot.org/story/11/12/18/2154224/how-to-thwart-the-high-priests-in-it

Am I imaginging things, or is somebody there trying to drive some agenda? (No, I didn't read either FA - I refuse to visit their website.)

Two kinds of shops - a) those who want absolute control over all IT objects and b) those where results are valued more highly. Where I work there's discouragement from bringing your own devices or software to the party, but often that's the only way you get it done - and done timely.

I needed to have a web app up and running last spring - if I waited It would have been this Fall. I used what open source tools I could to get up and running - nothing beautiful, but highly effective. All done against the grain of things .. so guess what, it caught the attention of leadership and I was lauded for such a great advancement in service.

It could drive one to madness.

Enough Galen Gruman/Infoworld stories on /.

[Kamiza Ikioi]

Slashdot just posted this other Galen Gruman story based on how to get your user devices into your business behind IT's backs: http://it.slashdot.org/story/11/12/18/2154224/how-to-thwart-the-high-priests-in-it

Now another story about user devices getting into business behind IT's backs, also by Galen Gruman.

Enough already!

Verify Certificate

[Anonymous Coward]

Anyone else getting a 'Verify Certificate' warning on the infoworld.com (2nd link) URL?
 
Safari can't verify the idendity of the website 'www.inforworld.com'.
The certificate for this website was signed by an unknown certifying authority....

Pure unfounded hype.

[rickb928]

I scanned TFA, and it looks like I will disagree with 70-90% of the assertions therein. I can't call them 'facts', because they aren't.

No mention of the security issues surrounding BYOD. For industries that reject bringing your own notebook to work, the assertion that financial services firms are embracing BYOD borders on the ludicrous, with a healthy dose of fantasy. Here at least, in a Fortune 50 financial services company, BYOD isn't even up for discussion. The security issues for Personally Identifiable Information alone rule out permitting any significant use of data on a device that is unsecured. And YOD is presumed to be unsecured, since it cannot be confirmed or assured by the people in data security that are responsible for preventing data loss. That's not 'minimizing' the loss, but preventing it. Nice try, Infoworld, but you're not fooling me into thinking I can load up my Android or iOS phone with corporate data. Not here anyways.

They then launch into how 'app-savvy' hardware is so great. Help me here - is 'app-savvy' another way of saying 'high-performance'? I thought so. Feh.

Good Devices may supply mobile device management systems to their customers, but I can name you a 50,000 seat company that may or may not use it, but if they do it's for captive devices - Blackberrys - that are never going to be BYOD. Quoting such a study is regurgitating their self-serving (and I expect nothing less, they are out for a propfit after all) hype and fantasy that with their services, BYOD is perfectly secure. Again, where I work, promises are not enough. Security is based on assurance. Little of it is provided by third parties. I can't even share data with co-workers in many/most cases. The concept of letting employees run mission-critical (data is mission-critical to a financial services company) or senstitive data apps would not be laughable here. It would be dismissed out of hand.

More to the point, however, the idea that somehow the device changes the nature of your work is both spot on and wide of the mark. If you're primarily displaying data, a table is par excellence. as soon as you need to enter data, it's a losing proposition. Depending on your role, tablets and smartphones offer some advantages.

My brother has been delivering real-time production data to his workforce worldwide (wherever there is a signal, WiFi, CDMA, GSM, or satellite) since Palm first made a phone. He's added native support for every OS as of last year. He sees the craze, and his boss asks him sometimes about how this 'Android thing' would work for them. And he responds that it has been working 'for a while now'.

And no, they do not do BYOD. They supply whatever is required for whatever geographic region the rep is in. But they could suport BYOD, since he supports some customers directly with the same apps, where they are BYOD only because it isn't 'his' device. And he sees the security issues. SSL is so flawed he considers it useless, but there is nothing else right now except for VPN tunnels. That's where he's at, and some Java sandboxing that he thinks is ensuring data is gone when the session is gone. But he knows that rooting devices will some day thwart that.

And since I can root most Android devices without a lot of effort, that alone makes BYOD for work just impossible.

Lastly, I read up on the link from IW that Android is making inroads into business environments that the IT staff are unaware of. Well, actually, I can't use any of my personal mail at work any more unless it's on my Android phone. I don't consider that a BYOD instance, since if I connected to the corporate WiFi, I wouldn't be able to use personal email on it then either. I can. theoretically, dump data to the phone via USB or a uSD card, but that would be logged and scanned, and PII would be captured and alarms sounded. Yes, my work notebook can be prevented from downloading data to a removable device, any sort of device. It can also check if the device is encrypted, which they all must be.

Hype. Misstatement. Fantasy. But it may sell more stuff, and that would be the point of TFA.

Re:Pure unfounded hype.

[Anonymous Coward]

BYOD is just Hype
Gee And I thought I was alone.
What could possibly happen without secure devices? Why have any security at all?
Loss of control of SECURITY
Possible lawsuits from Customers ( more unemployment )
Non-compliance with government regulations

GET A LIFE !

Re:Pure unfounded hype.

[rbraunm]

You make a lot of assumptions with your post. I am in charge of the infrastructure for a medium sized medical practice and we fully embrace the BYOD model. We have published guidelines about what is required on the computer (most recent service pack if it's Windows, most recent updates ubiquitously, antivirus software if it's Windows, etc.) and phones have a specific list of operating systems that are supported. Blackberry, Android, iOS in particular. We only support phones that have remote wipe capabilities and we routinely inspect our end user's phones for passwords. While it is obvious that you want to take any safe guards you can to prevent a loss of critical data to unwanted hands (a HIPAA violation is what I'm talking about here), there's not really a good reason to not allow an end user's computer onto your network. You need to take the same precautions as deploying a new image into your environment. Not really that complicated. I'm a little confused by the outright animosity at BYOD. End users are who we are here to support and, as long as we can maintain the proper level of security without significantly increasing the overhead, we should do all we can.

Re:Pure unfounded hype.

[rickb928]

Our limitations here are HIPAA and beyond, and yes there is regulation more onerous than HIPAA.

It's not me that's hostile to BYOD, I'm just reacting to what I see as a nearly false article. BYOD isn't penetrating the financial services industry at the higher level of large banks etc. It just isn't. The regulatory environment prevents it.

But you mentioned accepting only certain phone OSes, and list iOS, Android, Blackberry. That pretty much leaves S40/S60, WebOS, and what, Meego and the proprietary ones out, and of those there is not much to work with. So you essentially accept all useful smartphone OSes with a meaningful market share save WebOS. Not very exclusive, but very practical.

What sort of antivirus do you require for the Windows devices? Do you monitor updates? Functionality?

Do you require VPN access remotely, and do you permit Windows devices to attach to the LAN after being on other networks?

Around here, 'foreign' devices are forbidden. If I were still adminsitering a hospital network, that would be my preferred policy. Acceptance testing would include limiting off-network use to the employee or subscribed user. Family members etc would not be permitted. Since this is essentially unenforceable, it defers to an AUP and disciplinary processes, though I cannot imagine explaining to the CIO why the ER was down for a virus infestation due to an employee's machine carrying one into the house, especially if that 'employee' was an ER doc.

It was my experience in healthcare, expecially in a hospital setting, that outages had consequences, and were intolerable. In that environment, control = predictability = availability.

It's always a balance between enabling users to take advantage of what's out there, and keeping the joint running despite the dangers out there. At the hospital I was at, when asked why we wouldn't permit something, the answers ranged from 'we don't understand it', to 'it's not safe', to 'you already have something else'. The 'we don't understand it' response morphed into 'we can't support it'. MDs in particular would leverage their influence, we would sign off on a self-supported agreement, and without exception (for a five year span) they would require the support they agreed they would not ask for. And we made the exceptions. And we survived.

TFA focused on the financial industry. I doubt any federally chartered bank is permitting BYOD in the house, the regulatory risks are not worth it.

Re:Pure unfounded hype.

[rbraunm]

I agree with you. I just want it to be clear that there are ways to incorporate end user devices without significantly increasing IT overhead in most businesses. Some models, particularly hospitals and banks, obviously don't fit well into that category.

I wish I could provide a more cogent response, but it is a work day, the internet ate my response, and I have been fairly ill the last few days. Wah. Excuses.

Be well.

Maybe. If it is correct.

[khasim]

First off, those articles are very badly written. And they seem to be linked to InfoWorld's recent run of articles about how IT is PREVENTING such "adoption". Strange.

Secondly, he's quoting a guy from a firm that sells products to manage phones. He is NOT quoting ANYONE from ANY company in the health care industry.

In 2010 and for much of 2011, many in IT got scared when they saw iPhones, iPads, and Android in the office, fearful these heretical devices would cause corporate collapse as the BlackBerry sanctum was sacked and untold evils followed.

What?

OK, so most companies today have moved past that initial fear and made peace with the notion that modern mobile devices were now part of their technology fabric, though driven by user demand.

It is DECEMBER 2011. That's some fast action by "most companies" in a few months.

There's a HUGE difference between allowing such devices on the UNSECURED WIRELESS NETWORK and connecting them to the servers that hold private data.

He doesn't seem to be covering that difference.
And he doesn't have any quotes from companies that are doing what he claims.

Re:Maybe. If it is correct.

[SlippyToad]

And he doesn't have any quotes from companies that are doing what he claims.

I work for a largish healthcare firm. $6b fortune 500 company. We are doing it. The magic is Citrix, which insulates you from your end user's environment. We aren't yet to bring your own laptop except for a few folks in IT, but I see it coming soon.

Re:Maybe. If it is correct.

[jbolden]

I worked with companies that had untrusted client machines working with servers. The servers just have to be hardened. Instead of a perimeter defense model, typical corporate security, you move to a interior defense model where client facing machines are individually hardened and secured. Someone else mentioned a typical DMZ, that's a good analogy. Just imagine a huge DMZ, a small secure area and a small fully external area. What you do today inside the DMZ is what you have to do over the bulk of your network.

Re:Maybe. If it is correct.

[starfishsystems]

The magic is Citrix, which insulates you from your end user's environment.

Except that it doesn't. What part of "keystroke intercept" does Citrix protect against?

Re:Maybe. If it is correct.

[Karl Cocknozzle]

I work for a largish healthcare firm. $6b fortune 500 company. We are doing it. The magic is Citrix, which insulates you from your end user's environment.

...Except for key-loggers and screen-scrapes, which Citrix will always by definition be vulnerable to because even though you're doing the "computing" remotely, you're still typing and clicking locally.

Stop the INFOWORLD spam please

[Shivetya]

This is twice the submitter is from the site that has the story, worse its nearly identical if not the same one (ain't going to read this slashvertisement) where they were went off on IT departments enforcing standards.

Bring any device you want to buy

[hawguy]

At my workplace if you need a mobile device with email, IT will supply you with a blackberry. If you want something else, then they will pay you half of your subsidized device cost (i.e. if you need to pay $200 for a new phone, the company will pay you $100), and will pay the monthly fee they would have paid for the Blackberry (I think it's around $55, so it won't cover the entire plan, but should more than cover work usage). You own the phone and the plan, if you leave the company, you get to keep the phone, but you're still on the hook for the plan. LIkewise, if you drop it in a lake, you're on the hook to replace it.

IT will help you set up the phone for Wifi and Exchange email. Your phone has to allow remote wipe through Exchange to qualify.

It seems like a cheesy way to get employees to help shoulder some of the phone expenses, but also lets employees have pretty much any phone they want, so I see it as a net win for me. And most people don't *need* an Android/iPhone for work - a Blackberry could take care of all of their true work-related needs. Another nice advantage is that the company doesn't get my phone bills, so they can't see who I'm calling (like a job recruiter). And, I don't need to worry about losing purchased apps on a phone that's owned by my company if they take the phone back - it's my phone and my apps.

Not a perfect solution, I'd rather that they just gave me an Android for free, but with dozens of choices out there, the IT qualified device is probably not going to be the one I want anyway.

Strange, isn't it?

[khasim]

He's writing about how "most companies" are allowing users to bring in their own equipment ... while writing about how IT "priests" are preventing users from bringing in their own equipment.

But he isn't doing interviews with companies that are allowing users to connect to private. company data (the kind that would cause problems if leaked) via the users' own devices. Particularly companies covered by specific regulations such as health care.

Wouldn't at least one interview with the IT VP of a major hospital be appropriate by now? If nothing else, just to provide support for his claims.

Strange how that isn't happening.

Re:Strange, isn't it?

[joebagodonuts]

That would be too much work. Welcome to the new century, where no one wants to do hard, unpleasant things.

Re:Strange, isn't it?

[onyxruby]

He's become the new Jon Katz, how on earth did this guy ever get approved to write for an IT magazine? Your point about him lacking any companies that have any type of regulation to deal with is sound. We need a block on articles by this idiot.

Re:Strange, isn't it?

[SmurfButcher Bob]

Gimme a few seconds, I'll have a wikipedia entry that'll confirm every claim he's making.

Err...

fedex makes dirvers buy / rent there truck + route

[Anonymous Coward]

So you don't want this to go too far. But some places make you buy uniforms / coats at high costs.

What if a place made you buy your own Sony laptops and did not let you take other cheaper ones?

My case

[tool462]

My company has this policy, but I won't use it for one very simple reason:
You have to agree to a clause that allows them to remote wipe your device.
If it was truly a work device, this would be fine as it's theirs to do with as they please. It's my responsibility to keep whatever personal information I need backed up in a safe place. I'd probably still have my own personal device for personal photos/email/music/etc.
For a device that I own and pay for, this is not acceptable.

If the work access was appropriately sandboxed such that they could wipe only, for example, an encrypted partition of the SD card where the apps are installed and store their data, then I might be on board. Companies consider their data valuable, but I consider mine valuable too. And just like they won't give me root access to their servers, I won't give them root access to my phone/tablet/pc either.

Re:My case

[Jawnn]

You are right, on all counts, so don't expect to be allowed to BYOD. Do expect your employer to provide the tools necessary for you to be productive at your job.

Re:My case

[Relayman]

You bring the device to work and connect it to the network, the company pwns it. Remote wipe is only one feature, another is full inspection of all data on the device. I've heard of one person who got an iPhone 4S simply so her personal stuff is completely separate from the company network. Yes, that means 3G instead of WiFi at work.

Re:My case

[tool462]

Exactly. Though I didn't make that point explicitly, access to my data on my device by my company would not be acceptable either. The difference is, that would fall under my responsibility. I wouldn't just blindly trust them that they made their apps behave themselves and not look at my data. I would need to make sure they don't have access to anything I don't want them to access. I don't have the will or desire to go to those lengths for the privilege of paying to work from my own device.

Incidentally, I do have this set up for work access on my home computer. I have a clean VM with Windows installed that I use to VPN to my work connection. It provides that sandbox where my company can do whatever it deems necessary for their network security (AV installs, software audits, etc, etc) but have no access to my personal machine. Either of us can decide to remove access with no loss of anything valuable.

Legal Issue - can company erase YOUR machine?

[micron]

There is an interesting legal issue here.. IANAL though..
When the company owns the machine, there is a much clearer line as to who owns the applications and data on that machine. When an employee leaves the company, the company can "brick" the system with minimal problems. They own the hardware, they own the software licenses, and the company probably has a policy about no personal applications or data on the machine.
When the employee owns the machine, the rights of the company to erase data get really murky, fast. Does the employee have to agree to allow the company to inspect their (the employee's owned system) to remove company assets from the system? I don't see how that is going to work. My employer does not have the right to search my car after I quit, even though I called into conference calls in it, and used it for work related trips quite a bit.

I know of several companies that completely prohibit employee owned devices in the workplace for exactly the reasons I mentioned above.

Re:Legal Issue - can company erase YOUR machine?

[jbolden]

The company can demand you return their property. They can't however do an inspection to determine if you have. What happens is, it shifts the burdon of proof. The company has to prove by preponderance of the evidence that you do have their property so as to get a court order requiring you to return it.... If the company says they want to erase your laptop, you say you already deleted their stuff, they can't do much.

That's one of the reasons companies might want DRMed data and use application with much more DRM support if they want to move to this sort of remote model.

if people want to buy $2000 laptops in 2011...

[alen]

if people are willing to spend $2000 on Macbooks just to do their work, then management would be dumb to stand in the way and spend company money on company laptops

They offered that here at work...

[Lumpy]

Company bought Iphone with data and phone paid for by the company, or use your own phone and we give you $30.00 a month on your paycheck.

Considering I spend hours on tech support and blow through data like a madman for work, I'll take the company supplied one that coves all my work expenses instead of me paying out of my pocket for work related expenses.

Honestly, if they did not supply it and paid for the service, I will NOT use my personal one for work. So I hope this BYOD is getting companies to pay the employees cellphone bills completely.

Seconded.

[khasim]

If InfoWorld isn't getting enough page hits on their own with badly written stories like that, why give them any more hits?

Again...

[Jawnn]

If there's a business case for BYOD, IT should be supporting it. I said if there's a business case. That would include factoring in the additional expense associated with properly supporting these devices. It does not come freely, or even cheaply. Figure it out. If it makes more money than it costs, case made and IT will be glad to help. If not, don't go whining to the CIO, as some dickhead suggested in an earlier article.

Fines

[Culture20]

Two of the most highly regulated industries â" financial services and health care (including life sciences) â" are most likely to support BYOD

... until they get slapped with huge fines due to the whole concept of BYOD being against said regulations.

Re:Fines

[pete6677]

Right, because I'm sure the upper management of multiple companies in these industries NEVER thought of regulations when they approved this. Since you are so much smarter than all of them you should offer to sell them your consulting services.

There's a big question here

[onyxruby]

Are these devices presenting information or storing information? There is a world of difference between the two and I can assure that both finance and health industries have regulation that require governance in the event that data is stored.

That being said if the information is simply being presented (you log into a vm from home and all data is kept in the cloud) that's typically going to be ok. If information is being stored than you have large amounts of regulatory requirements you have to work with.

Home use devices are not inherently bad on their own. Having done enterprise management for both healthcare and finance I can assure you that both of these industries take their requirements seriously. They also both support large numbers of people that work from home by making the service available in a manner that can be controlled. This is something the troll of yesterday's "IT is an obstacle" just didn't understand.

Gray Area for Sarbanes–Oxley

[ponraul]

This is not surprising as it allows people to communicate off the record by using their own account on their own devices and maintain records that would not be subject to any retention rules. That sounds like a great business case to me.

Re:Gray Area for Sarbanes–Oxley

[anyGould]

You say this like it doesn't happen already - most people I know around here swap personal email addresses for "non-work related" things that IT doesn't like. Not really a surprise to learn that folks keep in touch even when they've moved to the competitor.

Re: Preventing

[Belial6]

Which is exactly why we have PCs in the workplace at all. If it were not for stories like that, we would all still be running on mainframe green screens. Whether that would be a good thing or a bad thing depends on who you ask.

About what I would expect from a "Smart User"...

[Anonymous Coward]

This guy seems to live in a dream world where facts and logic are irrelevant. I do have to wonder if the sky is brown for him.
IT fears no tech, we just don't want "Smart Users" to be putting the companies private data onto a device that can be completely owned by something as simple as plugging it into a USB port.
Sorry, most companies in the real world have rules against BYOD, otherwise you cannot enforce AV, encryption, remote device wipe, password policies, employee separation policies etc etc etc. If they don't they will after their first major breech. Something about not being allowed to process credit cards anymore or having to notify every customer you ever had that your "Smart User"'s Wii got hacked and had a copy of the customers database on it, that makes people with Cs in their title angry.
Also note how in these articles it seems to be the people who would be accountable are against BYOD... The author of both of these articles is no "smart user", the best I can say for him is he is a moron living in a dreamworld.

 

Worker status

[mjwalshe]

The other problem is it changes the nature of the employee relationship providing your own tools is an strong indicator that you are a contractor and not an employee - so there are lots of legal issues.
.
Oh and if you want me to provide the tools cool but you will be paying a 25% arrangement fee, the $500 month management fee and and hers the lease agreement you will sign (equal to the cost over 3 years) and the tax indemnity in case the tax people decide after the fact that I owe them tax :-)

my gear as not managed by the company ?

[Anonymous Coward]

you mean bring my gear that i've set up as war dialer nmap, OpenVAS etc etc etc , sure no problem , wont be for business use though

LMAO !!!!!!

Disagree

[Anonymous Coward]

IT professionals should read what kind of clueless propaganda memes that their executives are exposed to so that we can be prepared to crush these lies with reality. We've spend decades on user empowerment on both software and hardware and we need to be able to lay it out for the business decision makers as an inoculation against this kind of ignorance.

STUPID IDEA

[Khyber]

As has already been demonstrated at my porn shop job, this poses a HUGE security risk.

Just the simple act of plugging in your phone to charge can leave the hosting system compromised.

We found a virus in our systems a few days ago. Security log check - some LG device was plugged into our system.

We got lucky, I caught it before it could fuck our inventory database any worse than it already was when we finally discovered it.

Not seeing the savings there.

[khasim]

Someone else mentioned a typical DMZ, that's a good analogy. Just imagine a huge DMZ, a small secure area and a small fully external area. What you do today inside the DMZ is what you have to do over the bulk of your network.

Normally, the DMZ has additional attention (and software and hardware) dedicated to it because it is so vulnerable.

You might be one really smart guy ... but once you put a box in the DMZ you are defending against every other person in the world with an Internet connection.

And even with the extra attention and software and hardware sites are cracked every day.

So .... the new plan is to take that model and apply it to your internal network? Add the additional costs of more time / software / hardware AND the increased risk of some kid in Romania cracking your INTERNAL systems?

Sorry, but I'm not seeing the business advantage or the cost savings.

Re:Not seeing the savings there.

[jbolden]

You had asked for people who had done it. I don't see the cost savings either.

Your DMZ style servers are shattered. That's why they are imaged and easy to restore. Your servers aren't your security layer.
Where you want security you use much more secure OSes. For example a mainframe, i-Series. Solaris 10+ using Trusted Solaris. I did it with VMS but that was years ago. I've used hardened Linuxes, but it is still risky since x86 hardware doesn't handle security well. You wouldn't use Windows or a typical Linux for your secure boxes.

Webservers are hacked because they are running way too many services too casually. For example applications which tie into advertising are a notorious vector for attack. You just don't do that on boxes you care about.

And yes you have a lot of monitoring. And the real question is whether you want only perimeter defense. I can't see using this strategy for a company that doesn't already want multiple permitters. It would be too expensive. The kinds of companies this works for are ones that already have to have multiple levels where one more is no big deal. So for example they separate out DBA roles so a DBA can't just alter data by himself.

Re:Not seeing the savings there.

[Anonymous Coward]

For anything serious when it comes to security, I'd trust Solaris on SPARC or AIX/POWER. Both don't have the security issues that x86 hardware seems to. In fact, if someone plugs a USB flash drive in an AIX box, unless it is in an ISO format, the box will ignore it. Sounds dumb, but it completely cuts out the Stuxnet attack vector. One would actively have to log on as root and load/run the executable files.

Several AIX LPARs where I work actually do not even have a root user. UID 0 processes run as the same privilege level as everything else. Yes, it is a pain to upgrade (I just reinstall it which guarentees no cruft), but the items running on the box are relatively easy to tar off and back onto a rebuilt VM.

Perimeter defense is cute and all, but serious security requires defense in depth. It doesn't take much if an attacker gets enable access on some core routers to completely drop all perimeter/segment/VLAN defenses, so having hosts have built in packet filtering turned on is very important too.

Re:Not seeing the savings there.

[jbolden]

You got the spirit of how this works. I've never done non permitter on AIX, though I have used it as an end user, so I can't comment. But on Solaris, exactly. The big culprit though is x86 hardware.

Re:Not seeing the savings there.

[ckaminski]

That's because that's what 99.9% of people are running and as such is the exclusive focus of malware authors.

x86 is no more vulnerable than Power or SPARC. The OS's you choose to run are the culprit. You can run Solaris on x86 and get the same benefits.

Re:Not seeing the savings there.

[jbolden]

No actually the hardware makes a huge difference. On x86 all hardware runs unprotected. Which means that if you can successfully hack and piece of hardware on an x86 you own the system. That's not the case with more sophisticated hardware. Further other CPU and hardware designs are better about trapping buffer overflow type attacks.

Solaris on x86 does not give you the same protections.

FUD

[Anonymous Coward]

I work for a publicly held company that has some fairly strict information management rules, and must comply with SarBox, etc. I am not in the IT department.

And I have been surprised at how supportive and encouraging our IT has been for bring-your-own device. There are rules in place, but even with them, much of the burden of security is placed on (this will be horrifying to many Slashdot people) the *user*. The user is still obligated to try their best not to act like a stupidfuck. Which is always the case anyway. Even in the most tightly controlled environment you can leave a document (or a prototype) lying around, or forward email to the wrong person, etc.

The amount of fear, uncertainty and doubt on the part of the average IT admin that is on display on this topic is staggering. You get the feeling many IT people really think they're the last line of defense, and that information security is the be-all end-all. They seem to forget there are still millions of ways those idiot business users can make mistakes and royally screw things up in such a way that the lights go out on the whole operation - even if IT has everything locked down tightly.

It's 2011, people. I'm sure there are business people who still try and blame IT for their obvious failures and lack of responsibility/ownership. But they are fewer and fewer, and not credible.

Re:FUD

[SmurfButcher Bob]

You seem to have a very cavalier attitude toward costs that caused by, but not paid by you.

Re:FUD

[Anonymous Coward]

He also seems to be forgetting about the Compliance department. In credit unions, at least, they have more authority than IT to shutdown or prevent projects like this. For most companies, it is standard practice to give all employees Outlook Web Access, particularly since Microsoft enables it by default. The standard practice for credit unions is to disable OWA unless the user has been authorized to use a smart phone. For the most part, that means manager level or higher.

What?

[Taty'sEyes]

So let me get this straight, people in "financial services and health care" are being encouraged to bring their own devices to work? And this is so they can do their work more efficiently I suppose. Now the work they do, I'm guessing involves my private data if I am their customer. Is this safe to assume? And Angela got drunk and left her iPad at the bar...

Please stop posting troll stories

[Anonymous Coward]

This is getting rather ridiculous, /.

No thanks. Hands off my phone

[RubberDogBone]

Work recently decided the run with Gmail for Domains and migrated all the employees from using Outlook and a POP server to doing email on a version of Gmail.

Along with this change, they now allow employees to connect their personal smartphones to the Gmail for Domains product. Here's the problem: to do this, you have to give special admin permissions to the company IT team so they can admin things down to the device level.

Nobody can tell me what limits, if any, are on what they can do to my personal phone. Are they limited only to things related to my work email, or can they browse my device at will, look at my personal Gmail account which is also on my phone, grab my data, wipe the device and shrug at me?

As much as it would be convenient to have work email on my phone, I am not about to blindly hand over admin to them. If they want employees to consent to this, they need to spell out who is allowed to do what -and the answer had better be more than "we can do whatever we want and there are no consequences if we screw it up and brick the phone or wipe your unrelated personal Gmail account."

Re:fedex makes dirvers buy / rent there truck + ro

[RubberDogBone]

Fedex Express does not.

Fedex Ground drivers are technically private contractors who work as much as they want and rent the route.

What about subpoenas?

[Anonymous Coward]

What happens when the company is sued? Depending of the case, employees may have to surrender all the data on their device for discovery, since the device, while personally owned, is being used for work purposes too. This story talks about a recent case of DC government officials using their personal email from home for official business. How do you untangle the personal stuff from work stuff. I would think most lawyers are not going to care, and demand to see everything.

No

[Gonoff]

No Mr "DoYouKnowWhoIAm". We will not connect up your nice shiny new iPad to our network.

Why? We have a huge amount of personal information here and we have a boatload of regulations from our national organisation, consumer laws coming out of our ears and a small degree of common sense. All of these prevent us allowing someone - even you - to bring in their favourite device to put even the smallest quantity of it on.

But you really need to have it upon this fashion accessory? We can help you there. Please fill in this form and someone who is not one of us mean IT people will see whether the organisation agrees with you. If they do, they will spend our money on such a device. We will make it secure and you will then be able to increase your productivity as you describe.

But you want to use this one? We have another form here for this. Allow us to take control of your device. We will remove some applications such as Limewire and BitTorrent and put a few things on it to make it more secure. We will then Fix it so that it can't pass any of our records to people that the organisation does not want it to. We will also make it use that" RSA number thing" on your key ring. This will also prevent you from installing any more apps upon it but it will be nice and secure now."

Hello?

Hello? Are you still there?

Hello??????

Re:No

[Em Adespoton]

This is not just a fabricated story. This is my company's policy. It works well :)

ASTROTURF

[Anonymous Coward]

Galen Gruman with another article of dubious conclusion, no facts, no quotes and no sources.

Actually makes some sense

[TheCarp]

As someone in a rather regulated industry.... regulation, as much as it has a reputation for being stifling to innovation actually can help move it along.

See the thing is.... companies can't really stop BYOD. It is already in the culture. You really going to tell me I can't have a personal phone? You mean my personal phone that works everywhere, lets me get my personal email etc wont work here? Right, thats going to work out.

The thing is, other companies, unregulated ones, they can ignore it. They can enact useless rules that so "no" and then ignore their own rules. They can do that. We can't. We already have rules about how safe our data must be. We already have rules about device access etc. You would think we would fall back on them and just say "see we have rules" but the fact is, we need to have our rules work. We can't ignore them and hope for the best.

Its like hard drive encryption. Everyone knew it was a problem. There were major leaks due to lost laptops. However, a lost laptop is a lost laptop, its an accident...what you gonna do about it? Well... when the rules come down that we can't do that anymore and we will be liable....boy you should have seen how fast every single laptop got encrypted.

BYOD is just a matter of admitting reality and working with whats possible rather than working with whats "within your rights as an employer" but completely unreasonable and unrealistic. If you are an employer, your employees already have these devices, and already have their lives revolve around being within reach of them 24/7.

When will it end

[Anonymous Coward]

Another day on Slashdot, another link to a Galen Gruman article.

Dell Shitbox

[stewbacca]

I went from a Dell Shitbox environment to a Mac environment. A 500 employee company that seemingly prided itself on buying the cheapest, crappiest Dell products available to a 5,000 employee company where I have a MacBook Pro (2011), Mac Pro (older one, but still nice), 27" iMac (2010) and two cinema displays....and I'm just one developer...they understand that happy employees are productive, and more importantly productive employees are happy. \

Moral of the Story: It's hard to be happy with a Dell Shitbox.

Re: Preventing

[the_B0fh]

And for your initiative too, I'm sure.

Then tomorrow, get bitch slapped for not following procedures. But you're safe for now, since leadership saw it.

Common Theme

[snero3]

This appears to be written by the same guy that wrote this wonderful pile of BS.

That is two articles for the price of one right there, journalism at its best

phone companies

[p51d007]

I just wish the United States wireless companies would take that attitude. You provide the service, and if I want to bring MY phone (providing it is compatible with their network), I should be allowed to. Just look at the hoops some are having to do to convince at&t that the Samsung Galaxy Note is a PHONE as well as a tablet. Some are getting data turned off because the Death Star sees the Note as a tablet, not a phone.

PacketFence

[Anonymous Coward]

When it comes to BYOD, you certainly want to ease the process for those willing to "provide it" - for both wired and wireless networks. You also want to have some control over what's going on your network. For all of this, have a look at PacketFence - http://www.packetfence.org.

anyone see the irony?

[Anonymous Coward]

oh, hello NEWMAN...

Have these people never heard of Discovery?

[The Other White Meat]

Allowing or requiring employees to use their personal devices in direct connection with the workplace is a bad idea for both the company and the employee. The moment that company enters litigation, all of the computers used by that company's employees are open to search. Establish a pattern of personal device use in the workplace, and you've opened every employee's devices to discovery. If that employee gets involved in litigation or prosecution, and the company computers become vulnerable. You are far better off separating personal from business, and I personally would refuse to use any of my personal devices on behalf of the business.

Absolutely not.........

[Anonymous Coward]

Company either gives me some tether device (which I throw in the drawer at 6pm when I get home) or they can kiss my ass. No way are they getting my personal device on their network for anything short of doubling my salary. They're not getting my device, my personal info, my contacts my mail, notes, pictures NOTHING.

Wake up people. Just like the new gmail look -- say NO now or else.

Re:Absolutely not.........

[Anonymous Coward]

I agree 110%

How to Game Slashdot 2 Days in a Row

[Mr. Lwanga]

Biased article + InfoWorld + Galen Gruman = PROFIT

Gruman's articles are not well researched or balanced and look like marketing slicks.

You have to be kidding!

[Anonymous Coward]

Why? Because most of what the personal devices are being used for is personal business and nothing to do with what they are being paid for. I walk around our offices and find people hiding the devices to text, read emails and surf porn. Now this is very productive especially if they are working on a 35 work week. Then, they want IT to fix the device or call technical support because they dropped the device.

Give me a break!

Risk vs Return

[gelfling]

The return is obvious. They no longer have to buy or lease equipment or software. The risk is unmanaged anarchy and regulatory and audit fines for non compliance. Companies like IBM though, being IBM try to get it both ways - tell people they 'can' use their own stuff at least in so far as smart phones is concerned. And also micromanaged according to The One True Specification To Rule Them All. But lapstops, no longer. It's just too much work for them to manage laptops they don't own and build while STILL supporting help desk calls for them. My sources tell me though that as a kind of weak hedge they've decided to keep their own laptops in service longer - stretching them out years past the standard FASB depreciation as a cost cutting measure. Which is pretty funny when you show up at a customer with a 5 year old Thinkpad running XP and it takes 9 minutes to boot.

It is only reasonable

[lsatenstein]

Carpenters bring their own hammers to a worksite, Plumbers bring their toolbox, etc.
Tradespeople are now also programmers, system support staff, and I guess, even bosses.

Nothing wrong with bringing in your own smartgadget.