Slashdot Mirror
Businesses Now Driving "Bring Your Own Device" Trend
snydeq writes "Companies are no longer waiting for users to bring in their own smartphones and tablets into business environments, they're encouraging it, InfoWorld reports. 'Two of the most highly regulated industries — financial services and health care (including life sciences) — are most likely to support BYOD. So are professional services and consulting, which are "well" regulated. ... The reason is devilishly simple, Herrema says: These businesses are very much based on using information, both as the service itself and to facilitate the delivery of their products and services. Mobile devices make it easier to work with information during more hours and at more locations. That means employees are more productive, which helps the company's bottom line.' Even those companies who haven't yet embraced bring your own device policies yet already have one in place, but don't know it, according to recent surveys."
Adds some information-security problems, but reduces a huge IT problem with procuring/managing/repairing the devices.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Unless the employer provides ongoing cash payments to compensate the employee for use of thier device, this is a way of offloading IT cost onto the shoulders of employees. Add to that the fact that here in Canada, an employee of a company is not allowed to treat the cost fo a computer as a business expense (for tax purpoes), and the reduction in salary experienced by the employee is even greater than the benefit received by the employer.
FTFY.
Really, why buy equipment for your employees when you can just make them buy it on their own?
Palm trees and 8
with users bringing their own devices and loading sensitive data on them , customer data is lost in so many directions, its hard to point out the who actually "lost" the data in the first place.
The article discusses health care as the main industry that's important to have 24hr information connection, and by utilizing mobile devices that information and connectivity can be available 24/7. This is then generalized, saying because it works there all companies should utilize this opportunity to get a high ROI on employee efficiency. While we've all seen these posts before, what other industries require 24 hr access from all employees? I know managers and the like in most all businesses often are required to be on-call, but this seems to be addressing the lesser employees, as in the manager contacts his/her subordinate, making the subordinate more or less be on-call. Does anyone have such circumstances (besides power plants/industry and manufacturing)? Is it often outlined in your contracts?
Slashdot just posted this other Galen Gruman story based on how to get your user devices into your business behind IT's backs: http://it.slashdot.org/story/11/12/18/2154224/how-to-thwart-the-high-priests-in-it
Now another story about user devices getting into business behind IT's backs, also by Galen Gruman.
Enough already!
I8-D
I scanned TFA, and it looks like I will disagree with 70-90% of the assertions therein. I can't call them 'facts', because they aren't.
No mention of the security issues surrounding BYOD. For industries that reject bringing your own notebook to work, the assertion that financial services firms are embracing BYOD borders on the ludicrous, with a healthy dose of fantasy. Here at least, in a Fortune 50 financial services company, BYOD isn't even up for discussion. The security issues for Personally Identifiable Information alone rule out permitting any significant use of data on a device that is unsecured. And YOD is presumed to be unsecured, since it cannot be confirmed or assured by the people in data security that are responsible for preventing data loss. That's not 'minimizing' the loss, but preventing it. Nice try, Infoworld, but you're not fooling me into thinking I can load up my Android or iOS phone with corporate data. Not here anyways.
They then launch into how 'app-savvy' hardware is so great. Help me here - is 'app-savvy' another way of saying 'high-performance'? I thought so. Feh.
Good Devices may supply mobile device management systems to their customers, but I can name you a 50,000 seat company that may or may not use it, but if they do it's for captive devices - Blackberrys - that are never going to be BYOD. Quoting such a study is regurgitating their self-serving (and I expect nothing less, they are out for a propfit after all) hype and fantasy that with their services, BYOD is perfectly secure. Again, where I work, promises are not enough. Security is based on assurance. Little of it is provided by third parties. I can't even share data with co-workers in many/most cases. The concept of letting employees run mission-critical (data is mission-critical to a financial services company) or senstitive data apps would not be laughable here. It would be dismissed out of hand.
More to the point, however, the idea that somehow the device changes the nature of your work is both spot on and wide of the mark. If you're primarily displaying data, a table is par excellence. as soon as you need to enter data, it's a losing proposition. Depending on your role, tablets and smartphones offer some advantages.
My brother has been delivering real-time production data to his workforce worldwide (wherever there is a signal, WiFi, CDMA, GSM, or satellite) since Palm first made a phone. He's added native support for every OS as of last year. He sees the craze, and his boss asks him sometimes about how this 'Android thing' would work for them. And he responds that it has been working 'for a while now'.
And no, they do not do BYOD. They supply whatever is required for whatever geographic region the rep is in. But they could suport BYOD, since he supports some customers directly with the same apps, where they are BYOD only because it isn't 'his' device. And he sees the security issues. SSL is so flawed he considers it useless, but there is nothing else right now except for VPN tunnels. That's where he's at, and some Java sandboxing that he thinks is ensuring data is gone when the session is gone. But he knows that rooting devices will some day thwart that.
And since I can root most Android devices without a lot of effort, that alone makes BYOD for work just impossible.
Lastly, I read up on the link from IW that Android is making inroads into business environments that the IT staff are unaware of. Well, actually, I can't use any of my personal mail at work any more unless it's on my Android phone. I don't consider that a BYOD instance, since if I connected to the corporate WiFi, I wouldn't be able to use personal email on it then either. I can. theoretically, dump data to the phone via USB or a uSD card, but that would be logged and scanned, and PII would be captured and alarms sounded. Yes, my work notebook can be prevented from downloading data to a removable device, any sort of device. It can also check if the device is encrypted, which they all must be.
Hype. Misstatement. Fantasy. But it may sell more stuff, and that would be the point of TFA.
deleting the extra space after periods so i can stay relevant, yeah.
First off, those articles are very badly written. And they seem to be linked to InfoWorld's recent run of articles about how IT is PREVENTING such "adoption". Strange.
Secondly, he's quoting a guy from a firm that sells products to manage phones. He is NOT quoting ANYONE from ANY company in the health care industry.
What?
It is DECEMBER 2011. That's some fast action by "most companies" in a few months.
There's a HUGE difference between allowing such devices on the UNSECURED WIRELESS NETWORK and connecting them to the servers that hold private data.
He doesn't seem to be covering that difference.
And he doesn't have any quotes from companies that are doing what he claims.
This is twice the submitter is from the site that has the story, worse its nearly identical if not the same one (ain't going to read this slashvertisement) where they were went off on IT departments enforcing standards.
* Winners compare their achievements to their goals, losers compare theirs to that of others.
At my workplace if you need a mobile device with email, IT will supply you with a blackberry. If you want something else, then they will pay you half of your subsidized device cost (i.e. if you need to pay $200 for a new phone, the company will pay you $100), and will pay the monthly fee they would have paid for the Blackberry (I think it's around $55, so it won't cover the entire plan, but should more than cover work usage). You own the phone and the plan, if you leave the company, you get to keep the phone, but you're still on the hook for the plan. LIkewise, if you drop it in a lake, you're on the hook to replace it.
IT will help you set up the phone for Wifi and Exchange email. Your phone has to allow remote wipe through Exchange to qualify.
It seems like a cheesy way to get employees to help shoulder some of the phone expenses, but also lets employees have pretty much any phone they want, so I see it as a net win for me. And most people don't *need* an Android/iPhone for work - a Blackberry could take care of all of their true work-related needs. Another nice advantage is that the company doesn't get my phone bills, so they can't see who I'm calling (like a job recruiter). And, I don't need to worry about losing purchased apps on a phone that's owned by my company if they take the phone back - it's my phone and my apps.
Not a perfect solution, I'd rather that they just gave me an Android for free, but with dozens of choices out there, the IT qualified device is probably not going to be the one I want anyway.
He's writing about how "most companies" are allowing users to bring in their own equipment ... while writing about how IT "priests" are preventing users from bringing in their own equipment.
But he isn't doing interviews with companies that are allowing users to connect to private. company data (the kind that would cause problems if leaked) via the users' own devices. Particularly companies covered by specific regulations such as health care.
Wouldn't at least one interview with the IT VP of a major hospital be appropriate by now? If nothing else, just to provide support for his claims.
Strange how that isn't happening.
My local HR was freaked out about my temporary lack of a landline
They need to reach you instantly, at any hour of the day? Then they need to buy you a cell phone. Maybe you spent the past few nights at your new girlfriend's house, or you had to accompany your spouse to a funeral, or you decided to spend a few hours walking along the beach to center yourself.
Ended up listing my cellphone as both home and cellphone
So you are basically paying by the minute when your employer calls you. Yes, I know modern cell phone plans sell you blocks of hundreds or thousands of minutes, but the point here is that you are paying to make yourself available to your employer when you are not even at your office/job site. It may be rude to say this, but this is not really a situation that you should be in.
Palm trees and 8
There is an interesting legal issue here.. IANAL though..
When the company owns the machine, there is a much clearer line as to who owns the applications and data on that machine. When an employee leaves the company, the company can "brick" the system with minimal problems. They own the hardware, they own the software licenses, and the company probably has a policy about no personal applications or data on the machine.
When the employee owns the machine, the rights of the company to erase data get really murky, fast. Does the employee have to agree to allow the company to inspect their (the employee's owned system) to remove company assets from the system? I don't see how that is going to work. My employer does not have the right to search my car after I quit, even though I called into conference calls in it, and used it for work related trips quite a bit.
I know of several companies that completely prohibit employee owned devices in the workplace for exactly the reasons I mentioned above.
This is not surprising as it allows people to communicate off the record by using their own account on their own devices and maintain records that would not be subject to any retention rules. That sounds like a great business case to me.
The other problem is it changes the nature of the employee relationship providing your own tools is an strong indicator that you are a contractor and not an employee - so there are lots of legal issues. :-)
.
Oh and if you want me to provide the tools cool but you will be paying a 25% arrangement fee, the $500 month management fee and and hers the lease agreement you will sign (equal to the cost over 3 years) and the tax indemnity in case the tax people decide after the fact that I owe them tax
They need to reach you instantly, at any hour of the day? Then they need to buy you a cell phone. Maybe you spent the past few nights at your new girlfriend's house, or you had to accompany your spouse to a funeral
I suppose if I told my wife I was at the girlfriend's house, and I told the girlfriend I with with the wife at a funeral, I might finally have the spare time to get some stuff done in the lab without interruption... I think you're on to something here...
So you are basically paying by the minute when your employer calls you. Yes, I know modern cell phone plans sell you blocks of hundreds or thousands of minutes, but the point here is that you are paying to make yourself available to your employer when you are not even at your office/job site. It may be rude to say this, but this is not really a situation that you should be in.
Ah its not so bad because I am in a rather weird/unique situation of not being salaried as my current employer categorically will not go salaried for non-management employees, and being a tightward cheapskate I have the worlds most expensive pay per minute cellphone service, which even at its inflated rate is something like one nineth my hourly hourly rate at time and a half overtime... Work is paying me nine times what I'm paying the phone company for the privilege of talking to me, so I'm all good with that profit rate. When the phone rings with a call from work, I almost feel my wallet getting heavier as I talk... makes me want to speak slower, sometimes. I can see why a salaried guy would be pissed off, but theoretically they are paid more to make up for calls like that, theoretically at least.
Sometimes, at home, without being paid for it, I even read computer books. Weirdly enough, I like Knuth. I know, I'm a sick, sick man, etc etc.
I am very happy not to have to carry two cellphones, and sometimes being always available is an inherent part of the job... which is probably partially why my pay rate is so high to begin with.
Its like arguing that the company should pay for the detergent used to wash my work clothes an extra time if I come in to work on a Saturday, after they cut me a check for overtime around the size of a decent car payment... geeze don't look a gift horse in the mouth, take the money and run.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
You had asked for people who had done it. I don't see the cost savings either.
Your DMZ style servers are shattered. That's why they are imaged and easy to restore. Your servers aren't your security layer.
Where you want security you use much more secure OSes. For example a mainframe, i-Series. Solaris 10+ using Trusted Solaris. I did it with VMS but that was years ago. I've used hardened Linuxes, but it is still risky since x86 hardware doesn't handle security well. You wouldn't use Windows or a typical Linux for your secure boxes.
Webservers are hacked because they are running way too many services too casually. For example applications which tie into advertising are a notorious vector for attack. You just don't do that on boxes you care about.
And yes you have a lot of monitoring. And the real question is whether you want only perimeter defense. I can't see using this strategy for a company that doesn't already want multiple permitters. It would be too expensive. The kinds of companies this works for are ones that already have to have multiple levels where one more is no big deal. So for example they separate out DBA roles so a DBA can't just alter data by himself.
You got the spirit of how this works. I've never done non permitter on AIX, though I have used it as an end user, so I can't comment. But on Solaris, exactly. The big culprit though is x86 hardware.
Allowing or requiring employees to use their personal devices in direct connection with the workplace is a bad idea for both the company and the employee. The moment that company enters litigation, all of the computers used by that company's employees are open to search. Establish a pattern of personal device use in the workplace, and you've opened every employee's devices to discovery. If that employee gets involved in litigation or prosecution, and the company computers become vulnerable. You are far better off separating personal from business, and I personally would refuse to use any of my personal devices on behalf of the business.
--- Generation X: The first generation to have SIG lines inferior to their parents... ---