Slashdot Mirror


Most Companies Will Require You To Bring Your Own Mobile Device By 2017

Lucas123 writes "Half of all employers will require workers to supply their own mobile devices for work purposes by 2017, according to a new Gartner study. Enterprises that offer only corporately-owned smartphones or stipends to buy your own will soon become the exception to the rule in the next few years. As enterprise BYOD programs proliferate, 38% of companies expect to stop providing devices to workers by 2016 and let them use their own, according to a global survey of CIOs by Gartner. At the same time, security remains the top BYOD concern. 'What happens if you buy a device for an employee and they leave the job a month later? How are you going to settle up? Better to keep it simple. The employee owns the device, and the company helps to cover usage costs,' said David Willis, a distinguished analyst at Gartner."

34 of 381 comments (clear)

  1. So.... by Mitreya · · Score: 5, Interesting

    As enterprise BYOD programs proliferate, 38% of companies expect to stop providing devices to workers by 2016 and let them use their own

    Do they get to monitor communications or wipe my own device now if anything goes wrong?

    1. Re:So.... by admdrew · · Score: 5, Interesting

      Yeah, there's software out there to do exactly that, that a lot of employers (I'm in the network security field) already require to be installed if you want to connect to work resources.

    2. Re:So.... by afidel · · Score: 5, Interesting

      I see the future of BYOD being running another OS instance for the work apps, or possibly a separate easily switched profile with encrypted storage. One of the biggest hurdles right now with iOS and BYOD is that the end user can easily recover the wiped data from their last icloud backup. There are similar concerns with personal Dropbox accounts, how do you regain control of your corporate data once it's on an account that the user controls? There are solutions to the problem like windows rights management server (DRM for corporate documents) but they don't tend to play well with machines that aren't part of the central infrastructure, and are especially poor at support non-PC platforms.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    3. Re:So.... by ArhcAngel · · Score: 4, Informative

      I see the future of BYOD being running another OS instance for the work apps, or possibly a separate easily switched profile with encrypted storage.

      So...BlackBerry Balance then

      --
      "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    4. Re:So.... by afidel · · Score: 4, Interesting

      Yes, and VMWare ready for Android devices, and the user profiles from Android 4.2 refined, and the encrypted partition and app space from Good, and a whole host of other existing solutions, but if BYOD is going to become pervasive it's going to need to be built in at the system level and be easy to manage (I have to give RIM credit, balance does a pretty good job of meeting all these needs, it's just a second tier platform at this point).

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    5. Re:So.... by Jane+Q.+Public · · Score: 4, Insightful

      "I wouldn't worry about it. This will never happen at any company that has any concern about security."

      Besides that: if they want me to use my own hardware, they can damned well pay me for it.

      I'm not going to erase (or endanger!) my personal software and files for the purpose of someone else's company, and as far as I am concerned, equipment works the same as simply showing up. That is: if they want me to be there, they can pay me for the time I am there. If they want the use of my equipment, they can pay for the use of it. Or they can buy their own. They aren't going to get it both ways.

    6. Re:So.... by ryanov · · Score: 5, Insightful

      If it's my device that I paid for, I *don't* want to connect to work resources. Fuck that. My device, my number, none of your business.

    7. Re:So.... by SvnLyrBrto · · Score: 5, Insightful

      I'm as big a fan of the iPhone as anyone, but the tools you mention don't work for BYOD. They're great for company owned and managed devices. But it's not "Your Own Device" if you're letting someone else control it with those profiles or activesync connections. If I've paid for hardware with my own money, it's mine... period, full stop. No one else gets admin, root, remote-wipe, find my iPhone, or whatever privileges but me.

      I'd allow a company-controlled encrypted partition or something. But *I* retain control of *my* device as a whole. Apple's tools don't yet allow such a solution.

      --
      Imagine all the people...
    8. Re:So.... by Solandri · · Score: 5, Informative

      Samsung is already working on a solution to that. Basically, instead of your employer having full run of the phone, all the employer stuff is put into a sandboxed instance of the OS. Your personal phone runs into another sandboxed instance. Like having two virtual machines running simultaneously, you can flip between the two. Your employer has full control over one, and you have full control over the other.

      I'm a little skeptical of how well it'll work in practice (backups will probably be problematic). But if they can pull it off, it will eliminate the need to carry two phones just because your workplace wants full access and control.

    9. Re:So.... by oldlurker · · Score: 4, Insightful

      I expect to get the living hell modded out of me when I say the iPhone has been a secure platform for BYOD for awhile now (I don't remember if it's the 3GS or 4 where security was tightened up). Besides the Configurator, something as humble as ActiveSync can manage them. Same goes for many of the latest Android devices. The point is it's easy to natively get strong security on a mobile device. How good it meets your needs depends on your needs.

      If you let company admin access to lock and wipe your device, control what apps you install and use - like fx very insecure data-syncing services like icloud/dropbox, etc. then it is not really your personal BYOD device anymore, it is a company device. If you don't have this, the device is not company secure (it doesn't help enforcing local device encryption and password policies to prevent access to company data if you are leaking same company data to highly insecure consumer cloud services or in other ways setting up and using your phone in an insecure way).

      As several others have said on the thread already, the answer for BYOD security is that the phone needs to be running a controlled separate/virtual environment for the company that is completely walled off from the personal part of your phone.

    10. Re:So.... by mabhatter654 · · Score: 4, Insightful

      That's exactly the point, and that's how it's being sold. From my companies boss, he wants to give everybody a stipend for "a device" load up Citrix and said lockdown for company days, then let them do whatever they want.

      So basically his version of BYOD is letting you use "any"device but the company is still going to tell YOU what to do with it. Extend that to the cheap-ass employers that will just expect you to bring your OWN PAID FOR device in and bastard IT people that wipe YOUR data whenever the boss says.

      It's a whole "bag of hurt" for legal reasons as well. Jailbreaking, personal medical or legal data, not to mention music or media (and porn) all being carried around the workplace all day. It's an HR nightmare! I have just enough ODD to put clopping fan service as a screensaver just to piss one of those chea ass bosses off.

    11. Re:So.... by Rich0 · · Score: 4, Interesting

      I'm as big a fan of the iPhone as anyone, but the tools you mention don't work for BYOD.

      What you aren't getting is that "Bring Your Own Device" really just means "Pay For The Company's Device."

      The company treats it like they own it. They get admin access. They lock the user from setting preferences (like screen lock settings, etc). They wipe it if they decide they don't need you any longer. They specify what kind of device you can bring.

      Basically you're buying a device, then leasing it free of charge to the company for the duration of your employment. You get it back when you quit.

    12. Re:So.... by Dcnjoe60 · · Score: 3, Interesting

      I have a separate hard drive on my personal computer to boot from when I work from home, and I would love to be able to seamlessly use my phone to connect to work as well. Given the choice between my employer's giving me a non-android device (Given that my current phone is android based) and my bringing my own device, I would much rather bring my own device.

      Would you have that same feeling if your employer insisted on being able to monitor your calls, texts, data and other uses of your personal phone plus have the capabilities to wipe it? That is what the OP is saying his company does.

    13. Re:So.... by Dcnjoe60 · · Score: 5, Insightful

      Yeah, exactly. I'm on Android, and within the last year our standard connection to our work Exchange server required me to accept some basic management settings (remote wiping included) just to be able to pull my mail down, no extra software needed.

      You shouldn't have signed away your rights like that. Maybe you are comfortable giving your employer access to all the data on your phone, including photos, passwords and everything else. Most people probably would think the pictures you took in Vegas aren't any of your employer's business. Out of curiousity, if you change those basic management settings, does your email still work? If not, then something more than just settings was done to your phone, maybe software was installed remotely?

      Personally, if my employer feels I need access to email or to be reached 24/7, it is their responsibility to provide the means for that. They do not have the right to takeover my personal property or data just because I work there. Put differently, if there is a business reason for them needing me to receive emails/texts/calls outside of normal working hours, then they should provide a business solution. If I want to do it for my own convenience on my own device, well, then I would have to weigh the convenience against all the privacy issues involved.

    14. Re:So.... by Martin+Blank · · Score: 3, Interesting

      I'm right there with you. As one of the security people involved with implementing BYOD (though somewhat peripherally) at my last job, I opted to keep the Blackberry issued to me rather than attach my phone to the enterprise network even though I had admin access to the system. Many people thought I was nuts, but I draw a fairly clear line between work and personal life. Knowing what can be monitored, I opted to maintain that line.

      I think that might be one of the things people don't realize, even if they read what the company should be supplying. The mobile device security industry is changing rapidly with hooks going much deeper than they used to. One product that we looked at (but didn't implement) allowed not only monitoring of call logs but copied all text and MMS messages to or from the device up to the server for archiving, something I viewed as far too invasive for BYOD. Even if it was deleted immediately from the device, the software grabbed it and copied it up (or archived it for copying if data wasn't available). But with companies clambering over each other for features, I'm sure it wasn't long before others added it to their own lists.

      --
      You can never go home again... but I guess you can shop there.
  2. Just Say No to BYOD by MarioMax · · Score: 5, Insightful

    At my company there is a lot of internal chatter about BYOD, along with the security concerns (especially in terms of IP).

    My stance: Just say no to BYOD. If my company deems it necessary for me to use a portable electronic device to perform my job, then either:
    a) They supply it, and it remains company property, or
    b) There is no option b

    1. Re:Just Say No to BYOD by vux984 · · Score: 4, Insightful

      Option b) is that it's my device and all that entails, I control it, not them. No different than my car, if I leave the company it's still mine. If something belonging to them is in the trunk, they can politely ask that it be returned, but they don't get a set of keys, or have permission to enter it.

      If they don't like these terms, well... then its back to your option "a)"

      BYOD is no different than using a personal car, or a breifcase, and having company documents in either.

    2. Re:Just Say No to BYOD by PNutts · · Score: 4, Insightful

      BYOD is no different than using a personal car, or a breifcase, and having company documents in either.

      It's very different. There are regulations about how different classifications of data can be moved around and stored. You can have things on your phone that you can't have in a briefcase in your car. And there is more opportunity for a phone to be lost or stolen.

    3. Re:Just Say No to BYOD by spire3661 · · Score: 3, Insightful

      If regulatory issues are a concern, then it really shouldn't be BYOD.

      --
      Good-bye
  3. Concientious objector by Kell+Bengal · · Score: 3, Interesting

    I don't want a smart phone. I choose not to use one - I only care to have a simple phone that does the bare minimum. If they want me to have a smart phone, they'd better provide it for me because I will not spend my own money for a device I choose not to have. Under Australian law (to which I am subject) I don't believe a company can force you to provide your own equipment.

    --
    Scientists point out problems, engineers fix them
    altslashdot.org: The future of slashdot.
  4. Re:Don't bother getting ahold of me then by Cryacin · · Score: 5, Insightful

    Yeah, this happened to me once too. My boss was quite personally hurt when I handed in my letter of resignation AND rejected his counter offer to pay. My reasoning:
    1. Never accept counter offers - this means that your employer is not paying you what you're really worth, and means that you'll always have to threaten to leave to get paid a fair amount.
    2. Never accept counter offers - it's just a method for them to change the timing of when you leave to something more convenient to them.

    If more people had the guts to trust in their own abilities, we would all be better off.

    --
    Science advances one funeral at a time- Max Planck
  5. Re:An interesting problem occurs with unlocked pho by admdrew · · Score: 3, Informative

    All of the mentioned restrictions only work if the phone is locked.

    The mobile management software that's out there (and used by some companies that allow BYOD) works just fine on unlocked/rooted phones.

  6. Employment truth. by kurt555gs · · Score: 4, Funny

    I remember talking with a very successful businessman a long time ago. He asked me if I knew the diference between a job and a career? I said no. He said, it's simple, in a career you get screwed out of your overtime.

    --
    * Carthago Delenda Est *
  7. Re:Subsidised phone is huge bargain for companies by Anonymous+Psychopath · · Score: 5, Interesting

    A company paying $75 or so for monthly smartphone service pays for itself many times over in keeping employees tethered to the business and available for around-the-clock email and messaging. I expect companies will continue paying for service even for BYOD shops. If forcing employees to purchase a phone discourages them from using a phone for work then it will be a huge loss for companies.

    This is how it works where I am (Fortune 500 technology company). The company pays all the service, including my personal calls and data use, and I pay for the phone. They negotiate shorter contract terms and lower up-front device costs. I get my choice of carriers and devices. They also negotiate discounted service pricing for my family.

    The company does not wipe my entire device when I disconnect it from their system and remove their MDM, they just delete their content and leave everything else alone. They do enforce screen lock timeouts and require a PIN or password. They will wipe my device in its entirety if it's stolen.

    This is a sane BYOD policy that balances the desire of the employees to have a choice in their electronic tether with their needs to secure their IP.

    --

    Eagles may soar, but weasels don't get sucked into jet engines.

  8. Re:Do what they do to hourly workers. by mysidia · · Score: 4, Informative

    That is what's done to hourly (especially to min wage workers) workers all the time. They deduct for background checks, uniforms, etc ....

    Not generally lawful

    An employer can lawfully withhold amounts from an employee’s wages only: (1) when required or empowered to do so by state or federal law, or (2) when a deduction is expressly authorized in writing by the employee to cover insurance premiums, benefit plan contributions or other deductions not amounting to a rebate on the employee’s wages, or (3) when a deduction to cover health, welfare, or pension contributions is expressly authorized by a wage or collective bargaining agreement.
    Some common payroll deductions often made by employers that are unlawful include: ...
    Gratuities. An employer cannot collect, take, or receive any gratuity or part thereof given or left for an employee, or deduct any amount from wages due an employee on account of a gratuity given or left for an employee.
    Bond. If an employer requires a bond of an applicant or employee, the employer must pay the cost of the bond.
    Uniforms. If an employer requires that an employee wear a uniform, the employer must pay the cost of the uniform.
    Business Expenses. An employee is entitled to be reimbursed by his or her employer for all expenses or losses incurred in the direct consequence of the discharge of the employee’s work duties. ....

    ....
    ...
    Q. If I break or damage company property or lose company money while performing my job, can my employer deduct the cost/loss from my wages?
    A. No, your employer cannot legally make such a deduction from your wages if, by reason of mistake or accident a cash shortage, breakage, or loss of company property/equipment occurs.
    ..
    Labor Code Section 224 clearly prohibits any deduction from an employee’s wages which is not either authorized by the employee in writing or permitted by law, and any employer who resorts to self-help does so at its own risk

  9. If Your Employer Owns Your Cellphone, They Own You by Anonymous Coward · · Score: 3, Interesting

    Cellphones are one of the absolute most personal things ever created. Imagine if there's a legal dispute, and your company subpoena's your cellphone, or because you are using it for work, naturally asume they have the right to look at everything you've done. Oh, you're carefully protected friends list?, theirs. Your banking information?, theirs. Your pornography collection, (whether or not you've actually used it for such at work), theirs. Wife sends you a teasing pic during the day, which your forgot to delete, Manager looks at it, fired for sexual harassment.

    In an ideal world, they wouldn't have access to anything on your phone, but the way things are going, anything used for work is considered fair game.

    Also, yes, security, but that's nothing compared to the privacy implications.

  10. Usual nonsense by russotto · · Score: 4, Insightful

    1) Take a short and small trend.
    2) Do a linear extrapolation that shows a ridiculous result.
    3) ????
    4) Profit

    ObXKCD

  11. This BYOD stuff is just getting ridiculous. by Teddy+Beartuzzi · · Score: 5, Insightful

    Should I be buying my own desk? My own chair? Hell, my cubicle walls are clearly my responsibility too, right? If a company thinks an employee needs something for their job, then they should provide it.

  12. Buy my own devices? by the_Bionic_lemming · · Score: 3

    Um no.

    I'm the employee, you are the employer.

    I come in ready to work, you supply the tools for me to work.

    The tools are yours, you can monitor, adjust, replace, revoke, and have Orwellian standards on them. That's because you employed me and provided them.

    Past that? fuck off.

    --
    _ _ _ Go for the eyes Boo! GO FOR THE EYES!
  13. Re: Yeah, right. by bigstrat2003 · · Score: 3, Insightful

    Exactly. My company doesn't "technically" allow BYOD (though I imagine that enough pressure from users with the magic "Vice President" in their title will eventually change that), but even so I could totally use my phone. I have a work-provided device which uses ActiveSync, and nobody would ever really know I set my own phone up to receive company mail if I didn't tell them.

    But fuck that. Using a separate device for work means that when I'm not on call or otherwise required to be available, I leave it at home and nobody can even attempt to reach me. My direct boss has my personal number for emergencies that might come up, but nobody else. I would never consider giving up the work/life separation that using two different devices affords. I work 40 hours a week, not 168.

    --
    "16MB (fuck off, MiB fascists)" - The Mighty Buzzard
  14. Re:The old days... by LMariachi · · Score: 3, Funny

    I work for a foosball table manufacturer, you insensitive clod!

  15. security nightmare by dutchwhizzman · · Score: 3, Informative

    Gartner is so incredibly wrong here. You can't control a plethora of devices connecting to your office network. In reality, you'll have to assume that all devices that connect to you are inherently evil and users using them will be snooped on and their logon credentials will get sniffed. This means you first have to "weaponize" every application you run on your IT infrastructure and make it available as a web service. You'll have to issue two-factor authentication that uses a dynamic element such as a challenge/response hardware key generator. Only when you have everything like that in place, you can "safely" start using BYOD in a corporate environment. By then, there is no more need for people to actually be in the office to do their work, apart from meetings. For meetings, you can always call in or video conference from home. Effectively, the only way to pay for this is to quit renting office space and go completely virtual. Because you no longer rent office space, renting a separate server room will cost you dearly and you'll need your admins to have office space close to that room, so you're still running a brick company. Going to "the cloud" will be more or less mandatory for such a company, from an economic view point. I don't see a significant amount of companies do all this within the next four years. I do see a lot trying to save a few bucks on the abysmal hardware budgets they already have and fail horribly at productivity and security and reverse their decisions, spending much more in the process and not gaining anything.

    --
    I was promised a flying car. Where is my flying car?
  16. Re:The old days... by ryanov · · Score: 3, Informative

    Unionize.

  17. 20 Extra Hours Per Week by Scot+Seese · · Score: 4, Interesting

    Awesome, so as an employee *I* have to pay for my $700 smartphone -AND- the expectation will exist that I will be monitoring emails nights and weekends?

    What a bargain for your employer, by chipping in $50-100/mo to pay for a fraction of your service plan, they get up to 20 hours per week of additional work out of you, according to this study:
    http://www.techvibes.com/blog/byod-trend-is-making-employees-work-an-extra-20-hours-per-week-report-suggests-2012-08-22

    This, on top of inflation-adjusted real wages that have not increased since 1973:
    http://blogs.wsj.com/moneybeat/2013/04/16/the-best-indicator-of-u-s-health-is-wage-growth-or-lack-thereof/

    Slashdot headline next summer: "BYO Desk all the rage among newer workers"

    --
    THIS SPACE INTENTIONALLY LEFT BLANK.