Why Everyone Gets It Wrong About BYOD

snydeq writes "Brian Katz offers a simple take on the buzz around BYOD in business organizations these days: 'BYOD is only an issue because people refuse to realize that it's just about ownership — nothing more and nothing less.' A 'hidden issue' hiding in plain view, BYOD's ownership issue boils down to money and control. 'BYOD is pretty clear: It's bringing your own device. It isn't the company's device or your best friend's device. It's your device, and you own it. Because you own the device, you have certain rights to what is on the device and what you can do with the device. This is the crux of every issue that comes with BYOD programs.'"

Comments

BYOD means I/T loses some control over it

[Jailbrekr]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it. And if you do not trust your own network, you need to increase your security costs substantially and provide other resources that you would otherwise not need to offer. So while you're saving around $1000 per year per user on hardware, you're spending more on licensing for NAC and VDI/RDP/ICA. You also need to amp up the local tier1/2 support because now without standards they're going to be spending more time dealing with more types of machines. Any gains made by standardization will be utterly destroyed.

BYOD is a short sighted, stupid idea thought up by someone who sure as hell has no experience with I/T support.

Re:BYOD means I/T loses some control over it

[guruevi]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want? BYOD is not just about cell phones or property. It's about people taking work laptops home and home phones to work.

If you want to make sure everything is and remains standardized, you're going to need to implement NAC and have everything on your network be a dumb terminal.

BYOD is not just about someone saving money. It's about people expecting to have their devices work and IT in organizations being too slow or not having enough funding to give everybody their device of choice.

Re:BYOD means I/T loses some control over it

[Frobnicator]

From the IT side, it means a nasty festering pile of vulnerabilities. It means more vectors for the Chinese hackers, more attack vectors for competitors, more attack vectors for malware, more vectors for government and corporate spying, and more ways for information to accidentally leak.

From the personal side, it means being on the clock continuously without additional pay. It means additional personal liability. It means if something goes wrong at work the powers that be can brick your phone. It means that your boss or peers are always watching, sometimes expecting you to reply to emails at all hours or work on reports over the weekend.

From the bottom line perspective you may get a little more hours out of the worker, but at the cost of reduced total productivity from them never disengaging and the costs of supporting an alphabet soup of devices.

Nobody wins.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Not sure about you, but no one plugs in whatever they want to our network, all network ports are authenticated at the switch, you plug in a non authorized device the port simply shuts off. BYOD is a fucked up concept by people that simply have a poor understanding of IT that think what they do at home is "better" as the guys running the network can't possibly know more than them. I have seen BYOD in 3 places now and in all it has been 3 complete failures where it was rolled back due to the insane increases in support costs.

Re:BYOD means I/T loses some control over it

[FireFury03]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want?

Yep, I've had customers insist they don't need to worry about antivirus, etc. on their workstations because they have a company policy that no one plugs unauthorised kit into the network. A few weeks later they invariably get an infection because one of the directors ignored policy and plugged his personal laptop in - afterall, who's going to tell the director off?

BYOD is not just about someone saving money. It's about people expecting to have their devices work and IT in organizations being too slow or not having enough funding to give everybody their device of choice.

I've found BYOD is actually a big PITA for large organisations because the devices people are bringing are almost universally Android or iOS, and in both cases the OS and apps have terrible support for HTTP proxies; and many large organisations use proxies to control web access from within their networks.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

You should never trust your own network. If you think your network is more trustworthy than the next guy's just because you _think_ you dictate the hardware and software allowed on it, then you've got another thing coming....

You're like someone who puts up a 4-foot fence around his yard and thinks he's never going to get burglarized, or get burglarized less. All it will do is keep the kids out; the bad guys couldn't care less.

Re:BYOD means I/T loses some control over it

[Frobnicator]

BYOD is not just about cell phones or property. It's about people taking work laptops home and home phones to work.

We were recently stung by this little feature.

License true-ups and program audits are fun.

People install the products on their laptops with the corporate keys, and pass it around to their co-workers saying the installs are business related. For us, a two-week network scan found nearly two million dollars in improperly-licensed and unexpectedly-installed software on all those BYOD laptops.

A whole lot of people got one-on-one meetings with management, a few lost their jobs.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Then it sounds like you and the rest of the IT staff were incompetent. I work at a company right now that's been using a BYOD approach for nearly 5 years with no real issues. And with only 4 IT staff to support around 400 people.

Re:BYOD means I/T loses some control over it

[guruevi]

So you have implemented NAC, you therefore have already sunk an insane amount of money and resources into getting this to work. And now you're protected until a home device with malware has authenticated itself...

Re:BYOD means I/T loses some control over it

[guruevi]

Both devices have plenty of support for HTTP proxies. Even then, Squid has a transparent proxy option. Or you could filter at the DNS level... options, options.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

How do you make sure no-one plugs in whatever they want?

If you have to ask that question, i hope you don't manage any network in any company i have to work with. Its also not about 'funding' or 'slow', most companies prefer standards. Breaking standards is bad.

Re:BYOD means I/T loses some control over it

[guruevi]

Maybe you should improve your licensing options or choose better products with less licensing. Throwing out high quality people because a 3rd party company bullies you is not really great business practice.

Re:BYOD means I/T loses some control over it

[zidium]

Would these piracy scans be successful if the user was not logged into the domain via, say, their own personal laptop?

Or, more to the point, what is the best way for a user not to show up in these scans? Would a firewall help? What would I block?

Re:BYOD means I/T loses some control over it

[mysidia]

afterall, who's going to tell the director off?

I would... in private of course. The director must be coached, and warned, in a firm and positive way order to give them an opportunity to avoid misbehaving in the future.

This is why it's important to have security policies and IT governance rules and the consequences in writing, and signed off on by multiple members of upper management, and the board.

If you commit a violation, the disciplinary action procedure has to be initiated, no matter who you are in the organization -- even the CEO is not above scrutiny from the security department; just in the same way even the CEO is not exempt from fraud or financial embezzlement rules, as the violation of any of the important security rules is of similar severity, because it may have enabled the commission of fraud or other crimes against the shareholders.

If everyone is not held to the same standard, then not everyone has to obey the policy, and it won't work.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Funny, then the issues we had with Chrome and Firefox on Macs, and the time we spent trying to resolve them shouldn't have happened?. Fuck off idiot

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it. And if you do not trust your own network, you need to increase your security costs substantially and provide other resources that you would otherwise not need to offer. So while you're saving around $1000 per year per user on hardware, you're spending more on licensing for NAC and VDI/RDP/ICA.

That's the point though. BYOD isn't about enabling jack shit. It's about shifting the cost to your employee. If it breaks the employee pays. If the employee doesn't like it they had other options so it's their fault. Well here's the thing the employer wants to do that THEN lock down the device so that the end user can't use their own hardware. It's just petty and cheap. Petty and cheap is not going to facilitate security.

Re:BYOD means I/T loses some control over it

[swalve]

That seems like a lot of hassle for not a lot of payoff. Every time something breaks or gets moved, they have to call IT to reenable the port? Just so you can imagine that you have security? I guess nobody ever heard of MAC address spoofing.

Re:BYOD means I/T loses some control over it

[FireFury03]

Both devices have plenty of support for HTTP proxies.

Android Gingerbread lets you set a single HTTP proxy which applies to all networks. That means device owners have to manually enter and clear the proxy settings as they move between the office network and their home network. Not that it matters - almost all apps ignore the proxy settings anyway.

Android ICS and Jellybean let you set an HTTP proxy per wifi network, which at least means the user isn't expected to reconfigure the phone all the time. Most apps still ignore the proxy settings. Most of the apps that do pay attention to the proxy settings don't support authenticated proxy servers.

All recent versions of iOS allow the proxy and authentication credentials to be set on a per wifi network basis. That's excellent. Except that most apps (including a good chunk of the stock iOS apps that Apple ship with the phone) either ignore the proxy settings entirely or fail to support authenticated proxy servers. (Yes, Apple is aware of these problems - there are bug reports in their bug tracking system that have been open for several years, they aren't interested in fixing them).

Even then, Squid has a transparent proxy option.

Transparent proxying only works for HTTP, not HTTPS unless you are going to MITM all the sessions (which involves installing certificates on all the clients). And even then, you can't authenticate the users if you're proxying transparently.

Re:BYOD means I/T loses some control over it

[girlinatrainingbra]

Re:Throwing out high quality people because a 3rd party company bullies you is not really great business practice.

Excellent point. Licensing is key. Go FOSS.

Re:BYOD means I/T loses some control over it

[chihowa]

Ah, but from upper management's side, it means costs are shifted from purchasing physical hardware (who's cost is hitting a floor) to employee hours (which can keep going down). It means next quarter's expenses will be lower (the difference of which they can collect as bonuses now) and when the following quarter's expenses are back up (from IT having to maintain the mess), the bonus has already been collected. Then they can start looking to cut costs again by shipping the (now fungible) labor overseas, and collect another bonus. When the whole house of cards collapses, they've already cashed out.

Somebody wins (just not you).

Re:BYOD means I/T loses some control over it

[maccodemonkey]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it. And if you do not trust your own network, you need to increase your security costs substantially and provide other resources that you would otherwise not need to offer.

Right. Because corporate owned devices could never ever ever become quietly compromised. Sounds safe to me.

Re:BYOD means I/T loses some control over it

[mjwx]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want?

Managed switches.

No unauthorised devices get plugged in. Every device has to authenticate with the switch (so not simply MAC address blocking).

From the fine summary:

Because you own the device, you have certain rights to what is on the device and what you can do with the device.

Yeah right, feck off.

When you BYOD onto my network, we control it, we can wipe it, we can install and uninstall apps and if you dont agree to our terms, dont bother complaining that you cant BYOD. BYOD is not open slather, if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

Re:BYOD means I/T loses some control over it

[TENTH SHOW JAM]

Usability is the antithesis of security. With that in mind. BYOD can work for Some apps. Anything that stores sensitive data locally, no. Anything that requires much more stuffing around that opening up a web port, then no.

If PHB needs more than that to get $HisFaveApp working on his Pear uPad then he may find out there are some days when he must use the tools provided by the workplace. Diddums.

Having said this, the 80 20 rule will apply.

Re:BYOD means I/T loses some control over it

[Skuld-Chan]

1990 called - they want your manually set proxy server back.

We proxy everything, but the users are none the wiser and its a university where BYOD isn't even something we can control.

Re:BYOD means I/T loses some control over it

[mjwx]

People install the products on their laptops with the corporate keys,

Why were you giving end users corporate license keys?

Re:BYOD means I/T loses some control over it

[bdwebb]

Your company has no secure resources that you or your superiors are worried about then and you are not a candidate for NAC as the parent poster was. That or your company's IT staff, including you, is actually the incompetent group and if you ever get compromised by an outsider with malicious intent, you're fucked.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Sorry, but this part isn't negotiable

Maybe not - but I'm sure your employment is. The first time you tell the CEO to "feck off" I suspect it will be negotiated to no longer exist.

Re: BYOD means I/T loses some control over it

[Anonymous Coward]

You have 1 IT staff member to every 100 people? That is a high ratio. In my environment we have ~1650 users with only 3 people in the IT department and that includes the IT director. We also don't outsource really anything (cable runs is the only real thing I can think of), manage the network/servers and do development. There is no way we could do that if it was a BYOD environment. Our support model would be blown away. We are able to do what we do because we have a highly automated patch management and client management system, this would not be possible if we did not "own" the client systems.

Re:BYOD means I/T loses some control over it

[mjwx]

Sorry, but this part isn't negotiable

Maybe not - but I'm sure your employment is. The first time you tell the CEO to "feck off" I suspect it will be negotiated to no longer exist.

LoL,

You do realise this policy comes from the CEO.

Besides that, one data leak and it's the CEO's who's job will no longer exist. They get real paranoid when you make it clear their job is at risk. Besides this, if management wont take security seriously, I'll have another job by next week anyway.

Re:BYOD means I/T loses some control over it

[bdwebb]

There is a definite cost to implementing NAC but I'm confused as to how you believe a home device with malware is going to authenticate itself. There are many complex malware programs out there that can attempt a variety of attack vectors but none complex enough to bypass a NAC solution worth its' salt with anything but the baddest 0-day exploits.

There was a BlackHat presentation made in relation to NAC that presents some of these potential attack vectors (http://www.blackhat.com/presentations/bh-dc-07/Arkin/Presentation/bh-dc-07-Arkin-ppt-up.pdf), however in a fully secured, fully featured NAC deployment, the likelihood is almost zero. Like you said, the cost of the solution and the time and resources devoted to implementation are all high so it really needs to be an industry requirement or something of the like but a well implemented NAC solution in tandem with well developed security policies provides an extremely high level of security. IAANSE (Network Security Engineer)

Re:BYOD means I/T loses some control over it

[bdwebb]

MAC address spoofing doesn't help vs a well implemented NAC solution as the MAC address of the connecting device is not the only authentication factor. Many NAC solutions even require agents to be installed on the connected machine so that an analysis of installed software and hardware can be performed as an additional authenticator and many will pre-scan connecting devices for offending/unsecure software and quarantine them in a segregated network with no routing abilities.

Once implemented, a NAC isn't an incredible hassle to manage and 802.1X even allows for a port to be re-enabled once the offending device is disconnected from the port so you don't have to manually reenable the port every time someone plugs in an unauthorized resource. It is extremely costly, however, and the effort integrate it properly so that it can't be bypassed by simple means is huge so a NAC is not a great solution unless your industry or company requires it.

Re:BYOD means I/T loses some control over it

[ultranova]

I've found BYOD is actually a big PITA for large organisations because the devices people are bringing are almost universally Android or iOS, and in both cases the OS and apps have terrible support for HTTP proxies; and many large organisations use proxies to control web access from within their networks.

So maybe you shouldn't try to control web access from your network if you allow it at all, but rather deal with people browsing Slashdot or porn sites all day long when and if it becomes a problem?

Re: BYOD means I/T loses some control over it

[Anonymous Coward]

So what is the trade off here?

Option a) Heavy handed IT standardization and lockdown:

Reducing the need for IT staff by a few people and slowing the ability of hundreds or thousands of staff members in getting their actual work done. Slowing happens in many ways, inability to use a device optimal for your work, inability to use software you need for work, generally shitty corporate standard hardware.

or

Option b) BYOD

Slightly more IT people needed. Hundreds / thousands of staff has device and software they need/want making them as productive as they can be.

Seems to me its worth having a couple more IT nerds around if 1600 staff members are even slightly more efficient.

Re:BYOD means I/T loses some control over it

[khasim]

Besides that, one data leak and it's the CEO's who's job will no longer exist.

Maybe. Maybe not. It depends upon how well he (or she) can spin it.

And the easiest way to spin it is to blame you.

So if you're having trouble getting the CEO to support the "NO BYOD HERE" policy then start hunting for a job with a more informed CEO. Leave that job and that CEO to one of the BYOD advocates. Let them deal with whatever loss happens.

... I'll have another job by next week anyway.

Maybe. It depends upon how high profile the loss is. It's easier to get a different job BEFORE the story about how the company lost $500,000 because someone in Accounting brought in an infected laptop and the CxO's and BoD are all claiming that it was your fault. Be proactive.

Re:BYOD means I/T loses some control over it

[Lumpy]

Then tell management to stop being cheapskate morons and BUY the employees tablets and phones.

Honestly the one thing that screams that the management is a bunch of Douschebags is a BYOD policy. If a company is work working for they buy you a tablet and phone if you need it as well as a laptop if you need it. The only places I have ever seen a BYOD requirement has been either fly-by-night or swirling the drain. If a company can afford to pay you 6 figures they can spend $1600 on a laptop every 2 years and $50 a month to get you a smartphone.

Re:BYOD means I/T loses some control over it

[a_n_d_e_r_s]

So they could install the programs on their corporate computers.

Re:BYOD means I/T loses some control over it

[Lumpy]

Sounds like a plan. got a FOSS version of AVID? same quality and same abilities?

No? how about a FOSS version of AutoCad? no the two toys running around out there wont work.

Well then how about a FOSS version of my automotive computer tuning software? IT supports all the modern cars, so what FOSS program is out there that does that?

Lastly how about a nice FOSS large accounting software system? no?

There are three business types that can not use FOSS even if they wanted to, and that covers a hundred thousand of businesses in the USA alone. (car repair, car shops, engineering firms, accounting firms, TV stations and studios, etc...

FOSS is an impossible answer for a large number of businesses simply because the software does not exist.

Re:BYOD means I/T loses some control over it

[Lumpy]

I watched an IT guy try to tell a CEO that his apple TV was not allowed on the network. the CEO pointed at the door and asked the guy, "what does it say on the door?"

The IT guy was one of the brighter ones and got the hint quickly... and set it up on the corporate network.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

BYOD is not just about someone saving money. It's about people expecting to have their devices work and IT in organizations being too slow or not having enough funding to give everybody their device of choice.

Exactly. It's all too common for IT departments to be a bureaucratic obstacle rather than the people you go to when you need to get something done. The situation strikes me as slightly analogous to teachers unions being against school vouchers because they know the competition will kill them.

Re:BYOD means I/T loses some control over it

[vux984]

you're spending more on licensing for NAC and VDI/RDP/ICA.

Unless you aren't.

Many companies have an outbound sales force. The use a VPN + virtual infrastructure for laptops to access email email, access to the CRM, point of sale/sales quote system, and intranet resources. BYOD vs company hardware is a wash for licensing here.

You also need to amp up the local tier1/2 support because now without standards they're going to be spending more time dealing with more types of machines. Any gains made by standardization will be utterly destroyed.

Definitely true to a point.

In practice, for a lot of companies, they do end up ahead. Employees tend to treat the units better. There's no hassle with recovery after an employee leaves. They frequently tend to buy better hardware for themselves than corporate budgets would spring for. Insurance, droppage, spillage, etc is eliminated.

Ditto for smart phones -- if you don't have or need particularly stringent policies in place for email; and you already are just using some generic hosted exchange, or gmail hosting, or zimbra hosting or whatever then byod gets a lot cheaper fast.

You save on hardware, you save on support. Its your device, if the speaker stops working, or its dropping too many calls, go get yourself a new one. You don't have to manage their airtime packages and data usage. Or bill them, or monitor them. Typically you just give them a $X phone service allowance, and your done.

Not every business is paranoid about 'customer health and financial information leaking'. The sales guys knocking on doors trying to get you have their company fix your companies elevator, wash your companies buildings windows, do your companies landscaping, do the HVAC, do building envelope testing for water penetration, supply you with printer toner...

You don't always have to micromanage their devices. Sometimes you do, and then BYOD makes no sense, for all the reasons you state... but sometimes you just don't.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

Your company has no secure resources that you or your superiors are worried about then and you are not a candidate for NAC as the parent poster was. That or your company's IT staff, including you, is actually the incompetent group and if you ever get compromised by an outsider with malicious intent, you're fucked.

We have about 25,000 BYOD users and ferociously protect our IP. I wish you luck in your crusade against the customers you serve. It seems to be working out for the RIAA/MPAA.

Re:BYOD means I/T loses some control over it

[girlinatrainingbra]

Well, hey, if you can't get FOSS for what you want, at least have the ethics to realize that you have to pay fo rthe software you use. Don't use unlicensed software. FOSS software is licensed too, even if it is or is not free of cost. Freedom in FOSS is the freedom to share and the lack of a bullshit-filled license. Or at least don't keep hiring idiots who think that it's okay to steal. It's not okay to steal in either case, and your employees ought to be aware of that: a - proprietary software copied without paying for the copy or the extra license b - FOSS software that you intend to use without honoring the license If your employees can't stop stealing, perhaps they deserve being fired.

Re:BYOD means I/T loses some control over it

[octothorpe99]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want?

Managed switches.

No unauthorised devices get plugged in. Every device has to authenticate with the switch (so not simply MAC address blocking).

From the fine summary:

Because you own the device, you have certain rights to what is on the device and what you can do with the device.

Yeah right, feck off.

When you BYOD onto my network, we control it, we can wipe it, we can install and uninstall apps and if you dont agree to our terms, dont bother complaining that you cant BYOD. BYOD is not open slather, if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

Well, if it was my choice to B[M]YOD, I'd let IT get admin privileges on my devices. But if its at the company's insistence, then hell no!
Here's the deal:
- I can do off-hours work if I get email on my phone.
- I won't carry a second phone for work
- I am willing to add my work email on my phone PROVIDED:
    -- I am not required to register my device for monitoring
    -- I and ONLY I have admin rights on my phone
    -- No remote monitoring of my phone allowed

I will, however, agree to follow policy like setting a passcode, time-out locking, enable find-my-phone and remote wipe (which I will control).

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

802.1x - stops people plugging their own shit into the network. No certificate, no connection.

Re: BYOD means I/T loses some control over it

[Anonymous Coward]

What you do is start up a workgroup to evaluate the risks associated. Then present findings to upper management. They then make a risk acceptance decision in writing. You will find people are that much more cautious when they are explicitly tied to risk decisions in writing.

Re:BYOD means I/T loses some control over it

[war4peace]

...Which is the wrong way to do it.

Re:BYOD means I/T loses some control over it

[Benaiah]

Having worked on both sides of this fence I can say that IT are often lured into the belief that they are the core of an organisation and that they are constantly making things better for everyone by making things more uniform. Such as giving everyone the same desktop icons and refusing access to the desktop to allow users to add their own icons. They are hidden away from the rest of the workforce in artificially lit computer graveyards. The users in such a network ie, the accountants/journalists/engineers who are actually making the company money get more and more disillusioned with this system that gets less and less functional, ie submit a form signed in triplicate with a cost code attached in order to get Chrome installed. They bring their own 4G devices in and use them to do their work, or bring in windows hacking tools to give themselves local admin rights and all hell breaks loose.

Thus where I have seen IT actually play their support role is where they don't get put in the dungeon in the basement of the building but integrated into the workforce and forced to do their work in plain sight. Other staff members can see the work that they do and come and ask questions, and they can see the impact that their work has on their users. Their team meetings are infiltrated with key staff members who get to vet the plans moving forward, and key to all this, is an articulate manager who actually understands what his subordinates are doing and not just playing with dollars and cents.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

IT in a company is an expense. IT is there to support the money making side of the business. If the business leaders want no passwords and no firewall than advice of the disadvantages of doing that and provide some reasonable alternatives in a professional manner. In the end if they want it anyway and you implement it, you have done what you were paid to do which is advice truthfully and implement. IT people (specially below manager/director level) are... IT people, not business managers and decision makers for how the company should be run. That sucks but it is the truth. My examples above are extremes but it applies to everything IT related not just firewalls and BYOD. It is backups and SLA for recovery, DR, levels of redundancy, the "right" web server platform, blade systems or rack mount servers, physical or virtual servers, FC/iSCSI SAN, local storage or cloud storage etc..
Where this system breaks down is scapegoating and shifting decisions and responsibility for those decisions after the fact when the shit hits the fan but that is a political issue within the company, not one that any amount of technical ability can defend or overcome.
 

Re:BYOD means I/T loses some control over it

[guruevi]

I meant the "security" a NAC gives is defeated as soon as a device authenticates itself. Whether it's your company's laptop or a home device, as soon as the user authenticates the device it has free reign over the network and any malware on the computer gains access as well while you think the network is "secure". Typical malware is installed on devices that are still used by actual users.

Re:BYOD means I/T loses some control over it

[guruevi]

NAC isn't actually all that costly. There are free (as in beer and as in speech) solutions that top the expensive, vendor-centric NAC solutions.

The problem is that NAC is not a security tool, it's a network access control tool. It gives you some control as to what devices can connect to which portions of the network and typically you bump other devices to a VLAN that goes directly to the Internet (like a guest network on WiFi).

Once a device is authenticated (either by a malicious user or more likely, shared credentials or a piece of malware an authentic user unknowingly has installed), your network is still just as vulnerable.

Re:BYOD means I/T loses some control over it

[swalve]

Proper security shouldn't depend on the client browser. If you want HTTP traffic to go through a proxy, force it to at the bottleneck (ISP connection) not at the individual clients.

Re:BYOD means I/T loses some control over it

[dbIII]

I disagree with the first point - only because accepting BYOD means you have to give up on that and have ways available for people to plug their stuff in or connect wirelessly without contacting IT or their own management, using nothing more than a password circulated by word of mouth. Once a BYOD policy is there you the good idea expressed above (you plug in a non authorized device the port simply shuts off) is just abandoned.

It means you have to have staff available and plans in place to deal with virus outbreaks from infected devices that WILL turn up eventually. It means you need staff to keep the balance between a firewall that allows out what is required (which is a moving target, since a lot of applications want to phone home on obscure ports) but locks everything else down hard (not just email) to avoid your address going on a blocklist. It means hunting down and blocking devices that are consuming all bandwidth with bittorrent. It means draconian monitoring of personal communications right down to the packet level just to spot the things causing problems but causing all kings of privacy issues along the way. It means needing extra staff to cover support of a much wider range of devices - a policy to avoid this doesn't work because you do end up having to support Macs or whatever "just this one time" or waste a lot of time trying to talk irate users down when support is refused.

Re:BYOD means I/T loses some control over it

[swalve]

Don't connect equipment with pirated software onto your company's network. Done.

Re:BYOD means I/T loses some control over it

[mjwx]

I watched an IT guy try to tell a CEO that his apple TV was not allowed on the network. the CEO pointed at the door and asked the guy, "what does it say on the door?"

The IT guy was one of the brighter ones and got the hint quickly... and set it up on the corporate network.

These CEO's often wonder why they end up with crappy IT departments.

Yes men tend to make very poor security decisions.

Re:BYOD means I/T loses some control over it

[mjwx]

Maybe. It depends upon how high profile the loss is. It's easier to get a different job BEFORE the story about how the company lost $500,000 because someone in Accounting brought in an infected laptop and the CxO's and BoD are all claiming that it was your fault. Be proactive.

This is exactly what I meant.

I'll have another job long before the shit hits the fan leaving the decision makers holding the bag.

Re: BYOD means I/T loses some control over it

[guruevi]

1 IT tech per 550 users is indeed a very unreal ratio unless you work at a place like Google where everybody is highly technically adept. Even with heavy handed standardization and lockdown, you simply cannot maintain even the most basic of communications. You would be manning 1500 users, ~2000 computers, ~50 servers, ~150-250 printers and ~100 switches, 50+ access points if you have wireless, miles of cabling you should be halfway upgrading to fiber pretty soon... with 3 people? Who is developing anything? Who is rolling anything out?

Unless you have everything outsourced to the cheapest bidder and a host of consultants that don't count towards your FTE. Even 1 of you guys falling sick or getting hit by a bus would be devastating. From my experience a typical IT person can handle ~100 desktop users, ~250 if you have a well-run tiered help desk system.

If your department truly believes you personally have a hand over 550-800 users, then simply go out there, most likely what has happened is every single department has one or more official or unofficial IT tech and a number of desktop-servers and wifi routers on the desks.

Re:BYOD means I/T loses some control over it

[dbIII]

With respect, as an AutoCAD user from 1989 onwards, AutoCAD is a toy. For the entire length of it's existence there's always been something better and the open alternatives to it are functionally just as useful, they just have a different way of getting to the same endpoint.

Re:BYOD means I/T loses some control over it

[guruevi]

A proxy never works for HTTPS, you're always going to be doing MITM. You want authenticated proxy? Why in the hell would you want that? Proxies are there for caching purposes and maybe for blocking purposes (breaking the Internet on your own network), not for authentication purposes. You're using the wrong tools, you should be using Kerberos for service authentication, 802.1x for device authentication if that's what you really want, to block access to certain sites you could be using transparent proxies or block the DNS queries. Even so, proxies are dead with the amount of user-specific content the Internet generates these days.

Re:BYOD means I/T loses some control over it

[__aaltlg1547]

1. How on Earth would you save $1000/year per employee on hardware?
2. What is this support thing you mentioned? My guess is if they're not providing devices they're also not providing support for employee-owned devices.

Re:BYOD means I/T loses some control over it

[dbIII]

That sort of thing can come in by stealth when accounting does and end run around IT and fucks over employees by suggesting a "salary sacrifice" to get a shiny new laptop to bring to work that the company should have purchased for them in the first place. You end up with a pile of machines with no antivirus, no backups, you can't get a budget to repair or upgrade them, problems are not reported because of the fear you'll see the granny porn collections on what is their personal laptops, and, to make things worse, that's how Vista managed to sneak into the building at a time when none of our printers had drivers for the thing. There's still two of those things lurking around near me, and if the company owned them they would already have Win7 on an SSD or have been replaced entirely. Since they are personal machines the owners just get to see the people around them take home newer and better devices paid for by the company while they are left out of the upgrade cycle.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

We have about 25,000 BYOD users and ferociously protect our IP. I wish you luck in your crusade against the customers you serve. It seems to be working out for the RIAA/MPAA.

I don't understand your rationale that company security policies are some 'crusade' against the customers that company serves. Customers are not the same as employees...

Maybe the 'BYOD users' you are talking about are your customers and in that case, you probably have some other heavy security mechanisms to prevent those users from manipulating your IP. Either way, your business is not a candidate for NAC and your input is pretty much irrelevant.

No, I meant 25,000 actual employees, which is about 1/3 of our total internal user base. We've been running on a BYOD basis for about four years already.

BYOD is, much like LANs were, largely user-driven with IT reacting to demand.

Re:BYOD means I/T loses some control over it

[__aaltlg1547]

That doesn't solve the problem of what happens when an employee loses a device or has it stolen, or somebody plugs a spy device into a network-connected computer. Physical access to a connected device pretty much negates most forms of NAC.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Agreed and why did someone without authority to install have the keys. Oh yeah the software usually displays that in the about.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Nope. Just nope.
Because whatever you offer to users, they will come with their own device. And they will want to connect to the network with it. And check mail. Etc.
Nobody wants to carry 2 phones, 2 tablets, etc.

Yet, many wants choice and/or change device every 3-6month (I'm not saying its smart of cost efficient, I'm just saying its happening), so they'll bring their own device anyway.

Re:BYOD means I/T loses some control over it

[CAIMLAS]

The best thing about BYOD is getting drunk dialed by your boss at 2am asking for him to come pick him up... and no, I'm not even kidding. That would be a highlight.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

It certainly isn't a fucked up concept. The whole point is that IT departments have been primarily patrolling the boundary of each network, and relying on things like antivirus and USB lock down to prevent bad stuff on the network. The problem is that there is always a way, as the social engineering attack on RSA demonstrated. The whole web 2.0 paradigm is that you don't have a network, only a bunch of devices and networks that provide services. Those devices and networks may or may not be in your control. For the ones that are, you make sure they have appropriate security. For the ones that are not, you make sure you treat them accordingly.

In my experience "the guys running the network" are not nearly as disciplined as software developers. Infrastructure staff quite often have the mindset of lets fiddle with it until it works, and then put it into production, and fiddle with it there if it doesn't, rather than the develop - test - deploy of the software world. To be fair to them this is often because development environments are not given identical infrastructure to the production environment. Network guys also typically have a poor understanding of an overall solution, and how it interacts, and so are not best placed to make strategic decisions.

And just FYI in my case I learned programming in the early 80's (and that was on network connected PC or PC equivalents, not mainframes) and have worked in IT all of my life, the last 10 years of which has been in online security. I have also been responsible for a Network Systems team, so I am speaking from a wealth of experience from both sides.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Except for those guys that bring something to tether from the 'authenticated' device.

By the way, authenticated by the switch? How, by mac address, wuhaha, really?

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

This. I dunno what the grand parent's usage case is, but it seems like a case of 'You're doing it wrong'. Authenticate based on source network.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Hey if I bring my own lap top into work, it is none of the companies damn business what software I have running on there, and it sure as hell isn't their job to scan it or be responsible for the licenses.

I think you might be doing it wrong. BYOD means just that. The whole device, including the software. Is Your Own. If the company gives me a laptop, this is NOT a BYOD.

Re:BYOD means I/T loses some control over it

[the_B0fh]

If your company is not providing you the equipment to do the job properly, why should you provide it?

Anyone who wants to bring their own equipment in are just being divas. Your device *SHOULD NOT* work in the company. In fact, they *MUST NOT* in my environment. If IT is too slow, then management needs to fix it. Not let you introduce new issues.

I may loath and hate OutLook, but if the company tells me to use it, I use it.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Could you tell a bit more, please? What are use cases for those BYOD devices, what kinds of data and applications they're used for?

Re:BYOD means I/T loses some control over it

[aztracker1]

Put all byod devices on a VLAN with a transparent proxy allowing HTTP and DNS requests only, in addition to some restricted targets/ports until authenticated.. from there (after authentication) you can offer access similar to VPN users. You don't have to give *everyone* access to everything.

Re:BYOD means I/T loses some control over it

[KingMotley]

Personally, I prefer BYODs. I couldn't get a SSD into my PC even after I cleared it with IT, and I even bought it for them. It was only after I bought it they changed their mind and refused to either install it, or let me install it. My work PC is 1/3 the speed of my home PC, has 1/10th the disk capacity, and 1/20th the disk speed. Although, they did finally replace my 1280x1024 monitor this year with a 1920x1080 one. If it was a BYOD office, I'd have a much better office PC without their stupid antivirus killing 3 hours every week because it's corporate policy to run it at 12:00 noon instead of 12:00 midnight even though the PC is on 24x7.

Re:BYOD means I/T loses some control over it

[KingMotley]

I'd rather take the $800/year in "laptop fees", and $50/month in "cellular fees" and have them deposit it directly into my checking account. Oh wait, that is BYOD.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

Could you tell a bit more, please? What are use cases for those BYOD devices, what kinds of data and applications they're used for?

The primary BYOD users are a global sales force and executive staff. The core applications are email and calendar, which is pretty typical. I'd guess something close to 100% use those two. Other deployed applications are VDI, IM/presence, VoIP, sales process, commissions visibility, and expenses. Android and iOS have the most support, and new stuff generally launches on iOS first and Android second. Blackberry is supported, but I don't know what the story is with the various flavors of mobile Microsoft platforms. Could be we support them, I've never been interested enough to look.

We publish white papers on our BYOD deployment and have detailed statistics about what kinds of devices are being used and their growth rates. It's interesting stuff. I don't want to get more specific than that because we also manufacture things that could be used in a BYOD solution, and I don't want anyone to think I'm shilling or astroturfing.

Re:BYOD means I/T loses some control over it

[beelsebob]

Sorry to tell you this, but you're not doing your job. As a network administrator, your job is to make sure that the people using the network are able to do the tasks they need for their job.

Yes BYOD means you need to be careful about what happens on the network, but it does not mean the network will instantly fall over if you, the network administrator, is even half competent. What it also means in many (most?) companies is significant productivity gains for the people using the network, and ultimately, that's why you're there – to facilitate their productivity, not to sit in your ivory tower with your pristine "perfect" network that actually doesn't do what the users need it to.

Re:BYOD means I/T loses some control over it

[smack.addict]

Then your network isn't secure to begin with. You just use your control as a pathetic crutch.

Re: BYOD means I/T loses some control over it

[mikey1134]

Modern NAC as far more sophisticated that just Mac filtering. You can use 802.1X which requires a "supplicant" on the device to login to the switch with a user/password or certificate before the port will forward traffic. The switch checks with a RADIUS server, and you can even configure the system for "posture validation" which means things like the antivirus are checked to ensure the machine is clean and up to date before to device is given full network access.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

because you guys think you need to own every bit in the company to do your jobs, I can't
do my job.

and my jobs pays for yours, so, I don't care what you do, put me away from finance so I dont
have access to something I'm supposed to...but if you're going to insist that I cant plug in a machine,
or reinstall an operating system, or do anything else I need to to do my job you're costing the
company alot of money

so fuck off and leave me alone

Re:BYOD means I/T loses some control over it

[JDG1980]

The problem is that unless you can make a strong legal and/or business case for it, having the top management in a mid-size or large company held to the same standards as everyone else just isn't going to happen. For that matter, you probably can't force the company's best salesman to follow IT rules either – they outrank the IT department.

You might be able to rein in upper management if you can convince them and their peers that bad IT security practices are a violation of PCI standards (which can result in them pulling your company's ability to take credit cards) or Sarbanes-Oxley compliance (which can actually get the suits thrown in jail if they're unlucky enough). But just saying it isn't best practices isn't enough. Nor is saying that it's a violation of company policy – these are the people who make company policy. You will need clear and specific documentation saying that a particular practice could get them in actual trouble with some outside body.

Re: BYOD means I/T loses some control over it

[Anonymous Coward]

Even at Google, 1 IT tech per 550 users is unreasonable.

Re:BYOD means I/T loses some control over it

[Culture20]

4 IT staff to support around 400 people.

1 IT person should be able to support 1000-10,000 people depending on system homogeneity. BYOD makes everything heterogeneous unless the company mandates what hardware you're allowed to buy. That's why you could only support 100 people per IT person.

Re: BYOD means I/T loses some control over it

[Flere Imsaho]

Around here, the opposite is true. The technically adept people (read R&D dept) are the bane of our existence, as they constantly need changes made / make changes without consulting us.
The basic office worker drones with a standard image desktop are a walk in the park by comparison.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

No! You are showing "The Microsoft Way" of thinking about the network and the devices. The whole problem is that you should never have gotten there in the first place.
You should NOT trust the end user device. You should NOT trust the client network.
If you don't trust the client network or the client device THEN you don't have ANY problems with BYOD.

Re:BYOD means I/T loses some control over it

[skids]

I work in an educational environment where we've done BYOD since before the acronym got coined. Even in this very permissive environment, we still insist that certain OSes pass a basic NAC sanity scan to reduce the disease vectors inside the firewall. (It's all easily circumenventable, but less trouble to circumvent than to comply.) This brings down the infection rate to a level manageable by the help desk and IT staff.

We do have IP and PII concerns. We address them organizationally by clearly defining the boundaries where work with certain types of information may occur through user education. This generally does not constrain users to the point of hurting innovation -- interacting with this type of data is only a small part of most jobs here. Companies that fixate on technical solutions to problems that can be solved organizationally are only hurting themselves.

So the end result is people can BYOD, but they are patched up (because bypassing the NAC is 30 minutes work versus 5 minutes complying) can't be running open servers on them (as the firewall won't let inbound connections in) and are not using them to process the latest payroll, because they mostly cannot get to that data due to host/firewall policy, and where they can, they know they shouldn't do that.

Re: BYOD means I/T loses some control over it

[dkf]

The technically adept people (read R&D dept) are the bane of our existence, as they constantly need changes made / make changes without consulting us.

Only because you insist on having control.

Re:BYOD means I/T loses some control over it

[dkf]

A proxy never works for HTTPS

Yes it does, but only if the proxy supports CONNECT properly.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

I meant the "security" a NAC gives is defeated as soon as a device authenticates itself. Whether it's your company's laptop or a home device, as soon as the user authenticates the device it has free reign over the network and any malware on the computer gains access as well while you think the network is "secure". Typical malware is installed on devices that are still used by actual users.

A BYOD most likely does not support NAC. Since it's the end user device the chances they've installed malware or other malicious programs is greater.

Overall your argument is stupid, and a straw-man one. A network can be secure, and users can be prevented from plugging in unauthorized, unauthenticated and unaudited devices that don't comply with security standards and policies.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

The problem is that NAC is not a security tool, it's a network access control tool.

I suppose you don't consider a lock a security tool either?

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Don't connect equipment with pirated software onto your company's network. Done.

Only fools pay for software.

Re:BYOD means I/T loses some control over it

[dbIII]

That's fine with an ad-hoc situation where outside devices are allowed to supplement existing ones (and it's what I've got already for people's phones and the odd thing they bring in for personal reasons), but I see this discussion as being about BYOD policy with actual work expected to be accomplished on the BYOD devices - thus they can't be restricted as much without impeding work.
It all depends on the level of communication. If IT is just expected to get out of the way and hide in a corner then vastly more work is required than managed risk. In some places, despite it being a good idea, your suggestion would be seen as IT being unwilling to give up control and not embracing a BYOD policy.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Even easier to pin it on you if you're no longer there. They can just claim you intentionally infected the network for personal gain and bailed before bad things happened. Then you might just get a lawsuit thrown your way!

Re:BYOD means I/T loses some control over it

[Jane Q. Public]

"Not sure about you, but no one plugs in whatever they want to our network..."

I agree with you 100%. And I go further: if the company wants me to BMOD, then they can damned well pay me for the use of it. It's okay... I'll rent it to them at the going commercial rate.

Re:BYOD means I/T loses some control over it

[nojayuk]

AutoCAD is the basis of an entire ecology of add-ons and workflow tools, many of which can cost ten times the basic cost of the package itself and then some. Oil refinery piping layouts, dynamic flow analysis, bill of materials, finite element analysis tools, import and export to other engineering packages, 3DMax visualisation etc. etc. Unless and until the FOSS alternatives to AutoCAD can plug in as a one-for-one replacement to that ecology then they're not going to make big inroads in the multiseat engineering/architectural world.

Re:BYOD means I/T loses some control over it

[SuricouRaven]

"Not sure about you, but no one plugs in whatever they want to our network, all network ports are authenticated at the switch, you plug in a non authorized device the port simply shuts off" .1x? We use that too. No-one has yet figured out that the network printers, scanners and phones don't support it, so anyone could just unplug one of those. It doesn't get them on the main VLAN, but it's a foot in the door.

Re:BYOD means I/T loses some control over it

[symbolset]

You said you do it successfully, but didn't say how. I can respect that.

People are going to attack you for that because they don't know how. It's not your job to teach them how.

Incompetence reigns in enterprise IT, as it always has. Fixing that isn't your problem as long as you do well by your charges.

Eagles may soar, but weasels don't get sucked into jet engines.

Quite.

Re:BYOD means I/T loses some control over it

[SuricouRaven]

"1 IT person should be able to support 1000-10,000 people depending on system homogeneity. BYOD makes everything heterogeneous unless the company mandates what hardware you're allowed to buy"

So the company gets the equipment they want, and someone else pays for it. Management must love that idea. Way to externalise those costs!

Sure, it'll upset the employees. But what are they going to do about it?

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

We use FOSS counterparts to AVID and AutoCad in commercial production settings so yes that works. And the best accounting software systems that scales in enterprise deployments are FOSS (and based on Java EE). As for automotive computer tuning software I haven't used them so I cant say something about that.

So possibly with the exception of car repair you are dead wrong in your ancient beliefs on where FOSS can be used. In fact some of your examples are business that are totally dominated by FOSS, and often based on the Java stack (Jboss, Liferay, Apache OFBiz etc).

Re:BYOD means I/T loses some control over it

[symbolset]

Could you tell a little bit more, please? What is the IPv4 address range for your routers?

Re:BYOD means I/T loses some control over it

[SuricouRaven]

FOSS isn't always viable, true. But those applications are all very specialised - I can't imagine many employees would want to steal the key for a car-tuner or corporate accounting program. Things like office suites or DTP software are the problem, and in those areas FOSS is, if not always as good a solution as the established commercial software, at least good enough that it can be considered as an option.

Re: BYOD means I/T loses some control over it

[symbolset]

At Google you can't even interview without being IT tech qualified. Even for accounting, marketing or shipping. I'm pretty sure the guy who sweeps the warehouse could teach IT at your local community college.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Then you would get rich by suing them for defamation as its bot your fault that an unauthorized device have access to that system.

As I'm running more than one application over the internet where BYOD are sort of the norm... I am quite aware on how application level security works and how to secure a web application so that clients have to authorise themselves before they access a resource.

As I see it those that impose their crappy management software on devices are idiots that do not know how to properly secure their applications on the application level.

Re:BYOD means I/T loses some control over it

[symbolset]

1 IT person is good for nothing because humans need downtime to function correctly and tech needs to function correctly 24/7. At 400 users a good minimum is 4 IT folk. Fewer users: outsource it. From 400 to 3,000 you shouldn't need more though. After that somebody needs to assume a leadership posiiton.

Re:BYOD means I/T loses some control over it

[FireFury03]

A proxy never works for HTTPS, you're always going to be doing MITM.

You're wrong. Without MITMing the encrypted traffic you will, of course, never get access to much of the information being transferred. But you do get access to the host name being connected to, what useragent is being used, etc.

You're using the wrong tools, you should be using Kerberos for service authentication

Yes, HTTP proxies support Kerberos just fine.

802.1x for device authentication if that's what you really want

802.1x would certainly be ideal; but frequently not feasible due to the amount of integration required within a network - you're going to need to replace all your switches with 802.1x capable ones, integrate it with DHCP and firewalling, etc. and the overhead of managing the certificates on hundreds of devices is quite extreme.

to block access to certain sites you could be using transparent proxies

As mentioned elsewhere, transparent proxying isn't possible with HTTPS unless you're going to MITM the encrypted traffic.

or block the DNS queries.

That's a very blunt instrument - you're talking about blocking all access to a host for all client software, rather than blocking specific parts of a website.

Even so, proxies are dead with the amount of user-specific content the Internet generates these days.

I don't see how "user-specific content" is at all relevant to the conversation. Sure it reduces that amount of content that a proxy can cache, but not greatly so - there is a *lot* of static content around still (javascript, css, images, etc) and caching it certainly has a big impact on the performance of a network. Its generally only the HTML and JSON traffic that is user-specific and uncachable, which tends to be a small proportion.

Re:BYOD means I/T loses some control over it

[FireFury03]

So maybe you shouldn't try to control web access from your network if you allow it at all, but rather deal with people browsing Slashdot or porn sites all day long when and if it becomes a problem?

1. You're assuming this is just about stopping people wasting their time browsing porn all day, whereas filtering web traffic is very useful for security purposes (e.g. blocking phishing sites, malware, etc).
2. You're assuming I'm dealing with adults. I'm not.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Other companies do just need the equal security of SSL and have their CRM/ERP/ETC as a web application. That really removes a lot of management overhead. VPN client and remote desktop replaced with web browser. Same security, less work.

The only case when you need extra security you really need end to end security. Tamper-proof bios, firmware and operating system. That means you need to run ChromeOS which are the only OS that currently have end-to-end security.

Re:BYOD means I/T loses some control over it

[gd2shoe]

These CEO's often wonder why they end up with crappy IT departments.
Yes men tend to make very poor security decisions.

???

That was a non-sequiter. You took an example of bullying and tried using it to rail against men. Lots of men make great security decisions. Lots of jerks with power don't -- both men and women. This isn't a gender issue.

Calling someone a "hater" only means you can not rationally rebut their argument.

Are you trying to be inflammatory? If it was a joke, it was badly formed (and not funny).

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

This. Most tools we use have painful stupid licenses, because it have been negotiated by morons. When I negotiated some of the tools we used, I told the sales reps there was no-way I would put the company at risk because of people behaviour, and was going to license on the number of people using the software, not the number of install. Non negotiable, and if hey don't provide that, they can go fck themselves. Got low prices too, because I know the exact use cases, and don't care at all about list prices. You may be surprise at what vendors are ready to do to make their numbers.

Of course, in some case it isn't possible. In those cases, 1- I tell the vendor about it, 2 - I re-engineer the workflows to lower my dependency on the vendor, taking an alternative source (where possible) 3 - I take the strict minimal number of licenses possible, each year less 4 - I avoid all other of this vendor's offernings.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

> Sorry, but this part isn't negotiable.

But you job is.

The world is changing, those devices are extension of people, and they will use them at work, whether BOFH like you want it or not, and your centrally contolled view of the world will just blow up, like so many before. Do you think IT wanted "personal computers" to connect to their beloved internal mainframe SNA network? Where are they now ?

All apps are going cloud, accessible from any devices. You are going to get routed around.

Our local 20yearofpresence BOFH have been made redundant 3 months ago to his considerable surprise. No one misses him.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Well then I won't bring my own device. ( Actually I will, but I will not tell you about it. If I can I will go around your precious security features to use it. Or just use it outside _your_ network ). You will not get to wipe _my_ device. I'm not sure why anyone would even want to carry their own device around for work related things. I'd rather use someone elses hardware, that way it's their problem if I lose or break it.

Re:BYOD means I/T loses some control over it

[dbIII]

It is called system integration and is done with things that are less of a toy than AutoCAD.
Also I cannot understand why you wasted your time listing those things - some of which I've been aware of for decades and some (like the FEA stuff) that is inaccurate since the data doesn't have to come from just AutoCAD. I knew of all those things before I gave my opinion, and attempting to lead things even furthur offtopic gets us nowhere.

Re: BYOD means I/T loses some control over it

[Flere Imsaho]

The technically adept people (read R&D dept) are the bane of our existence, as they constantly need changes made / make changes without consulting us.

Only because you insist on having control.

Pfft.. I'm talking secure/running. It's nothing to do with control. We have a great relationship with the rest of the business, best of any IT shop I've worked so far.

How the fuck does a snarky one-liner like yours get modded up, anyway? Bless the Internet - I love being insulted by complete strangers. who through a butt-load of assumption, think they know something about me and my place of work >:-/

Re:BYOD means I/T loses some control over it

[shitzu]

How do you make sure no-one plugs in whatever they want?

IEEE 802.1X

Re:BYOD means I/T loses some control over it

[ttucker]

The stupid thing about NAC to protect from trusted internal users, is that their machines have to authenticate, and therefore have the keys to authenticate. Extracting them becomes a relatively simple process. All that it really provides is some notion of who is connected... but even then, a key can be stolen from a coworker.

Re: BYOD means I/T loses some control over it

[Anonymous Coward]

Thank you, if you wouldn't have corrected the complete BS "Culture20" uttered I'd have done it.
And I would have written something quite similar to you!

Re:BYOD means I/T loses some control over it

[dreamer-of-rules]

"Yes men" .. people (of any gender) who say "Yes" to higher-ups. A brown-noser.
http://en.wiktionary.org/wiki/yes_man

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Our customers include people like the MOD and we're a List X site. They get upset if you let people plug whatever they like in to your network, which is why there's port level authentication for all devices - if it's not authorized for the network port, it's not on the network.

Re:BYOD means I/T loses some control over it

[DarkOx]

There you go, a ratio of 1:100 is pretty bad for operations staff by today's standards. You should be able to handle, 2500+ clients with that. One support phone guy. Then 1 network engineer, 1 wintel guy, one *nix guy. The latter three all crossed trained engough to moonlight covering for each other and deal with a support escalation as well as handle the interdisciplinary stuff like VM infrastructure. You can do that if you have standards.

Re: BYOD means I/T loses some control over it

[DarkOx]

Yea well we learned at my organization you have to keep control. You get good engineers that just are not it experts. If you don't have control you pretty soon find then doing things like FTPing schematics home to work on then there. Sure they are smart guys and understand the potential problems with that when you explain it to them, but that is not the sorta thing they spend there time thinking about. Unless you want to waste there time having the it security talk weekly rather than anually, a good electronic fence implemented on equipment it controls is a more efficient way to keep everyone on the strait and narrow

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

And with only 4 IT staff to support around 400 people.

I support more than that by myself because my workplace is not BYOD (3 sites). You basically said why BYOD is not a good idea.

Re:BYOD means I/T loses some control over it

[DarkOx]

I am sorry but people like you who have that attitude toward it are absolutely every bit as wrong as the it types who think the answer to everything should be "no".

When some gets a worm on your network and it takes the entire business offline for the better part of a day while everyone chases down and cleans the machines you will still say IT failed to do the job you refused to let them do.

When you customer list is published on wiki leaks, or near perfect copies of your flagship product trade secrets and all start coming off the boat from china you will say it did not do their, which you refused to let then do.

Yes, IT needs to help you be productive but they also need to protect you and the company, which means they can't just let you do *anyhing* any time. It's not that simple, you need to stop looking at IT as your bitch and start thinking of then as trusted advisors just like you do your legal department or your HR people.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

I've taught AutoCAD at a major school of architecture. I agree, it's a bit of a toy next to the alternatives. I think AutoCAD remains largely in part because there was a time early on when there really weren't alternatives.

Re: BYOD means I/T loses some control over it

[Flere Imsaho]

Totally agree. "It's nothing to do with control" was probably a bit strong. I meant it's not about controlling people just because you can.
We aim to be secure, but transparent. If there's a conflict the business decides on the risk level we go with. I'll always push for secure in that situation - it's my responsibility to do so. I try to be reasonable, but hey, if nothing else I've done my job well and can sleep at night.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

If you can wipe it, it ain't my device any more. No thanks - please supply me with a corporate toy instead.

Re: BYOD means I/T loses some control over it

[Flere Imsaho]

Crap, didn't mean to say "We have a great relationship with the rest of the business" I meant to just say "...with the business" - all of it.o_0

Re:BYOD means I/T loses some control over it

[Flere Imsaho]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it.

I think having a network means you can no longer trust your own network. Air-gap it, or assume the worst and plan accordingly! :-)

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Where did you get the 1000-10,000 figure from?

Re:BYOD means I/T loses some control over it

[Lumpy]

You are full of carp on the AVID replacement. there is nothing . N O T H I N G that is FOSS that can replace avid. Hell there is nothing FOSS that can replace Adobe Premiere.

Everything that is FOSS for video production is either a toy for home movies or is so buggy that you lose money by the bucketload. When you are paying a professional editor $90 an hour to edit your film you dont want Cinerella to crash yet again and take out the last 4 hours of work.

Oh and ignore that to use FOSS you have to transcode all your footage because it will not work with RAW video or with AVCHD (if you work in ENG you have to live with AVCHD as all the pro sony cameras use it) so now you need to transcode and get a mild generation loss PLUS waste about 6 hours to convert the 12 hours of footage you shot.

Unless you have some hidden FOSS project out there that we have not been able to find. Because every single one I have tried is utter, utter, crap compared even to the Jokes of the industry like Premiere and Canopus.

Oh and please tell me what you are using to replace After Effects? Dont even try to say blender. Eventually Blender will be able to do some of this, but not now.. not if you are paying someone to work with it. Workflow in blender for anything outside of 3D CGI is a nightmare.

Re:BYOD means I/T loses some control over it

[Lumpy]

Key theft is not a problem if the IT department did not hand it out freely and they actually did their jobs.

Re:BYOD means I/T loses some control over it

[higuita]

pick on some of the money you would pay in each of that software and invest it in the FOSS companies to build one for you, fixing the things missing on the current software. on short term still use the closed programs until things get better. on short term you pay more, but the long run you will save a lot of money.

each of the software you point, each one cost huge amount of money, even a small part of it would help making FOSS software to get better

Remember, FOSS is software that someone build to solve his problem... if this is your problem, help fixing it. If everyone is waiting for the next guy to do it, none will do it. If you cant program, pay someone to do it.

Re: BYOD means I/T loses some control over it

[Bill, Shooter of Bul]

Ha! I used to work at a place with a real honest to god genius. Who was almost irreplaceable and by far the primary engine behind the company's growth. He also hated, hated any and all attempts to restrict his access to anything that interested him. We went through several network administrators that thought they were smarter and didn't want him to sporadically take down the network when one of his side projects unrelated to work brought down the network. I felt bad for the poor bastards that were in that no win situation.

Re:BYOD means I/T loses some control over it

[quetwo]

If you don't understand that for your IT department, your employees are your customers then no wonder you don't like and can't deal with BYOD. I bet you also lock down their screen savers because it's easier for you to deal with as well.

The issue is that IT has become commoditized. With a lot of the basic services out there, employees have found ways around IT that treat them like dirt (we are the monopoly, and you HAVE to use us to do your job!). That is where the conversation around BYOD begins.

In my organization, the IT department was forcing all the users to use Windows phones as the only option to check email. This was up to about two years ago, and Windows Mobile 6.1 devices were the only approved ones because "it made sense to standardize devices across the organization" They couldn't fathom using an Android, iOS or BlackBerry to do our jobs. Windows Mobile made it easier for them, so that is all they allowed. Then one day they were told by the BOD that they were going to carry Android phones. Then the exceptions happened, and now they are forced, kicking and screaming, into the serving their customers.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Disciplining users is a human-intensive activity, it can not be donc in a cost-effective way one you pass a specific size.

Also, disciplining users is a reactive strategy, it does not help you a bit when business-critical project with deadline and heavy penalities was stalled for a few hours because some bored intern wanted to access the latest video-streaming website, and saturated accesses (hint: there are big video companies competing on how fast they can saturate any network link with the highest-def-possible programs)

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

It's a walled garden of near uselessness. Gratz.

Re:BYOD means I/T loses some control over it

[Chris Mattern]

You misparsed the sentence. Not "Yes, men tend to make...", but "Yes-men tend to make...".

Remember kids, punctuation is important! It's the difference between "Let's eat, grandma!" and "Let's eat grandma!"

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

You sound incompetent. You're also delusional. I can easily share my network connection with a my computer at work or I can use a router with MAC spoofing. A switch doesn't secure much at all.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Your an idiot if you think MAC spoofing will get you into a device authenticated network, these aren't home wifi routers that use MAC addresses as quasi security device. Your also a moron if you think people that lock down there network give there users rights to alter their network settings. Someone certainly sounds incompetent, but it aint the OP.

Re:BYOD means I/T loses some control over it

[Gr8Apes]

You can do both you know. NAC is used for a "secure" network, which has a certain level of trust internally. BYOD is on a second, lower trust level network, and access to your "secure" network is gated and monitored. Note that neither case ever relieves you of the need to monitor and manage your "secure" network, nor the intended "secure" resources, which should still be gated and monitored separately.

I have one case where you're supposed to go through a proxy to hit resources in a "secure" network, but the incompetent network folks did not VLAN that network, nor did they firewall it, or sincerely do even the most basic of activities to actually secure that network other than proxying HTTP/HTTPS traffic. That is not a secure network by any stretch of the imagination. I can hit it directly from almost anywhere in their network and guest network, once I have access to any single system on it.

Re:BYOD means I/T loses some control over it

[goose-incarnated]

When some gets a worm on your network and it takes the entire business offline for the better part of a day while everyone chases down and cleans the machines you will still say IT failed to do the job you refused to let them do.

The problem with that is that in my experience, even when a worm takes down half the locked-down-to-hell-and-back machines on the network, the IT dept who refuses to let the "peons" do anything still doesn't get blamed! I figure, since you aren't getting blamed when my machine gets infected, why the fuck are you restricting what I can run on it? I get blamed in any case while IT get's to increase their lockdown.

Re: BYOD means I/T loses some control over it

[Agent0013]

If you don't have control you pretty soon find then doing things like FTPing schematics home to work on then there.

So what are you saying? You would much rather have them copy the schematics to their laptop or USB key and bring them home that way? I don't really see how FTP makes things any less secure, just less convenient.

Re:BYOD means I/T loses some control over it

[dargaud]

if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

That's insane. There's no way I'll give admin priviledges to my hardware to anybody, much less a coworker with an attitude. And that's even counting if I have it in the first place. If I want to use my smartphone on the wifi at work, unless it's rooted I'm not even admin on that, so why should you ?!? Do what sane network admins do: register the systems and put them on separate networks. For starters.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

bullshit
90% of all autocad users could get away with using either autocad lt *OR* a freeware/cheapware alternative... i know, 'cause i've done it...
used autocad for forever (still using it at work), and -again- 90% of the users do NOT use nearly any of the advanced features that *requires* them to use autocad specifically; they just do, 'cause that is 'the standard'...
it is pretty much exactly analogous to photoshop/gimp: 90% of photoshop users are doing 'simple' tasks like cropping, contrast adjustment, etc, and 99% of the time they have no need for the more advanced tools which *may* be uniquely easy/powerful to do in photoshop...
i am not saying you are incorrect about *some* engineers, etc who use integrated -say- COGO software on top of autocad, but *most* do not *have* to have autocad specifically for their (mostly) 2D drafting tasks...
just habit, and the 'nobody got fired for buying IBM' mindset...

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Singalong with me:

Copying is not theft.
Stealing a thing leaves one less left
Copying it makes one thing more;
that's what copying's for.

Copying is not theft,
If I copy yours you have it to
One for me, and One for You
That's what copies can do.

If I steal your bicycle
you have to take the bus,
but if I just copy it
there's one for each of us!

Making more of a thing,
that is what we call "copying"
Sharing ideas with everyone
That's why copying is FUN!

Re:BYOD means I/T loses some control over it

[MachineShedFred]

It's possible to do BYOD, but it requires having a shload of infrastructure in place first. Example:

- Only certify certain hardware as qualifying - basically the hardware compatibility list of:
- run a bare-metal hypervisor on the hardware, like XenClient
- have your corporate image as an image running on the hypervisor, with the user image running in a different sandbox side-by-side
- have your corporate image authenticate with the network, and only talk to your corporate network (or a VPN concentrator).
- have your corporate network only talk to your corporate VM image, and actively deny any connection that doesn't authenticate through provisioned TLS.

This would keep the company secure, as well as allow the user of the device their own place for their stuff.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

you don't want my device on your netwerk, that's fine.

but if it's my device, then I control it
If corporate IT want's root, they can coorporate can give me the rooted device, cause they're not getting it on my hardware.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

So maybe you shouldn't try to control web access from your network if you allow it at all, but rather deal with people browsing Slashdot or porn sites all day long when and if it becomes a problem?

What? Like after the lawsuit has been filed against your company?

Re:BYOD means I/T loses some control over it

[FreeUser]

Honestly the one thing that screams that the management is a bunch of Douschebags is a BYOD policy.

That depends on the BYOD policy. I work for a company that gives you a choice: company iPhone, or BYOD and they give you a stipend that covers the majority of the cost of most cell phone plans. It's a pretty good deal whichever way you roll.

But then, my employer isn't trying to get people to buy their own laptops or workstations. Any employer doing that is a real douchegab.

Re:BYOD means I/T loses some control over it

[MachineShedFred]

Try getting PCI compliance if you aren't using some form of network port control - 802.1x or otherwise. You won't pass the audit, and for the company that I work for, that's literally a billion dollar problem.

That's not about being user-surly, that's about being a responsible employee.

Re:BYOD means I/T loses some control over it

[MachineShedFred]

I work for a company where the director of corporate information security has actively told the CEO that he can't have that device, and then gave him good reasons why (safe harbor, encryption of proprietary data, accidental financial disclosure risks, etc.).

Was the CEO happy? Actually, yes - he knew that he had competent employees that were doing their jobs and looking out for the company, and not looking to be Yes Men.

Re:BYOD means I/T loses some control over it

[MachineShedFred]

The fix for that: automated software deployment.

If the users never get the installation media, and never get the license keys, and are not administrators because they no longer need to be, you don't have this problem. Also, you can audit your licenses because they've all been centrally deployed.

We've been doing that now for about 7 years, and it's much more convenient for someone to fire off an email and have the software installed an hour later, than have non-IT staff wasting their time muddling through IT work that can be automated using free-from-licensing solutions that are available for practically every platform. There's some that you can pay for and have some really nice features, but even small business can do automated software deployment now.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

You can always start your own business and have the network your way.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

We all know that bad 0-day exploits are an uncommon occurance right? BlackHat is not what it used to be. It seems that they're more aligned with corporate agendas now days. Don't get me wrong, NAC is a good thing and certainly provides significant protection, but anytime you allow uncontrolled devices to enter your network you're asking for trouble regardless of whether you have NAC or not.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

I have the 'joy' of working with an IT dept like yours.

I make programs for a living. Visual studio, eclipse, net beans? What freeking odd programs to install on a computer?! Yet I have to get each new exe 'signed' or use an 'unauthorized' device. Just to do my job.

IT is a balance of trust and non-trust. The question is do you trust your users not to get their computer infected and bring it into your network or not? Education is better than letting them do whatever. They are probably doing whatever because you never trusted them to do the right thing in the first place. You never made them feel like the security of the network is also part of their job. You made it 100% yours. With that you get 100% of the pain of supporting it.

So they suffer at home with a broken computer 'because its not your job'. Perhaps if you help them with their home computer too they will be *shock* more happy. As they will not be farting around with some stupid root program for 6 hours after they get home. Because they would know how to not get it in the first place. And a bit of help from software you install on their computer.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

This is exactly why I DON'T want BYOD at my job. I like to keep work away from my personal devices, and would never want to give remote wiping or admin privileges to my work. I'm perfectly happy doing my job on my company-provided hardware.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

+20! In spite of the typos it's a very valid post. The answer often should be no. The problem is though that IT/Security is not respected, and they often take the blame when things happen. We've had contractors come in and unleash badness in our corporate environment. Our security team recommended that they be segmented from the rest of the network, but upper management didn't want to spend the money. Even after we were compromised they still didn't take it seriously, and blamed the security folks. It happens all the time in companies the world over.

BYOD introduces an insurmountable number of variables. The people who are doing it successfully are playing russian roulete, and they've been lucky. When you stop and think about the fact that the best anti-virus packages only catch about 40% of what's bad, 0-day exploits are discovered every day, many more are undocumented and sold on the black market, and users are generally prone to do dumb things when it comes to security you start understand that the more static you can make your environment the less likely it is to be compromised. BYOD makes that impossible to do. You can't do things like white listing, driver updates and patching is next to impossible, NAC is going to require you to manage every device, and once it's trusted there's nothing to stop an exploit from compromising you network. It just seems like a terrible idea to accept all of that risk in exchange for not having to buy a little hardware.

Re:BYOD means I/T loses some control over it

[unixisc]

This is correct from the office's POV - it's stupid and shortsighted from that end. From the employee's end, it's only a good idea if the employee - and unfortunately, there are too many of them - freely uses his work computer for personal/private use, and vice versa.

Otherwise, it's completely inane and unethical - if I'm using a laptop or phone for my personal use, why on earth should I use it for work? First of all, when using office computers, employees are always made completely aware that anything they put on that belongs to the employer, and so they can't legally object if the network sniffs their personal info and does something w/ it - such as them interviewing another company. But if I am in a BYOD environment, there is no way that such an item belongs to the IT department, but I may have to use software that the office requires. That is meddling into my control of my own device.

My solution - keep it simple. Don't use office laptops or phones for your personal stuff, such as checking your bank account, sending e-mails to a recruiter or your personal accountant, or things of that sort. Similarly, don't use your personal laptop to make office presentations, reports, spreadsheets or other such documents. Keep usage of those things completely separate, and there will be no issues about ownership.

Re:BYOD means I/T loses some control over it

[hobarrera]

If you were blindly trusting your network just because you owned the devices, you were doing it all wrong.

The moment someone else physical has access to a single computer on your network, you should treat the entire network as untrusted. Anything less is just asking to have a security breach.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

"Yes moron CEx's regardless of sex tend to make very poor security decisions."

FTFY

Re: BYOD means I/T loses some control over it

[denmarkw00t]

getting hit by a bus would be devastating

Note: This is true regardless of company size and/or IT staffing

Re:BYOD means I/T loses some control over it

[hobarrera]

Why do you need to filter web access through a proxy?
I've yet to see an organization with a valid excuse for this.

Re:BYOD means I/T loses some control over it

[hobarrera]

BYOD is not just about someone saving money. It's about people expecting to have their devices work and IT in organizations being too slow or not having enough funding to give everybody their device of choice.

I've found BYOD is actually a big PITA for large organisations because the devices people are bringing are almost universally Android or iOS, and in both cases the OS and apps have terrible support for HTTP proxies; and many large organisations use proxies to control web access from within their networks.

If users bring their own devices, and those have OSs that don't even support HTTP proxies, then that's the users' problem.
You can't have a BYOD policy and then have to deal with devices that have network support that looks like it's 2001.
What's next "my device doesn't support TCP/IP"?

Re:BYOD means I/T loses some control over it

[hobarrera]

I agree. Even before the age of the internet, users had the change of bringing in a floppy with Monkey Island on it, buy nobody did that because they know they'd get fired for fooling around in work time. The same needs to apply to modern internet usage: you don't restrict it, but make sure people aren't slacking off all day long.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

All of that is invested in even with company owned devices otherwise you are simply cutting corners or never let a company owned device leave the building. If you implement some requirements for BYOD then you do have standards. You may purchase and use any device you want but if doesn't meet the requirement for the BYOD program you will not be using it at work. BYOD programs do work and they work well when implemented properly.

Tier II VDI Admin.

Re:BYOD means I/T loses some control over it

[hobarrera]

Maybe you should improve your licensing options or choose better products with less licensing. Throwing out high quality people because a 3rd party company bullies you is not really great business practice.

Yeah, really high quality employees which were illegaly redistributing copyrighted works inside a corporate enviroment!

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

BYOD for me, as employee is about having a personal computer (laptop formfactor though) available instead of a corporate appliance.

You want control, then you provide and administrate the device.

The flipside of that is that if it's my device it's also my responsibility to keep it working, how much, if any support for that you do as corporate IT is up to you.

Usually means that there's some locked down desktop with the corporate image that I hardly use cause I'm working on my BYOD laptop (all corporate data I need is in slow as molasses webbased system)

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

That sounds great in theory, but it's seldom how it works in practice. If you leave you make the perfect scapegoat. "Oh, our last security guru screwed up. They're no longer with us, so problem solved."

Re:BYOD means I/T loses some control over it

[hobarrera]

When you BYOD onto my network, we control it, we can wipe it, we can install and uninstall apps and if you dont agree to our terms, dont bother complaining that you cant BYOD. BYOD is not open slather, if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

BYOD isn't a priviledge. I'm actually putting additional resources onto my job to do it more efficiently. Why do I also have to give YOU control over it?

I use my personal PC for work. If my boss want access to wipe it, install stuff etc, my answer would be "No. I own it. If you want control over it, give me one payed by yourself. I want to do whatever I want on it on non-work time. Also, don't expect me to ever carry it with me the moment I leave the office."

Re:BYOD means I/T loses some control over it

[Penguinisto]

I suspect you would be better served to ask how many subnets/VLANs he uses, and how they're structured to isolate the BYOD bits from the rest of the infrastructure.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Our BYOD program has been running for about two years and I have noticed that although the BYOD users generate more problem tickets when they first start but they tend to take care of their own equipment better than company equipment. Those extra ticket usually end with us educating the new user on how to care for their device which they take more seriously when the hardware is their investment.

Re:BYOD means I/T loses some control over it

[petermgreen]

Also with some software it's trivial to get the license key from an installed copy of the software. I've even seen at least one program that showed it on the splash screwn at startup.

Re:BYOD means I/T loses some control over it

[Hatta]

Oh, your users know. They know and they hate you for it. You only don't know that they know because there is no mechanism to petition for a redress of grievances.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

So the fact we have 20+ people on phones and 16 techs yet are still drowning with only 10,000 devices means we're horribly inefficient? I guess with some areas fewer techs and more hardware is fine, but in our organization it doesn't work. Nor any that I've worked in.

Re:BYOD means I/T loses some control over it

[drinkypoo]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it.

You never did, and if you've been assuming that you have, you don't understand network security.

Re: BYOD means I/T loses some control over it

[drinkypoo]

We went through several network administrators that thought they were smarter and didn't want him to sporadically take down the network when one of his side projects unrelated to work brought down the network. I felt bad for the poor bastards that were in that no win situation.

If they were smarter, they'd have got him his own network and his own WAN link to play with.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Pro-tip:

Typically, everything under "--" is a signature. The signature is a snippet of text that the user chooses in advance and rarely has anything directly to do with the specific post it is attached to. Also, someone with such as weak grasp of English as to not recognize the phrase "yes man/men" should not offer advice as to what constitutes a badly formed joke.

Re: BYOD means I/T loses some control over it

[aceboomblain]

Those folks might be the "bane of your existence", but the corporation as a whole probably considers them to be critical assets; unlike the IT folks, who can be replaced much more easily. It is IT's job to serve them (and everyone else), not the other way around.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

When some gets a worm on your network and it takes the entire business offline for the better part of a day while everyone chases down and cleans the machines you will still say IT failed to do the job you refused to let them do.

No, any IT department that can't protect its networks from a rogue device is incompetent.

Any competent IT department will be able to properly segregate user devices from critical corporate infrastructure. Hell, even if you're totally incompetent you should be able to set up a goddamned Wi-Fi network that's connected to the Internet outside the corporate firewall.

If your HR department advised you not to ever allow employees to speak to one another to avoid personnel conflicts, you would fire the HR director.

If your Legal department advised you not to do business outside my state of incorporation to avoid liability, I would fire my head counsel.

If my IT department can't secure critical data from a hypothetical rogue device, then it can't secure it from a determined hacker, either.

Re:BYOD means I/T loses some control over it

[SecurityGuy]

It was just made up on the spot, like 73% of statistics are.

Re:BYOD means I/T loses some control over it

[g0bshiTe]

It's called a GPO to disable USB ports on PC's. Also on a network the DHCP range is limited to 5 ip's which also shoots our IT dept an email when a lease is issued AND I have a server setup to monitor ARP (it's to prevent man in the middle attacks) I still get a notification when a new device appears on the network.

Do you work in IT or did you just stay at a Holiday Inn Express last night?

Re:BYOD means I/T loses some control over it

[g0bshiTe]

BYOD of 400 users across 4 admins, your IT guys are overloaded, there's your issue.

Re:BYOD means I/T loses some control over it

[g0bshiTe]

Actually sounds more like a App Store dev house.

Re: BYOD means I/T loses some control over it

[Anonymous Coward]

Yeah, this "You must serve us!" mindset is what really burns through IT quick.

We won't listen to your warnings about not running DancingPigs.exe attachments from our mail or stuffing paper with staples in it in the printer, but damn, you must serve us, slave, and it's your fault we have to stand around sipping coffee while you're fixing things we caused! Move faster, you're losing the company a $1000 per minute here.

Re:BYOD means I/T loses some control over it

[vux984]

Other companies do just need the equal security of SSL and have their CRM/ERP/ETC as a web application. That really removes a lot of management overhead. VPN client and remote desktop replaced with web browser. Same security, less work.

A web application is not a substitute for all but the simplest scenarios.

The only case when you need extra security you really need end to end security. Tamper-proof bios, firmware and operating system. That means you need to run ChromeOS which are the only OS that currently have end-to-end security.

Just Yuck. Interesting, but still yuck.

Re: BYOD means I/T loses some control over it

[Bill, Shooter of Bul]

They weren't given the budget to do that, and that would have just caused him to link the two together in an unorthodox fashion and kill both anyway.

Re:BYOD means I/T loses some control over it

[Yakasha]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it.

Didn't read, didn't understand, or didn't agree with the article?

Three things, 1 from the article, 1 anecdote, 1 question.

Article: The article, and the summary, stated that the primary and only real difference between COPE and BYOD is ownership. Why do you automatically assume that "BYOD" means "Bring absolutely anything you want from an iPhone to a kitchen sink and plug it into our network without running past IT first."? BYOD in no way prevents you from saying "Bring your own Windows 7 or 8, OSX 10.6-8, or RedHat 7 laptop; iPhone 4+ or Android 4+ phone; And install this software we provide...; No CentOS; No BB; No XP; No 10.5". You don't have to relinquish control or standards, you don't have to give up your Terms of Use for your network. The only thing that has to change is who pays the invoice when the computer is delivered.

Anecdote: I worked on a contract with Lucent about ... wow 10 years ago. As a vendor I obviously brought my own laptop (well, my company's, but same difference as far as Lucent is concerned... its not theirs). The first thing I had to do when I plugged in though was install their software. I still have no idea what it did beyond letting me join the network (and pop up a friendly little window when I did connect, reminding me of Lucent's right to monitor, record, restrict, or redirect absolutely anything sent over their network). But as soon as its there, guess what? They had whatever control they wanted over their network and my PC. What would have happened if their software didn't work on my PC? Who knows...

Question: Considering the anecdote above, what is the difference between having a BYOD policy and not providing a brand new laptop to every vendor and contractor that walks through your front door?

BYOD is a short sighted, stupid idea thought up by someone who sure as hell has no experience with I/T support.

Spoken like a grunt with no management experience that didn't think things through. :)

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Could you tell a bit more, please? What are use cases for those BYOD devices, what kinds of data and applications they're used for?

The primary BYOD users are a global sales force and executive staff. The core applications are email and calendar, which is pretty typical. I'd guess something close to 100% use those two. Other deployed applications are VDI, IM/presence, VoIP, sales process, commissions visibility, and expenses. Android and iOS have the most support, and new stuff generally launches on iOS first and Android second. Blackberry is supported, but I don't know what the story is with the various flavors of mobile Microsoft platforms. Could be we support them, I've never been interested enough to look.

We publish white papers on our BYOD deployment and have detailed statistics about what kinds of devices are being used and their growth rates. It's interesting stuff. I don't want to get more specific than that because we also manufacture things that could be used in a BYOD solution, and I don't want anyone to think I'm shilling or astroturfing.

So what you're saying is that any number of those 25,000 employees could be sniffing the email and/or other network traffic and siphoning that off to someone else, and you have absolutely no way of detecting (or preventing) it from happening.
In some situations BYOD is not such a bad idea: The business doesn't have to pay for the equipment, it comes out of the wallets of the workers. They get to use whatever they want, and possibly get a tax write-off as a business expense to boot. From a security standpoint it can be a nightmare, and throwing out accusations like "you just suck at security" doesn't make them go away.

Re:BYOD means I/T loses some control over it

[Vlado]

BYOD is a stupid idea?
No IT support experience?

Tell me something then: how do all the websites survive? How does the e-banking survive? It's designed on BYOD concept from the get-go.

And before you say anything about web apps, I don't expect every application to be web-enabled. But I DO expect it to work for me from everywhere and on pretty much any device that I have available to me, at any given time.

I work in company that has a majority of users who travel globally on a daily basis. We're expected to both consume and produce intellectual property securely and constantly (even while we travel). Our work devices have to be our private devices as well, otherwise we would die of boredom on long trips or would have to carry two of each.

In my particular branch office we have zero IT support/admin guys. At the same time we have pretty much zero IT support issues that are not actually caused BY the IT department (email server going offline 2 or 3 times a year). And we're not all IT pros. We have our share of office administrators and so on who are proficient in Excel, Word and web-app usage but no more. But guess what: they don't have problems. Things work, because they're set-up so that they work.

And yes: our network is not 100% secure. It's secure enough. But on the other hand, no network is 100% secure. Just the other day there was report here about Chinese hackers stealing F-16, Aegis and whatnot blueprints from "secure" governmental networks. The thing is that we make sure that the due-diligence is observed. Employees understand which data is important and secure it additionally to prevent it's leakage in a reasonable way. At the same time we don't get our panties in a bunch about security being more important than the work that we have to do.

BYOD rocks!

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

I just got done reading the new corporate policy on BYOD that just came out for review. It basically gives the company the right to have space on your phone and you the right to pay for the HW, the access contract and any other expenses associated with the phone. Reimbursement for the use of your phone is optional for your BU and the company gets to tell you if you are allowed to upgrade the device in the future.

Smartphone support here already sucked waz so having 100 different pieces of marginally supported HW won't change that much. The company just doesn't have to pay for the device they abuse you with after hours anymore. When I was asked if I wanted to be in the BYOD pilot I told them politely that if they wanted me to carry a phone 24/7 they could pay for it. They didn't feel it was important enough to get me a phone so I didn't feel inclined to let them screw with my phone.

Re:BYOD means I/T loses some control over it

[Methuseus]

And this is why BYOD isn't accepted many places. I deal with HIPAA. BYOD is a big no-no with that in most cases.

Re:BYOD means I/T loses some control over it

[war4peace]

In this case, the employee did something against the Internal company Procedures (HR, Software Usage, Security, etc). In other words, it's called theft and they deserve the punishment handed to them.

Re:BYOD means I/T loses some control over it

[akpak]

No it's not. If you BYOD, you'll likely get nothing at all in terms of hardware/service costs.

Re:BYOD means I/T loses some control over it

[Cederic]

A proxy never works for HTTPS, you're always going to be doing MITM.

The web proxy server at my previous company, and my current one, both do MITM attacks against HTTPS traffic. If you're using the default desktop browser you don't see this as they've added their own certificate authority to the default browser install.

I use my own browser, and I get informed of invalid certificates on every HTTPS connection I make. Shrug, it's their network; if it's that sensitive I'll use my own network.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Sure you do. Riiiiiiiiight. Welcome to /., where there's always someone with an anecdote, no matter how absurd.

Re:BYOD means I/T loses some control over it

[fostware]

Schools.

Duty of Care requires the school to at least *try* to block porn at school.

If they did nothing it'd be like a chip to seagulls when it hits the lawyers...

Re:BYOD means I/T loses some control over it

[fostware]

MagicJellyBean says I can get the keys without asking IT...

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

From the personal side, it means being on the clock continuously without additional pay. It means additional personal liability. It means if something goes wrong at work the powers that be can brick your phone. It means that your boss or peers are always watching, sometimes expecting you to reply to emails at all hours or work on reports over the weekend.

Then you are the tool. Early on in my jobs where cell phones were common (I've been around long enough to have worked before they were widespread), I've taken a Summer vacation to where "I cannot be reached". Either remote Canada, hiking in New Mexico, Mississippi (at the time had nonexistent cell coverage), where no one could contact me. That, and the fact that I don't answer my cell phone after hours has trained my superiors to know that they cannot reach me after hours. Oh, some have shouted and ranted about it, but I've never wavered (and also never been fired because of it).

Train your managers that your personal time is just that -- your personal time, not theirs. They don't pay you for it.

Re:BYOD means I/T loses some control over it

[Specter]

I notice that you don't list an MDM in your deployed applications. For email, how are you dealing with lost devices?

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

You'd want MITM to control what people are doing on sites. Want to download from dropbox? No problem! Want to upload a file? Nope, sorry, denied.

Re:BYOD means I/T loses some control over it

[hobarrera]

Those same kids that use their cell phones at school have 3g/4g, so they still have perfect access to porn.
They probably have internet at home as well.

Re:BYOD means I/T loses some control over it

[Specter]

"Why do I also have to give YOU control over it?"

Because you want to put your corporation's data on it. It's completely reasonable for your employer to require that you take the steps necessary to protect data that they're letting you have access to.

Re:BYOD means I/T loses some control over it

[gd2shoe]

Not misparsed. That would imply the source text obeys the target grammar.

Thanks, though. I'm glad someone could interpret that. There's so much bad punctuation on the Internet that one must frequently guess what the punctuation ought to be. I just got it wrong this time.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Except when IT refuse to run an NTP server because they don't see the point (and then complain that they have lost an hour of their life that they'll never get back after the meeting discussing why it is critical to so many projects) it is hard to look at them as trusted advisers. Or when they claim that IE7 on 2k3 is secure and that there is no way anyone from IT with a clue about security would run Chrome. Or when when the local proxy is under-performing (refusing incoming connections) to use another proxy - except the WAN firewalls ban this. Or taking three weeks to install critical software that is required for a project that only lasts two weeks. Or demanding that only HP enterprise SSDs are used (at ridiculous cost - we recently paid ~£2000 for two small disks) when very cheap alternatives would suffice (scratch space for CI builds where failure is tolerated and even expected). Or taking 3 years to design a solution that didn't meet the original requirements, let alone the ones that were then required when they delivered the design (which was of course rejected). Or taking over 2 years to install servers, followed by another 6 months to commission them, by which time they only had 6 months of "deemed service life" left so were not appropriate to deploy new systems onto and were then decommissioned immediately and the process started again.

All real examples over the last few years.

Oh, and FWIW nobody looks up to the HR dept or the legal depts either. One day I might find an organisation that focuses on value rather than cost...

Re:BYOD means I/T loses some control over it

[gd2shoe]

Typically, everything under "--" is a signature. The signature is a snippet of text that the user chooses in advance and rarely has anything directly to do with the specific post it is attached to.

Yeah, I got that moron. Signatures are occasionally declarations of what a poster intends to do on the forum. A .sig like that could easily be a declaration that someone is going to start trolling for or against a "minority" group.

Also, someone with such as weak grasp of English as to not recognize the phrase "yes man/men" should not offer advice as to what constitutes a badly formed joke.

"Yes, men..." is a far more common phrase to start a sentence than "Yes-men". I took a left instead of a right. Sue me.

"Weak grasp of English"? Really? Maybe you're constantly surrounded by people who use the phrase "yes-men" all day long... but most of us aren't. Aside from particular business interactions, it really isn't a very common phrase. On the other hand, all of us ask questions. "Yes" is one of the two most common answers, and frequently starts sentences. Yes, that means it was an easy mistake to make.

Re: BYOD means I/T loses some control over it

[Hognoxious]

It's probably his responsibility if it goes pear-shaped, so wanting control is hardly unreasonable.

Re: BYOD means I/T loses some control over it

[Hognoxious]

Meh. If they were even smarter than that they'd have framed him for kiddy porn or - if they wanted to be real bastards - copyright infringement.

Re:BYOD means I/T loses some control over it

[gd2shoe]

Actually, the hyphen is non-optional. Hyphens prevent ambiguity.

(Yes, there was no comma there. It's the Internet. Commas are frequently treated as optional. Hyphens too, apparently.)

Re:BYOD means I/T loses some control over it

[fostware]

You missed the point... it's not somebody thinking of the kids. It's so school legal can say "won't somebody think of the kids, because we did our best" and deny parents financial recourse.
Once the kids surf porn via 3G it's a pastoral care issue, and responsibility can be shared with the parents or guardians.
"Those" kids also end up usually blowing their data plan which then becomes the financial issue for the carers.

Re:BYOD means I/T loses some control over it

[Trogre]

Yep, I've had customers insist they don't need to worry about antivirus, etc. on their workstations because they have a company policy that no one plugs unauthorised kit into the network. A few weeks later they invariably get an infection because one of the directors ignored policy and plugged his personal laptop in - afterall, who's going to tell the director off?

802.1x for all network access would fix that.

Re:BYOD means I/T loses some control over it

[Hognoxious]

You claim to be a developer, so you ought to know what you're doing. Still, there's no harm in getting everything checked. it's not like you need to install a new IDE three times a day.

But those twats from marketing? I'm not sure how you'd educate them. They know everything already.

Re:BYOD means I/T loses some control over it

[Hognoxious]

And the parents can blame (or sue) the school over those because...?

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

What the fuck is I divided by T? Perhaps you meant I OR T?

Re: BYOD means I/T loses some control over it

[Rakarra]

The technically adept people (read R&D dept) are the bane of our existence, as they constantly need changes made / make changes without consulting us.

Only because you insist on having control.

If you're there to take the fall without having control over your work, then that job has a disfunctional design at that company.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

Sure you do. Riiiiiiiiight. Welcome to /., where there's always someone with an anecdote, no matter how absurd.

http://media.www1.good.com/documents/Good_Data_BYOD_2011.pdf

"Companies already supporting BYOD policies tended to be largetoverylarge enterprises on average, with 81 percent having more than 2,000 employees, nearly 60 percent having more than 5,000 employees, and 35 percent having more than 10,000 employees."

Re:BYOD means I/T loses some control over it

[hobarrera]

If my employer doesn't trust me with sensitive data (which I need for my own work), then they should not keep me their employee.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Correction, Accountants do not MAKE the company any money,they only keep track of where it goes and they are often the ones that require the triplicate form and cost code.

IT, like Accounting/Finance, HR, and Legal, are support of the Operations of the company.

On the other side most company's processes are so messed up that they would benefit from a custom information system that would alleviate them from having a lot of the staff that cause the security issues. Anybody that need to generate reports for a boss is a prime example of a place that does not have the proper systems in place to manage their information. Do Six Sigma first, then code a system to handle the flow. Workers are data entry, managers are data consumers.

Re:BYOD means I/T loses some control over it

[the_B0fh]

Why? What's the security risk with an Apple TV? Especially if it's set up on the guest network that doesn't touch anything inside the network?

Re:BYOD means I/T loses some control over it

[AK Marc]

Not if it's locking your fence when you have no gate on your driveway.

Re:BYOD means I/T loses some control over it

[Skuld-Chan]

Hardly... You can browse any site you like on our network (porn, pirate sites etc) you'll just be missing a ton of inline ads.

Get infected? We have sensors setup to jail your mac address/port.

News flash...

[fuzzyfuzzyfungus]

In case our good buddy Brian missed the past couple of decades, nothing is simple about 'ownership' in our delightful brave new world of digital devices...(even if we might want it to be)

"Licensed not sold", DRM in all its myriad permutations, encrypted bootloaders, SIM-locked cell modems, systems that phone home faster(and in much greater detail), than ET, activesync policies that give IT the ability to nuke your phone if you want to connect to your email, all the good stuff.

Even in his article, purporting to be all progressive and whatnot about recognizing 'ownership, he says "The good news is that plenty of tools allow you to isolate all your business data from employees' personal data. Those tools can let you wipe business data from their devices without touching their photos and private emails." This is, in effect, a polite way of saying that "There are plenty of tools that allow you to gain control over a slice of somebody else's device in a way sufficiently robust to keep them from messing with that slice'.

Above and beyond all the usual amusements of negotiations between dubiously equal parties, contemporary computers offer ample power to enforce restrictions of virtually arbitrary complexity over what we quaintly pretend that you 'own'.

Re:News flash...

[Anonymous Coward]

For those of us that's not Windows users thats Solaris Zones/Containers or Linux Namespaces/SELinux in a nutshell. Or software partitioning, kernel virtualization and many other names/labels.

Re:News flash...

[fuzzyfuzzyfungus]

For those of us that's not Windows users thats Solaris Zones/Containers or Linux Namespaces/SELinux in a nutshell. Or software partitioning, kernel virtualization and many other names/labels.

You are missing the relevant bit: All those partitioning technologies, right back to when LPARs crawled out of the primordial mainframe at the dawn of time, let the owner of the system do whatever they want to the subordinate partitions/zones/containers/etc. The system protects the subordinate containers from one another; but not from the entity at the top of the pyramid.

If you are on a system with a partition you can't look into, that's a very good sign that you aren't the owner.

Leased

[Anonymous Coward]

It's your device, and you own it.

Not if it's running an Apple or Microsoft OS.

Re:Leased

[Anonymous Coward]

Read the EULA. You don't own the OS.

Re:Leased

[Anonymous Coward]

Get a new phone, and then try to port it to another carrier. Its leased in they sense you pay, but the carrier "owns" it.

Re:Leased

[stoborrobots]

The concept of "leasing" vs "ownership" is not one of whether you're paying every month or not - it's about whether you have legal control over the asset. If you paid the entire cost of leasing a house up front, that doesn't mean that you own it.

A leased asset is yours to use, because another entity continues to permit you to use it, however they may revoke your permission to use it at any time. They have the legal control over the asset, you get to use it because they allow you to use it as long as you play by their rules (which may or may not involve repeatedly paying them money).

When someone else says "you can use an iPhone, as long as you don't install Cydia or other unapproved software on it, and if you do, we reserve the right to remotely disable it", that's indicating that they have the control, and dictate the terms under which you use your device.

Re:Leased

[arth1]

Get a new phone, and then try to port it to another carrier. Its leased in they sense you pay, but the carrier "owns" it.

None of the mobile phones I've owned have ever been locked to a carrier. Why anyone would buy a locked and usually crippled phone, commit to a long term contract and end up paying 50-100% more for the phone in the long run boggles the mind. It's like buying eyeglasses from the eye doctor - you know you're going to overpay and only get to choose from a few models, so why do it?

Re:Leased

[armanox]

You're not in the US, are you? Choice doesn't really exist.

Re:Leased

[arth1]

You're not in the US, are you? Choice doesn't really exist.

I am indeed in the US. Choice exists, but most people here are ignorant, including those who sell services - I've had to escalate on at least two occasions to find someone who even knew about the unadvertised BYOP plans.

For about four years, I paid $19.95 a month for a plan with unlimited data, because I brought my own phone. Which also allowed sideloading, bluetooth data, music downloads and everything that the provider's own phones were locked from doing. Win all around.

Yeah? Hidden?

[magic maverick]

I'm pretty sure that's what a lot of people here on /. have been saying about "bring your own device". You know, "it's mine, and I don't want corp. IT to tell me how to use it, or what software to have on it, or to be able to remotely delete everything on it". And, "why should I have to pay for company equipment? If it's for work, they can pay".

Gee, who'd'a' thunk it?

In other news, a smug Linux user commented that Linux doesn't crash nearly as often as M$ Windoze does. And, moreover, the GIMP is a more than sufficient replacement for Photoshop for most casual users.

Re:Yeah? Hidden?

[Anonymous Coward]

yawn

Damn kids need to get off my lawn!!

Re:Yeah? Hidden?

[jeauxkewl]

I would mod this up if I had points. This came home to roost with me just this week. I started a contract gig for one of the O&G supermajors whose new contractor policy is BYOD and they use a vmware/mokafive VM to give you access. So here I am, doing the same work their employees are doing with powerful dedicated machines and multiple displays on my laptop running a Win7 VM on top of Win7 (see: splitting resources) because said company is too tight to provide tools to do the job. I guess it's not a problem if it takes me longer to read the fine print or manage issues as I'm on their very generous hourly rate but I'll be damned if I'm gonna drag my dock and 24" displays to the office. Sure, VM makes sense to them from a cost perspective (no capital for workstations) but the cost savings end there. Another clear case where bean counters rule.

Re:Yeah? Hidden?

[Ironhandx]

Especially when workstations are so cheap these days. On bulk purchases you can get quad core workstations with dual displays for under $500 fully provisioned...

BYOD - Borrow Your Office Data

[Anonymous Coward]

Great circular rant with no intelligent point. Thanks for the "simple take" Brian. Way to gloss over information security and system compatibility by repeating the same non-sensical bullshit for a whole page.

Umm no.

[TobinLathrop]

Or maybe it is because I work at place with SOX/HIPAA/DOD/etc requirements. Even though I am vendor I have to use the customer supplied device as I admin their servers and thats what security will allow for me to do my work. I don't have admin rights on the supplied laptop itself and everything is whitelisted to run.
Every time I hear about this at least from my side of the fence of IT support I just think of the support and security nightmares. Also if the company wants me to install their stuff on my personal pc. well they can buy me one. Same goes for a phone. They need to call me as an employee they can provide a cell phone too.

BYOD means IT imagines less control over it

[crow]

No, BYOD means that IT still has no real control over the devices on the network, but now has to stop pretending that they ever did.

In an engineering environment, many of the locked-down MSWindows systems that are deployed are wiped by the users to install Linux. Other systems may be mostly locked down, but users will run their own systems in virtual machines. The network may have a nice secure firewall, but lots of users set up backdoors through their home VPN connections to bypass the tight web filters.

And then there are the Chinese hackers who have infiltrated the network.

Any company that relies on controlling the systems on their network for security is practicing security through imagination. A real security model has to assume that there will be issues at every level. BYOD may help force companies to recognize the need for comprehensive security, but it doesn't create the need.

Re:BYOD means IT imagines less control over it

[mysidia]

many of the locked-down MSWindows systems that are deployed are wiped by the users to install Linux. Other systems may be mostly locked down, but users will run their own systems in virtual machines. The network may have a nice secure firewall, but lots of users set up backdoors through their home VPN connections to bypass the tight web filters.

These are all things that can more or less be prevented or detected.

For starters... the implementation of 802.1X authentication of Windows computers, Network Access Protection

The other big one is a semi-deny by default webfilter policy; with a firewall device that validates the HTTP stream is actually HTTP (identification by protocol regardless of TCP/UDP port), allows access to only IP space on known web hosting providers, datacenters, and large Enterprises, but specifically doesn't allow connections to VPN services; and only allows HTTPS to specific known destinations.

VPN attempts can then be screened for and detected based on traffic anomolies: HTTP session duration and Download to Upload ratio.

Any session with a high Upload ratio sets off alarms, and gets blocked in a short period.

Re:BYOD means IT imagines less control over it

[tepples]

Then watch requests to whitelist particular web sites take up half the IT department's time.

Re:BYOD means IT imagines less control over it

[mysidia]

Then watch requests to whitelist particular web sites take up half the IT department's time.

Legitimate web sites would still generally get through, because they'd be categorized by a decent filter.

For those that don't.... require sufficient paperwork, that the user is doing most of the work, before a whitelisting request can be made.

Tier 1 tech: "You want us to allow you access to a site being blocked?" "OK; here, fill out this 3 page form, and sign here, here, and here, and have your supervisor sign here on page 2 and on page 3..."

Re:BYOD means IT imagines less control over it

[tepples]

Tier 1 tech: "You want us to allow you access to a site being blocked?" "OK; here, fill out this 3 page form, and sign here, here, and here, and have your supervisor sign here on page 2 and on page 3..."

Then watch requests to whitelist particular web sites take up half of everybody's time.

Re:BYOD means IT imagines less control over it

[mysidia]

Then watch requests to whitelist particular web sites take up half of everybody's time.

Then IT will be allocated 15 minutes a day to review whitelisting requests, and department managers' requests get priority.

Any requests that don't get handled within a week are rejected, and may be resubmitted in 15 days.

Re:BYOD means IT imagines less control over it

[vux984]

At least he's a 'job creator' :)

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

and.. you just have to run nat on the authenticated box.
you can even just use the same authentication credentials in linux on that box, if you want.
you can also make that box an access point, too.

As for ratios.. yea, if your users don't need internet, you can do that. Obviously its not going to fly at most places. Heck.. allow access only to some ip is the same. Might as well cut their internet access off.

Re:BYOD means IT imagines less control over it

[jrumney]

many of the locked-down MSWindows systems that are deployed are wiped by the users to install Linux. Other systems may be mostly locked down, but users will run their own systems in virtual machines. The network may have a nice secure firewall, but lots of users set up backdoors through their home VPN connections to bypass the tight web filters.

These are all things that can more or less be prevented or detected.

Which is what is wrong with IT. You can't see past your own policies to the fact that users have genuine business needs to use Linux on their laptops or in VMs, and those web filters you install to stop anything with *p?rn* in the URL are preventing access to sites that people need to access to do their work.

Instead of "OMG, people are bypassing our restrictions! How do we stop them?", your first response should be "why do they feel the need to do this, and how can we accommodate their business needs?".

Re:BYOD means IT imagines less control over it

[Eristone]

I had this problem with my parent company - Engineering and R & D would be trying to find coding examples and the sites they would end up trying to reach were flagged by the web filters as hacking sites or game sites (which they were a lot of times). The train of thought they were following would stop because it took days to get an approval for opening up a site. They finally said to heck with it and started using their phones as hot spots, plugged their computer into the corporate network and then used local route statements to define what went where - Internet traffic vs. corporate traffic (tech savvy developers).

The key for security is having it in such a fashion that people use that security vs. trying to work around it to get what they need.

Re:BYOD means IT imagines less control over it

[JDG1980]

Congratulations – you've now set up your IT department to be a universally hated roadblock. Don't look too surprised when they decide to outsource you to "the cloud".

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

Sounds like a government employee: Forgets he is in SERVICE of the people, not the freaking boss...

Re:BYOD means IT imagines less control over it

[mysidia]

Congratulations – you've now set up your IT department to be a universally hated roadblock.

It's not IT department that makes the decision about web filtering; it's information assurance/security department, that ultimately falls to an org's chief security officer: who should thoughtfully have some file folders full of of case studies showing where companies got hacked or sued as a result of employee surfing activity would be on hand to show anyone questioning the wisdom.

The approval requirements just go there, to demonstrate that the employee is not wasting business resources requesting a web site be opened up for personal or reasons not essential to the carrying out of the organization's mission.

It's just the outcome of deferring to the HR department for their guidance on ensuring that, which results in approval processes and requisite allocations of staff time.

And everyone knows you don't outsource security to the cloud, unless you want to get pwn3d.

Re:BYOD means IT imagines less control over it

[mysidia]

Engineering and R & D would be trying to find coding examples and the sites they would end up trying to reach were flagged by the web filters as hacking sites or game sites

See... I don't recommend that Enterprises use their web filters to block 'game sites' or 'hacking' sites.

I recommend that they used to block web traffic to pornography, overseas IP address space, Known VPN providers, and Cable/DSL/Dialup provider IP address ranges -- such as attempted connections to any IP address listed in the Spamhaus PBL or SORBS DUHL.

As well as attempts to access sites on foreign ccTLDs such as ".RU" or ".PW"; which are essentially guaranteed to be related to malware distribution

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

You are both dead wrong. These days users do not do anything to bypass stuff IT does. They call IT and if they don't comply, they QUIT.

Employers seem to be living in some kind of illusions that they are important ant that people should suck up to them in order to keep their jobs. That may be true when you are dealing with low level people that are not in high demand on the market. You can fire them and hire someone else. Try that with journalists, developers etc.

Re:BYOD means IT imagines less control over it

[JDG1980]

So your whole company is a giant bureaucratic clusterfuck. Got it.

Re:BYOD means IT imagines less control over it

[sithlord2]

In most companies, doing all this will just get you fired...

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

You are so much part of the problem that it isn't funny.

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

Sure, i'll just sit here doing nothing for the 15 days. When my boss asks whose fault it is I blame the IT and thei insane policies. Have fun.

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

You are assuming "a decent filter".
In the real world, due to Websense categories like "Freeware/Software download" I resort to installing work-related software at home in the evening.

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

Don't you see, it's doing boneheaded stuff like this that leads to people installing Linux on locked-down Windows machines, and plugging their laptops into their phone for EDGE access.

Re:BYOD means IT imagines less control over it

[Anonymous Coward]

It is called "the administration".

Re:BYOD means IT imagines less control over it

[mysidia]

Don't you see, it's doing boneheaded stuff like this that leads to people installing Linux on locked-down Windows machines, and plugging their laptops into their phone for EDGE access.

Windows itself is an existential security threat; therefore, people putting Linux there is not inherently a bad thing; so long as Linux is implemented on the workstation in a manner compliant with IT and IS policies, including the ones about privileged user access being strictly controlled by the organization.

Re:BYOD means IT imagines less control over it

[Jahta]

No, BYOD means that IT still has no real control over the devices on the network, but now has to stop pretending that they ever did.

I'm not sure why this was marked insightful. Where I work (a financial institution) there are strong network controls that not at all illusory. Connect an unknown device to the network and it gets instantly quarantined (and you get fired). Reformat your official device and install some other OS, it gets instantly quarantined (and you get fired).

Any company that relies on controlling the systems on their network for security is practicing security through imagination. A real security model has to assume that there will be issues at every level. BYOD may help force companies to recognize the need for comprehensive security, but it doesn't create the need.

It's true that there's no single magic bullet for security; defense in depth is the only way. But if you let employees connect random devices to your network it's already largely game over.

If we introduced BYOD the financial regulator would be all over us like a rash; some of our competitors have had serious and costly data breaches. All our portable devices have full disk encryption (and restricted networking options). 99.99% of all our end-user devices have removable media disabled; the .01% that can use removable media are heavily monitored. Even the data we use for internal system testing is tightly controlled. There's no way we would allow staff access sensitive corporate or customer information from an unmanaged device.

Re:BYOD means IT imagines less control over it

[Jahta]

So your whole company is a giant bureaucratic clusterfuck. Got it.

Sheesh, way to demonstrate a fundamental lack of understanding.

Apart from the obvious fact that your employer is paying to, you know, do some actual work and not spend your day goofing off on the web, there are other good reasons to restrict web access. The company could get sued if, for example, female co-workers see you surfing pr0n on a company computer and take a sexual harassment suit. Even better, if you are doing something illegal online, the company could face criminal charges for letting you do it on their time and dime.

So no, it's not a "giant bureaucratic clusterfuck"; it's commonsense business management.

BYOD means YOU pay for it, you support it

[Anonymous Coward]

That's why businesses like it.

Point = missed

[girlintraining]

Because you own the device, you have certain rights to what is on the device and what you can do with the device. This is the crux of every issue that comes with BYOD programs.'"

Okay, let me make this simple; You're in IT security. Let's say you just threw open the doors and let anyone bring their own laptop in to work. Well, you know, and I know, that people are stupid. They're going to be infected with malware, viruses, APTs, and god only knows what. And that's the point: You don't know what's being brought in. You have no control now. And let's say as a result of someone doing this, they pass on a piece of malware, not to your super-secure corporate systems, but to another employee who's also brought in their own device.

Who's legally at fault here: The employee who accidentally (or neglegently!) brought in an infected laptop, the other employee who connected their own laptop and accidentally (or neglegently!) got it infected... or the company whose network policy facilitated this? And here's a better question: Who do you think both employees are going to sue, thus costing your company millions in unrecoverable legal fees (even if you win, you ain't going to see that money again).

Ownership here is indeed the issue; Just not device ownership. Specifically, the cost of ownership; which if you allow this stuff on your network, the cost of owning that network is going to rise due to incidental costs. How much, nobody knows for sure -- this is still a relatively new thing (in the business world anything less than 10 years old is 'new').

Re:Point = missed

[TENTH SHOW JAM]

How about you set some standards?

I $user in connecting my device you your $companies network, do swear and aver that
* My antivirus software is paid for and up to date.
* My device (to the best of my knowledge) is patched and up to date.
* Assume all risks to the IT system that are traced to me to a value of $20 M
* Will follow IT policies and procedures (and not look at porn at work) while device is connected.
* (insert whatever you want here)

Risk of infected laptop has now been transferred to the device owner.

Re:Point = missed

[Anonymous Coward]

and the device owners go for this because....

Re:Point = missed

[tepples]

My antivirus software is paid for

Are you referring specifically to the fact that Microsoft Security Essentials runs only on the first ten PCs in an organization and that a lot of the freeware Windows AVs likewise have policies against business use? And what antivirus do you recommend for an Ubuntu installation that I keep patched?

Re:Point = missed

[techno-vampire]

And what antivirus do you recommend for an Ubuntu installation that I keep patched?

ClamAV. Not because you need it to protect your own computer but because having installed and running kills two birds with the same stone. First, of course, it allows you to say that you've got AV software installed and running. Second, it will (or should, at least) catch any infected files that you're co-workers send you before you pass them on to somebody else who might get infected by them.

Re:Point = missed

[stephanruby]

Who do you think both employees are going to sue, thus costing your company millions in unrecoverable legal fees (even if you win, you ain't going to see that money again).

Millions? That's a little much. Were their laptops even worth that much?

And has this actually happened? The legal system in the US is bad enough, we don't need to start making up new scary stories about it.

Re:Point = missed

[arth1]

ClamAV. Not because you need it to protect your own computer but because having installed and running kills two birds with the same stone.

Yep. RAM and CPU.

Re:Point = missed

[armanox]

Last I checked Avira had a Linux client

Re:Point = missed

[Anonymous Coward]

You can't impose a $20 million liability on someone for some set of circumstances, possibly not their legal responsibility, just by getting them to agree to it. Employment law does not work that way.

Re:Point = missed

[drinkypoo]

ClamAV has no on-access component last I looked, and even if it did you could disable it if you're not worried about infection of the host system. You can run it on a schedule during a lull, like dog intended.

Re:Point = missed

[Anonymous Coward]

And when your customers lose control of their accounts through identity theft, or your tech is stolen by China, you can point to your user agreement and go, "See? That's all taken care of."

"BYOD" -Define your damned acronyms in the summary

[Anonymous Coward]

And not just with a link. No, this is not a well known acronym yet.

what about disasters from BYOD

[Joe_Dragon]

what about disasters from BYOD can you bill some for damage with little to no proof? can you make some go out buy some thing new right after they just go some due to change requirements and so no? What some who is not very technically informed goes and get's the best buy special POS and who fixes that mess?

and if they go the way of making employees pay out of pocket for a specific device and subject it to complete IT control so that no personal apps or data could be used on it. This is akin to not only buying your uniform from only this supplier, but also ensuring it is kept clean and pressed and not only but based on the cost and labor laws that can pull some under min wage for that pay period and in other places it may fall under Business Expenses.

Also you can be hit with same laws even if not as locked down / you must use this system.

Re:what about disasters from BYOD

[Joe_Dragon]

what about disasters from BYOD?

Can you bill some for damage with little to no proof? Can you make some go out buy a new system new right after they just got one due to changes in requirements ? What some who is not very technically informed goes and get's the best buy special POS and who fixes that mess?

and if they go the way of making employees pay out of pocket for a specific device and subject it to complete IT control so that no personal apps or data could be used on it. This is akin to not only buying your uniform from only this supplier, but also ensuring it is kept clean and pressed and not only but based on the cost and labor laws that can pull some under min wage for that pay period and in other places it may fall under Business Expenses.

Also you can be hit with same laws even if not as locked down / you must use this system.

Re:what about disasters from BYOD

[KingMotley]

That is not english.

what about disasters from BYOD?

What should be capitalized.

Can you bill some for damage with little to no proof? Can you make some go out buy a new system new right after they just got one due to changes in requirements ? What some who is not very technically informed goes and get's the best buy special POS and who fixes that mess?

Can you bill some(one/thing/where?) for damage, with little to no proof? Can you make some(one/thing/where?) go out (and) buy a new system right after they just got one due to changes in requirements? What some(one/thing/where?) who is not very technically informed (I give up, this sentence is just a bunch of random phrases tossed together with no conjunctions).

Re:what about disasters from BYOD

[Anonymous Coward]

f they go the way of making employees pay out of pocket for a specific device and subject it to complete IT control so that no personal apps or data could be used on it.

then we're not talking about BYOD, the OD in that is 'own device', If it controls then practically speaking IT is the owner, even if the employee payed for it

and quite frankly anyone agreeing to personally pay for a device that will then be under complete of your workplace is a freaking slave

Re:what about disasters from BYOD

[Anonymous Coward]

It's very simple, it's their device you can't make them do anything on it.Nor can you make them go out and buy a new system.

if your IT works with their device, great you didn't have to buy it and they can do their work.
if not, then it's up to you to make sure they get the tools needed to do their job. If that means providing them with gear, then you'll have to provide them with gear.

Re:what about disasters from BYOD

[Anonymous Coward]

You're wasting your time. Joe_Dragon is illiterate and uncomprehending.

Your device, their data

[DigiShaman]

The problem with BYOD is that users often want access to corporate data. But companies have a right, no, make that a duty to protect their own data. The problem is that in order to do that, the company has to have some control of your hardware. Mainly with regards to encryption and holding the keys from you. Again, your device, their data. And that's often the point of contention between staff and IT personnel.

Re:Your device, their data

[Anonymous Coward]

Wrong - if it's my device, then I control it to the fullest extent possible. If the company wants me to have access to their data on the move, then *they* have to provide whatever device is suitable, which they can own if they want to (or rent, lease, give away whatever is their fancy), and I'll be happy to comply with their rules.

Re:Your device, their data

[fermion]

And the solution is to go back to the good old days when corporate controlled data and user only had terminal access. This with todays technology this is not so hard to do. User devices are display only. All storage and processing is done on IT controlled servers. The average worker bee does not need a high end PC, and has not needed one for years. At least not for work. It has been a perk that companies supplied a PC that could also be used for entertainment purposes.

The real downside, to me, is support. If a user device is not working, then no work will get done. This means that the firm has to fix the device or lose productively. This is not such a big deal because modern devices, especially non-MS Window devices, are very reliable.

Re:Your device, their data

[bdwebb]

If the terms of your employment are that you BYOD and comply with company security policies then you do that or you don't have a job. I'm not saying you're wrong...I also believe they should be responsible for providing you with a company resource to comply with security policies. In fact, almost every company with a BYOD policy actually does do this and BYOD is simply a policy that allows users to work in a more convenient fashion with their own equipment.

Almost every BYOD policy I've seen implemented is due to complaints about not being able to get on the corporate network with their iPad or connect to the corporate network with their personal laptop via VPN. In the case where users want that access, it is up to the company to either allow it and enforce security on those BYOD devices just like they are company resources or to disallow them entirely and tell the personnel to eat it. All the BYOD policies I've ever seen that require a user provide their own equipment operate through Virtual Desktops anyway so there are no strict compliance rulesets for the devices people use..just simply that they have web browser access and can install a Citrix agent or something along those lines.

Re:Your device, their data

[Mr. Freeman]

That is EXACTLY HIS POINT!

The problem is that many users demand both that they be able to use their own device and that they be allowed to access company data on their device. If they were demanding one or the other, it wouldn't be such an issue.

Re:Your device, their data

[JDG1980]

If the terms of your employment are that you BYOD and comply with company security policies then you do that or you don't have a job.

Those terms of employment may violate labor law. Forcing employees to buy their own workplace equipment is generally not permitted.

Re:Your device, their data

[RabidReindeer]

If the terms of your employment are that you BYOD and comply with company security policies then you do that or you don't have a job.

Those terms of employment may violate labor law. Forcing employees to buy their own workplace equipment is generally not permitted.

I wouldn't take that as a blanket statement. There is a place on the US Form individual Income Tax return specifically to allow people to deduct unreimbursed business expenses, including equipment and supplies.

What an an employer can or cannot demand is subject in large part to local restrictions, so it's best to consult a lawyer if there is reason to make an issue of it.

Indeed

[Anonymous Coward]

That's it right there.. It's your device.... you control it..

Well since that is such a big issue for you, Since I control the network, I guess you WONT be bringing your own device and using it at work.
Chew on that ......

Re:Indeed

[JDG1980]

Well since that is such a big issue for you, Since I control the network, I guess you WONT be bringing your own device and using it at work. Chew on that ......

You're fired.
Signed, Your CEO

Re:Indeed

[mjwalshe]

in 95% of companies the CEO is just another employee

Brian doesn't have a fricking clue.

[Chas]

"It should be about enablement"

Spoken from the self-entitled end-user's perspective!

Sorry, but it IS about control. Control of company data. Security of company data. Compliance with various laws such as HIPAA, SOX, etc.

No sane company WILLINGLY bends over and spreads by giving unfettered access to their dearly bought client and company data.

I've dealt with numerous clients over the years who've been suing former employees for data theft. And they TOOK precautions!

And you're telling me I should let someone walk around with uncontrolled access to a multi-million dollar client list, documents, etc, in their pocket?

FUCK YOU!

Re:Brian doesn't have a fricking clue.

[iggymanz]

you have some misconceptions. Enterprise software can manage the access of data on the device: requiring device have password lock, separation of client and company data, wiping of the device by the company if stolen (yes, employees made to sign agreement). All this can be done on Android, iPhone, Blackberrry

Re:Brian doesn't have a fricking clue.

[iggymanz]

also should mention my employer actually will buy the device for the employee, it is the employee's property and yet they pay the bill each month, HOWEVER note the agreement the company can wipe the device upon termination, theft of device or any other reason.

Re: Brian doesn't have a fricking clue.

[Anonymous Coward]

You missed the part in the article where laughing boy is deriding security in the name of unfettered access.

Re:Brian doesn't have a fricking clue.

[JDG1980]

Spoken from the self-entitled end-user's perspective!

You do realize that the end-users are why we have jobs, right? As IT, our job is to make their jobs easier and more productive. You forget that at your peril. Once you start acting like Mordrac The Preventer, other people in the company will start looking for ways to get rid of you.

And you're telling me I should let someone walk around with uncontrolled access to a multi-million dollar client list, documents, etc, in their pocket?

If they have access to that list on their device, it doesn't matter if you control the device or not. Nothing stops them from emailing the list to an outside address they control, or copying it into a notepad file and saving it to a thumb-drive, or, if all else fails, just writing the damn list down on a piece of paper. Maybe if you're in a super-secure military installation where all this stuff is locked down, that might stop them (or maybe not – see the recent article about the Chinese hacking into U.S. military aircraft plans). But in a normal business environment, the remedies against someone walking off with your confidential data are legal, not technical.

Rights?

[Anonymous Coward]

You have no rights if you connect to my network and i get to control your device 100%. Sorry, it has to be that way for all our security. If you don't like it ( hey, i don't either.. ), not a problem, just don't connect YOUR device to my network and accept a corporate device.

Completely misses the point

[Anonymous Coward]

There are many things involved here:

- The fact that a discovery and hold data order may mean the company needs to grab the user's notebook (and depending on the jurisdiction possibly provide them with another one.
- The lack of a solid hardware break fix plan for "whatever crap" the user brings in. Is it depot instead of onsite? Is it even under an plan?
- How does the crap notebook from Best Buy work with existing docking solutions and provide dual monitor support and fit with the corporate ergonomics mandate?
- Heck, how can the user even load the coporate ergonomic software - let alone any other corporate software on the device. Many times the ownership issue is exactly the licensing boundary.
- How does IT support the failed app installs due to some crazy setup?
- How does that home system work with our Smart Card mandate for logon?

There are a lot more. In fact, most large companies IT departments will simply punt and force all corporate data access and applications to go through a VDI and use the user's BYOD device as a dumb display terminal when faced with BYOD.

It is about ownership. Please. If only it was just about that this would be easy.

Re:Completely misses the point

[jedidiah]

> - Heck, how can the user even load the coporate ergonomic software

That's not a bug. That's a feature. That kind of crap is why end users want to control their own devices to begin with. The employer provided devices are all crap. It's because of nonsense like "corporate ergonomic software".

The PCs they give you in "enterprise" environments are one of the biggest reasons to avoid "enterprise" environments in general.

Re:Completely misses the point

[Todd Knarr]

Well,

Discovery: there's legal issues there, yes, but there's also the fact that it's not your property that the data's on anymore. With physical documents a discovery order for the company doesn't give the company the right to come in and search my home for documents that might relate. Why should it be any different for electronic documents? The pattern should be that of any other case: the company responds that some of those documents are not under their control and supplies the contact information of the people who do control the documents.

Break/fix plan: not the company's problem. It's my device, fixing it is my job. And frankly I build stuff so my break/fix plan is "Buy a replacement.". I try to design things so I can hit Fry's and get replacement parts if it's really an emergency, mostly that means I'm down for an hour or three depending on which one I have to go to.

Exising desks etc.: again not the company's problem. I shouldn't need a docking station just to plug in a power cord and Ethernet cable, and the monitors should be using standard VGA/DVI/HDMI connectors.

Corporate software: this should've been dealt with before you started a BYOD program. If you require software that's got complex licensing requirements, figure out how you're going to let users use it first.

Failed app installs: this mostly shouldn't be a problem unless your apps have some really hairy dependencies. Despite this being a common scare tactic, I've rarely run into situations where an app wouldn't install because of some complex interaction with a personal setup. Most often it's because of stupidity like "We designed it to only work with one specific patch level of Java 1.5, and the user's got current Java 7 installed.". Often it ends up being the corporate developers who created that problem. For example that Java app before would run just fine in current Java 7, the only problem was that the corporate developers deliberately set the configuration to refuse to run except with that one specific patchlevel of one specific version of Java. Take that restriction out and presto, app works perfectly.

Smart Card mandate: again this is something the company ought to be working out beforehand. Remember that when you want to use someone else's equipment you can't always mandate what it has to be capable of or how it must operate. You either deal with this up front, or you acknowledge that the company needs to own the equipment which means it's not going to be BYOD.

The big problem seems to be that companies want to have employees paying for and owning the equipment, but want to treat that equipment as if the company owned it. The company needs to change it's attitude if it wants to use BYOD, design things to not require the company to own and control the equipment. It's not like it's a big deal, it's not like Oracle or Adobe or Intuit or Blizzard or any other software publisher hasn't had to figure out how to make their software live and work on machines they have no control over. If they can do it, I'm positive the problem isn't insoluble.

Re:Completely misses the point

[LDAPMAN]

Discovery only applies to data you control. Once it's on an employee owned device the company has no obligation to produce the data. The court then needs to go after the user directly if they want that. Note that there are exceptions for company officers.

Re:Completely misses the point

[Anonymous Coward]

yeah, that's because they're not Personal Computers, but Corporate Appliances in a desktop or laptop formfactor.

Taxes

[macemoneta]

I'm sure that eventually someone will realize that companies are deriving a benefit from an asset they don't own (not on their books), and thus should be paying tax and or compensation.

Re:Taxes

[Anonymous Coward]

I hear you, but I fear it will be the other way around. Tax authorities will start to claim that since employees provide (rent) their devices against a payment (some percentage of salary, perhaps), the employees will end up paying some form of additional income taxes. Mind you, companies can offset all cost they expend, including the software and staff they soley require to make use of BYODs.

BUY not BRING

[Anonymous Coward]

Companies like BYOD because they suddenly don't have to pay the bill for the hardware and the data plan (or whatever).

You also lose rights on your device

[cyberspittle]

If there is company property on your device, they have every right to it. Not as good as it seems.

Re:You also lose rights on your device

[Anonymous Coward]

does that go the other way, too? if the company has one
of my documents on their machine, do i own it?

Re:You also lose rights on your device

[armanox]

Read you're company's policies, or speak to HR or a company officer. I'm sure they'll be able to answer that for you (and the answer is usually, no, it doesn't go the other way).

BYOD moves between work and home

[Hentes]

BYODs move between work and home thus transferring sensitive information out and moving viruses in.

Not really it isnt yours.

[Anonymous Coward]

When you use it on company property on company time for company work you are doing then you need to abide by their rules and when following those rules essentially it is not yours.

Its no different than having to buy your own clothes that meet your companies standards. Sure you can have mustard stains on them, if you are a business guy you have to tuck in your shirt, not wash them and spill coffee on them but when you are at work those things are not acceptable to company standards. Yes you bought the clothes but you are still required to keep them a certain way for work.

If they didn't control the device you bring in atleast somewhat then the offices would get flooded with Trojans from retards that cant maintain their device, or people just automatically assume they can take whatever company data home on their device.

So is it your device? Yes it is. Is it your device when using it on company time? No it is not because your ass belong to your employer when on their time body and device and if you don't like it then quit your job because there a ton of people out there who would love to have a job.

What about risk of damage to your BYOD?

[Katan]

Think about the risk that has transferred over to your personal devices. You take ownership of a BYOD as your own, even if you receive a stipend for its purchase. So now a BYOD affects you personally, and not only the company. For example, if you work in an environment where your BYODs could be damaged. This could range from the basic (spilled coffee) to the extreme (working outside in a harsh environment). What if its cosmetic damage?

Obviously I have some personal experience in this. I took a BYOD (Macbook Retina) on a business trip, and we were making coax cables. My colleague dropped his end and the center conductor whipsawed onto my brand new screen, leaving a scratch. So now my supposedly best in class screen has a smiley face scratch on it. You could argue it is cosmetic. So how you handle this? I talked with my boss and it became clear that having a BYOD means accepting some liability. To be clear, my job is fairly office environment-esque, just general IT tasks for the most part. I use my laptop for email, programming, office suite etc. But I could see days where I need to bring it on a man-lift or in a harsh environment. Not a great prospect.

There are certainly extremes where you can expect some company liability, but it opens many questions about how determine if/when risk of BYOD damage is a customer issue.

I'm not going to spend this much money, stipend or not, and have it get all jacked up. I'm leaning towards letting the company carry the risk going forward...

BYO(Body)

[LionKimbro]

I can see an argument that a person's device is effectively part of their brain or their body.
I own it, I control it.
Also. Both my device and my body can catch a virus.

Perhaps the problem with BYOD is sick days.

UGGG!

[certain death]

I am waiting on the host file rant, at least it would break the cycle of it's mine, no, it's mine!! GAWD!!

Just say NO to BYOD

[canadian_right]

I would never use my personnel devices at work. One, if work wants me to have device xyz they can pay for it. Two, I like to keep my private and work life separate. Three, I've never worked for a company so insane that they actually thought BYOD was a good idea.

Re:Just say NO to BYOD

[Anonymous Coward]

I'll add four: I don't take work home with me. Why would I want any personal device with work crap on it?

cost of repairs and need to have a working device

[Anonymous Coward]

who is going to to replace it the same day when the device breaks, the screen gets damaged, the fan stops spinning, or it catches on fire? If its byod, and work needs to be done, the employee may not have the money on hand to deal with "fixing it" that day. if its not byod, it will replaced by the next morning. work can't stop because theres no funds available to fix your byod device.

Didn't read article, summary is ridiculous

[Luke has no name]

Of COURSE the problem is ownership! That's the first question every worker in my IT department asked when we got offered BYOD!

"So, if I can have company data on my phone (email), what are y'all doing to my phone? Oh, you're putting it in an encrypted sandbox? Oh, you're reserving the right to wipe that sandbox remotely (and possibly my entire phone)? Oh, you're not taking any liability for accidental wipes? Oh, you're not issuing a phone number that hides my personal cell (ala Google Voice/giving me a SIP address)?"

Ya, fuck that noise. Give me my crappy work-iPhone 5 that, rather than using native apps like the Blackberry I had, gets to use "GOOD for Enterprise" apps that don't integrate with the rest of the phone.

BYOD exists really for one reason ...

[Anonymous Coward]

By making people use hardware they own, the non-tech types break them dramatically less than when it is company owned.

We had an 80% reduction in sales people breaking laptops when we started making everyone use hardware they own (and have to replace when they break it).

Things don't get lost in airports, people don't carry them around by the screen like a jackass, etc ...

Let's have our cake

[Zeromous]

Look, where I am BYOD is totally OK. We are provided lots of options for secure OTG access and training to avoid breaches.

Here's my person opinion and what I advocate for in my work:
I support doing everything you can to isolate clients from servers- from data access to workflow/process. There is no reason this level of authentication cannot be implemented on BYOD as the next step. That said, BYOD is only sustainable long term if accompanied by a mature self-service support model. IT should provide the virtualized environment setup, but once it's on your device you are "on your own". Devices now are so homogeneous- soon it won't be an issue to support random/phones/tablets/PCs. Save money supporting on the front end, consolidate your back end and support the hell out of it. Companies should supply replacement and loaner hardware if they need to confiscate a user device, for say, legal reasons or company interests.

So missing the real point...

[Anonymous Coward]

The huge issue with BYOD is really simple. People are paid to work. This means that whatever device they're using has to work so they can do their jobs.

With BYOD, their device is potentially an unreliable piece of junk that the IT staff (who are responsible for keeping people working) has no control of, no experience with, and no idea how it's set up.

So when it fails, the IT staff are suddenly landed with a big turd that they have to get working RIGHT NOW because Joe Citizen needs to be able to work.

See the problem?

Die proxy servers

[tokiko]

Proxy servers are relic of a time before NAT. Please, please, please stop using this old hack to "share" your office Internet connection. If you want to prevent SMTP/FTP/IRC/etc traffic on your network, set up a proper firewall that blocks those port ranges. As you pointed out, using a proxy server in 2013 is going to give grief to anybody that has to touch it.

Re:Die proxy servers

[FireFury03]

Proxy servers are relic of a time before NAT. Please, please, please stop using this old hack to "share" your office Internet connection.

Thats not the purpose of a proxy server in a modern environment. A great many large organisations use web proxies to control web access; this involves stuff like anti-virus/anti-phishing (by examining the http traffic); accellerating a busy internet connection using a cache is also a big performance boost, especially in certain environmnet where you can expect a large number of people to simultaneously access some specific resources. You may consider them a relic, many organisations don't and have actual legitimate use for them beyond sharing a connection (just a look at the traffic on the Squid mailing list will show you that it is still extremely popular).

If you want to prevent SMTP/FTP/IRC/etc traffic on your network, set up a proper firewall that blocks those port ranges.

What on earth have SMTP/FTP/IRC got to do with a conversation about http proxy servers?

As you pointed out, using a proxy server in 2013 is going to give grief to anybody that has to touch it.

Its funny, Windows and OS-X, and the applications that run on them largely handle proxy servers without any problems. Its basically Android and iOS (mostly iOS) that causes problems - Apple's implementation is so utterly half-arsed and bugridden I'm often left wondering why they bothered implementing it at all.

Re:Die proxy servers

[fostware]

So why are schools using them for "Duty of Care" to cover their arses from "my kid surfs porn during school days and it's your fault"?
So why are web companies putting reverse proxies in front of farms to speed up all those new cable and FTTN connections world wide?
So why are companies with offices in remote areas using them on their GPRS- or satellite-based internet connections?

While you have a nice 20Mb connection mum or work pays for, not every-one else has the luxury.

Dual SIM, Dual OS

[ChunderDownunder]

Partition the phone into work/private.

The 'work' profile runs whatever your corporate masters inflict upon you. It's for work calls only.

The 'home' profile uses its own SIM and runs inside its own OS. You can load Android, FireFox OS, Ubuntu, whatever - it's you're personal space with your environment, private contacts, phone contract & data plan.

When an employee leaves, the personal profile could be easily exported to be transferred to another phone (the image is just carried across to the hypervisor running on the new phone).

Dual SIM tech exists. Hardware virtualization exists (arm v7a extensions).

Re:Dual SIM, Dual OS

[farble1670]

Hardware virtualization exists

the problem is that support for it needs to be built into the mobile operating system. you can't have virtualization provided by a mobile app simply because of the restrictions put upon mobile apps. so now the problem is getting google or apple to implement virtualization support. that doesn't exist.

vmware has an android vritualization solution on the market,
http://www.youtube.com/watch?v=HX_Kmc2n82k

it's pretty slick. a true android virtual machine that runs an "enterprise" guest android gingerbread under your host personal device. the problem? it requires a custom android dist for each device it's released on.

Re:Dual SIM, Dual OS

[ChunderDownunder]

Obviously Apple is a non-starter. But Android is open source.

I'm not saying off the shelf solutions exist but any startup could create a niche by supporting one device and targeting virtualization solutions for that hardware. requires some partnership with chip vendors, device makers and big corporates.

I'm thinking of the reverse of what you suggested. The company still supplies you with a work phone, with an "enterprise" image loaded. The worker then has the freedom to load a "personal" guest profile, even using a second SIM to maintain the work/life separation.

Possibly that's a slight improvement over "here's a blackberry. if you want a personal communications device, carry a second phone in your other pocket "

Blame Apple; ipad + ceo = byod

[Anonymous Coward]

and the shit rolls down hill from there

BYOD @ Your doctor, bank, accountant, government?

[deadlydiscs]

Here's the simple question...

Perhaps without knowing all of the risks associated with BYOD in a corporate environment, or any environment were information management is expected or required, how comfortable would you personally be if you knew that BYOD was implemented as a standard anyone-can-have-it end-user offering at:

- Your Doctor and/or health care provider
- The financial institutions you use (e.g. banks, brokerage, 401k, etc.)
- Any small/large company that is storing your personal information (SSN, DOB, name, address, salary info, etc.)
- Your attorney, accountant, etc.
- The networks of your government


Shoot. After typing this, I half wish there was a BYOD disclosure requirement to customers/citizens of the above organizations.

Financed

[tepples]

T-Mobile USA doesn't lock phones anymore because it's switched from a subsidy model to a more transparent loan model.

Pick 2...

[stove]

You can have:

* Company data that is not world readable
* Low cost (time and money) support.
* Users bringing in their own devices that are not editable by the company.

Attempts to have "all three" mean that the cost was underestimated.

TFA point?

[manu0601]

I have readen TFA and could not say what its point is. It seems just void thinking to me.

Done properly in Australian government departments

[MavEtJu]

http://risky.biz/byodauscert

PRESENTATION: BYOD in government, a high level talk
Handy talk for CIOs and CSOs...

Start the discussion 0 Comments
May 23, 2013 --

The following is a recorded presentation from AusCERT. It's by Al Blake, the Chief Information Officer of the Department of Sustainability, Environment, Water, Population and Communities. In it he talks about BYOD, basically, from an Australian government perspective. It's not an overly technical talk, but it is a good overview of what a CIO like him has to consider when allowing staff to use their own devices in a heavily regulated environment.

That was one of the stupidest things ever written

[gelfling]

In the history of people. It wasn't even complete sentences and thoughts. It was word salad bullshit. If that's what "CIO Magazine" calls 'best practices' and data security regulatory and privacy law compliance, then we're all doomed and we can burn down all the data centers and go back to the 18th century.

No BYOD doesn't mean data is safe.

[Isaac Remuant]

Well, you don't need BYOD to take the company's data home. You can use a portable hard drive, cd, use a cloud service, email, etc.

I wish my company would BYOD

[Anonymous Coward]

I am so sick of how slow the POS microsoft computers are they force us to use. By the time the Microsoft drone IT clowns put all their crippleware on them, they are so slow productivity slows to a crawl. Not to mention the constant reboots required when the AV kicks in or the machines randomly slow to a crawl. My home computer has half the specs of my work computer and runs dev tools, databases, servers, etc... probably about 100x faster.

Re:I wish my company would BYOD

[Anonymous Coward]

All that slowness is due to constant network backups etc. Take your computer out back with a baseball bat, and your IT department can get you a new identical one over a long lunch break. They keep you working. That doesn't happen with BYOD.

Does your office door have the same key as home?

[Anonymous Coward]

If your job requires you to carry a phone, then you carry the phone, and if you don't want to share according to the rules, I guess you carry two phones.

Do you ask them to rekey your office door and the building access to match the doors at home?
I thought not.. you carry one key for home, and one key for work.

Do you demand that your drivers license be used as your corporate ID? Swipe the DL instead of your badge?

I thought not.

If your job doesn't require you to carry a phone, then don't carry the company phone, and nobody cares. If the job requires it, carry the darn phone and stop your whining.

Too bad he wasn't fired .....

[King_TJ]

Having done I.T. for over 25 years and counting now, I'm *really* getting fed up with all the authoritarian sysadmin wanna-be's who impose all sorts of rules on what people CAN'T do on a network, instead of ENABLING people to do more with the resources available.

You want an AppleTV on the corporate network (most likely for the purpose of easily projecting things onto a conference room television instead of physically connecting a video cable between the PC and the TV)? Great! Why the hell NOT allow it? It's pretty much the same guts inside as an iPod touch, except with a locked-down version of iOS. Not exactly anything I'd be concerned about. (If your main objection is something along the lines of not liking the fact it lets people stream TV shows or music when that's not what they're hired to do? Guess what! It's not YOUR job or problem to concern yourself with that! Like the telephone on someone's desk, it's a TOOL. In I.T. you're paid to provide it and make sure it functions well. It's not YOUR problem to try to stop them from making personal calls instead of work-oriented ones. The person's direct supervisor can be concerned with all of that.)

As just one of the extreme examples .... my current boss just told me a story of his previous boss at a casino he did I.T. work for. The guy was SO intent on having 100% control and lockdown on things, he wouldn't even give the I.T. staff administrator rights to any of the boxes, except on an "as needed" basis. My boss was trying to install and configure SQL servers on a number of Microsoft servers, so each time he had to load the product, he was required to call or email and request admin access -- which was only granted JUST long enough to get the product installed! At least a couple times, this caused people to sit around and do absolutely nothing productive for the better part of a day, when he forgot they needed admin rights back for a project they were assigned to do and HE wasn't available to give it to them.

At the end of the day, when you work in I.T, or network/systems administration, it's your job to construct and maintain a computer environment that everyone finds as productive as possible. Yes, "computer security" has value ... but at the end of the day, it's just about having a documented process in place to show you tried/are trying. It's not actually some sort of goal you can achieve, and the more you try, the more difficult you make it for everyone to just USE the tools they're given.

I think this is why people make BYOD into a FAR bigger deal than it needs to be. Again, the cellphones and mobile devices are simply tools people can use to do their jobs. If you TRUST an employee enough to give them access to your digital information in the first place, then who really cares if your company has the legal right to wipe the device on demand or not? That's like issuing them a pad of paper and pencil and saying, "If you're terminated or quit, you must return the pad of paper to us." Never mind the person might have already torn out the pages where he or she scribbled down the proprietary information you were trying to protect. (Anyone with a smartphone could synchronize the contents to some personal device, off of the company-owned one, so they still possess the data you wished to wipe.)

What protects your DATA is the legal stuff.... non-compete clauses or signed agreements and documents promising you won't do certain things with the info. The BYOD or the company owned devices are just tools that can temporarily hold some of the data for people. Who buys the device is little more than a detail for accounting -- and shouldn't even matter much from the I.T. perspective.

Re:Too bad he wasn't fired .....

[Anonymous Coward]

Having done I.T. for over 25 years and counting now, I'm *really* getting fed up with all the authoritarian sysadmin wanna-be's who impose all sorts of rules on what people CAN'T do on a network, instead of ENABLING people to do more with the resources available.

Having done IT for over 10 years, I am really getting fed up with all the lazy and irrelevant staff that is crying about "enabling" functionality that is completely not work related and in the end just "enables" YouTube and Facebook for them - so they can hide more easily that they're not doing any useful work.

Re:Too bad he wasn't fired .....

[gd2shoe]

I think this is why people make BYOD into a FAR bigger deal than it needs to be. Again, the cellphones and mobile devices are simply tools people can use to do their jobs. If you TRUST an employee enough to give them access to your digital information in the first place, then who really cares if your company has the legal right to wipe the device on demand or not? That's like issuing them a pad of paper and pencil and saying, "If you're terminated or quit, you must return the pad of paper to us."

I largely agree with you, but there is a very important aspect that you're overlooking. You're focused almost entirely at malicious insider activity. From this perspective, you're absolutely right.

What you're missing is outside malicious activity. The average employee hasn't a clue how to keep intruders out. Aside from minimal training, they can't be expected to. They aren't professionals at keeping computer systems secure and running. That's ITs job.

IT must therefore find strategies to enable other employees to keep the network secure and running. BYOD causes all kinds of problems in this regard. It must be addressed with time, effort, and resources, or prevented (again costing time, effort, and resources).

Remember, the problem here isn't (principally) what employees do with their devices. The problem is what their devices do despite them.

Re:Too bad he wasn't fired .....

[Flere Imsaho]

We insist on a mobile device manager client being installed. It's a basic firewall and AV for 'Droid, Symbian, Blackberry and Win Mob, and select/full remote wipe for those plus iOS. It can white/blacklist apps, but we don't at the moment. We can push apps, which is nice as we're writing a couple of in-house SAP apps. That should make support a lot easier - pushing updates, etc. We can google map to locate a stolen device, but the user gets alerted, so you can't abuse it for shits and giggles.
.
Our people seem to trust we don't snoop and no-one's seemed perturbed the slightest when we install the client.

Speaking of AppleTV, I found one only because it was jabbering away at the firewall, trying to find Steve in the aether. The sudden appearance of a new host getting constantly blocked at the edge tripped the IDS/IPS and I got an email alert.
No biggie - I have no problem with devices being added to the network. One day it'd sure be nice to get a email letting us know what's coming, and maybe inquiring if we have any concerns. I could have reserved it an IP and tried to proxy it out to the big bad world for updates, etc, or given it it's own little firewall policy if it can only do direct WAN access. Which is what I did anyhow...

In a post above, someone accused me of some dictatorial scheme. Tosh - you just have to find a compromise between security and usability. We insist on being secure but aim to be transparent. If a conflict in those two ideals occurs, then sure, every time I'll recommend the secure option, but ultimately the business will decide how much risk they can afford - in both senses of the word.

http://friends.banksophilia.com/guestbook/

Re:Too bad he wasn't fired .....

[Anonymous Coward]

I like you.

Re:Too bad he wasn't fired .....

[bill_mcgonigle]

Maybe this IT guy knows exactly how to grab the AppleTV's MAC and put the connection into a VLAN and route it out the firewall only onto the Internet. But the same CEO refused the funds to upgrade the switches to handle VLAN's and the Internet connection is completely full from 7AM to 6PM every day.

Meanwhile the IT guy is personally responsible for information security under federal regulations.

Re:Too bad he wasn't fired .....

[ab0mb88]

While I agree with you about excessive control in some IT departments I have to say your example is not the best. Casino security is well known to be extreme. Your boss should not be surprised in the least that there was this level of security. Honestly it would be surprising to me if there were not screen captures of the entire session that the user was logged in as administrator just to keep the Security Officer happy. Anyone who works in a casino that doesn't have to strip down to their underwear at the beginning and end of every shift is lucky.

Re:Too bad he wasn't fired .....

[drinkypoo]

You deserve a $CIGAR. The policies are in place for a reason, sometimes even the result of something the CEO said once, like "bring our network into compliance with applicable regulations", but probably less pithy.

Re:Too bad he wasn't fired .....

[Anonymous Coward]

Cool, so next time a worm takes down the network or a bunch of confidential information gets leaked I'll go into my boss's office and wave a piece of paper going "But the legal stuff was supposed to protect us!"

Re:Too bad he wasn't fired .....

[SecurityGuy]

Having done I.T. for over 25 years and counting now, I'm *really* getting fed up with all the authoritarian sysadmin wanna-be's who impose all sorts of rules on what people CAN'T do on a network, instead of ENABLING people to do more with the resources available.

This is mostly right. Realize, though, that sometimes those authoritarian sysadmins aren't imposing the rules in any more than a technical sense. Requirements are imposed on them, too, and sometimes the only way to meet those requirements is to say sorry, guys, you can't just install whatever you want. Clearly the story you relate goes WAY beyond that.

At the end of the day, when you work in I.T, or network/systems administration, it's your job to construct and maintain a computer environment that everyone finds as productive as possible.

Nearly everything is a balancing act, and nearly every statement that something should be "as X as possible" is wrong, because it fails to take that into account.

What protects your DATA is the legal stuff.... non-compete clauses or signed agreements and documents promising you won't do certain things with the info. The BYOD or the company owned devices are just tools that can temporarily hold some of the data for people.

This, however, is completely wrong. Non-competes, NDAs, etc. don't protect your data at all. They merely give you stick to smack people with if they fail to protect your data if they had an obligation to do so..

Who buys the device is little more than a detail for accounting -- and shouldn't even matter much from the I.T. perspective.

IT doesn't care who buys it. IT cares who manages it because there's an implication about how it's managed, what it does, who uses it, etc.

Re:Too bad he wasn't fired .....

[akpak]

It's not YOUR problem to try to stop them from making personal calls instead of work-oriented ones.

This is pretty much how I approach it also. I don't really care if people are surfing at work, but we do crack down on streaming because we still have to pay for our bandwidth. So long as your "personal activities" aren't endangering or slowing our network, I really don't care.

Re:Too bad he wasn't fired .....

[Specter]

Time to head back to school: your information about corporate IT legal liability is about 25 years out-of-date.

Who cares, you ask? Lots and lots of government regulatory agencies, especially in Western Europe. Did you fail to take the minimum standard of care to protect data deemed sensitive by your local regulatory authorities? Congratulations! Your data leak just earned the company a big fat fine or, in extreme cases, jail time!

BUT WAIT, THERE'S MORE! Who else cares? The payment industry! Good luck getting approved to take electronic payments when your answer to "How are you securing our customer's payment PII" is a blank stare and a piece of paper.

BUT THAT'S NOT ALL! Do you know who else cares? Your customers! I guarantee that if they're not asking for it now, your customers will soon be asking you to demonstrate that you're taking industry standard measures to secure their confidential information. Failed to implement commercially reasonable information security? Loss of revenue! Loss of customers! Lawsuits! What fun!

Re:Too bad he wasn't fired .....

[ImprovOmega]

You want an AppleTV on the corporate network (most likely for the purpose of easily projecting things onto a conference room television instead of physically connecting a video cable between the PC and the TV)? Great! Why the hell NOT allow it? It's pretty much the same guts inside as an iPod touch, except with a locked-down version of iOS. Not exactly anything I'd be concerned about. (If your main objection is something along the lines of not liking the fact it lets people stream TV shows or music when that's not what they're hired to do? Guess what! It's not YOUR job or problem to concern yourself with that! Like the telephone on someone's desk, it's a TOOL. In I.T. you're paid to provide it and make sure it functions well. It's not YOUR problem to try to stop them from making personal calls instead of work-oriented ones. The person's direct supervisor can be concerned with all of that.)

You have to restrict streaming in some fashion because otherwise everyone's internet slows to a crawl because guess what - no budget for a faster pipe. The rules that need to be in place the most are the ones protecting users from themselves. Now this should be coupled with a good communications plan explaining that you're not doing it to be a douche, but limiting streaming is *exactly* something you should be concerned about as a network admin. Any one person doing something? No big deal. 1,000 users doing something? You need to limit it or ration it out somehow so that you make effective use of the resources available.

Re:Does your office door have the same key as home

[octothorpe99]

Do you ask them to rekey your office door and the building access to match the doors at home?
I thought not.. you carry one key for home, and one key for work.

If they wanted me to buy my own lock then I would

The point here is your employer cannot demand to control your property. You want to control something you pay for it.

Whether or not I will agree to carry a second phone is orthogonal. I might if my job required it but not if it was just for being able to work off hours. But again, that's beside the point.

As far as I am concerned about BYOD...

[Anonymous Coward]

The spread of all the devices means that either us frontline support guys has to get trained up on all the devices operating systems and quirks or certain people support certain devices, which can be q royal pain in the ass if someone is away for whatever reason, especially if it is a long term absence.

It should be a case of "Here are the settings you need. Have fun as you won't get any more support than that". Of course, we know that all the PHBs that ruin a company... I mean run a company, will screw things up and require us frontline people to fix the utter ballsup they have made of the simple, fully illustrated guide they were given.

BMOD and it got stolen - no reimbursement

[Anonymous Coward]

My laptop was stolen from our office during an after hours panel discussion we hosted. I used it from week 2 to untether from the desktop. It was locked down with a Kensignton Microsaver. My employer did not reimburse me for the machine.

Re:"BYOD" -Define your damned acronyms in the summ

[Culture20]

And not just with a link. No, this is not a well known acronym yet.

Bring Your Own Beverage. Context of the summery was clear that BYOD is Bring Your Own Device.

WTF is a trusted network or network device?

[symbolset]

30 years a network and systems admin and such a thing has to now been hypothetical or mythical. I'd love to hear about this wonderful new thing and the miraculous science through which it was achieved. Does it involve quantum physics?

Analysis Complete

[Anonymous Coward]

Reading these comments it is clear most commenting here are clueless. There is no nice way to put it. You are mostly tools... make decisions based on what is right not what is fashionable or be consumed by the tides of man.

Licensing

[DUdsen]

The BSA will have a field day slamming companies that migrate off site licensing windows and MS Office for using limited licenses or even worse pirated software on the BYOD equipment used to conduct the company's business. if you don't actually provide employee's with a licensing budget or depend s

To get around it means getting in t equally big trouble with labor laws banning the nonfree-freelancer loophole some companies have used to pretend they to not have obligations as an employer in the past.

The main problem with BYOD is the fact that you cant legally demand that your employee's bring the device you want them to without compensation, at least not in the civilized part of the wold. ie no matter what the company is going to wind up paying most of the HW bill, and all of the licensing bills. And you still need to support the equipment.

The problem here is not as much that you cant manage the security aspects but that you cant just slash your IT budget without breaking contract and employment law. And without the option of cutting IT budgets most BYOD business cases just fall a part.

Tax Write-off?

[some old guy]

Wouldn't the "owner" be entitled to claim the purchase cost, maintenatnce, and service charges as allowable cost-of-employment expenses, similar to a mechanic's hand tools or a salesman's unreimbursed automobile mileage?

IANAL, so I was just wondering.

Re:Done properly in Australian government departme

[Anonymous Coward]

You do realize that it ends up costing more. The reason why Australian Government Departments like this is that you can better fiddle the books to say you have a higher ratio of teachers/doctors/lawyers than before (because you can outsource support to those off the books as regular employees).

You own it and it's your responsibility.

[Mattsson]

One thing that many people overlook when they voluntary bring their own hardware to work is that when it breaks or is worn out, it's their own responsibility.

For instance, if you use your private laptop 8 hours a day at work and the fan or battery is worn out after a year, it's your own responsibility.

Or, if you bring your laptop to work and it breaks, it's also your own responsibility.
You'll have to pay for repairs or a new laptop yourself.

Unless, of course, if you have a contract with your employer about them taking responsibility for private equipment.

Coding examples hosted overseas

[tepples]

Engineering and R & D would be trying to find coding examples and the sites they would end up trying to reach were flagged

I recommend that they used to block web traffic to pornography, overseas IP address space, Known VPN providers, and Cable/DSL/Dialup provider IP address ranges

This would interfere with essential duties of R&D in the way that Eristone and I described if the "coding examples" happen to be hosted on a web site in another country.

A block that interferes with the mission

[tepples]

The approval requirements just go there, to demonstrate that the employee is not wasting business resources requesting a web site be opened up for personal or reasons not essential to the carrying out of the organization's mission.

When an engineer performs a Bing or Google search for information "essential to the carrying out of the organization's mission", but most of the results are blocked because they happen to redirect all HTTP traffic to HTTPS as an anti-Firesheep measure and are not one of a few "specific known destinations", this block interferes with "the carrying out of the organization's mission".

Re:A block that interferes with the mission

[mysidia]

When an engineer performs a Bing or Google search for information "essential to the carrying out of the organization's mission", but most of the results are blocked because they happen to redirect all HTTP traffic to HTTPS as an anti-Firesheep measure

With the proper paperwork, the engineering group can switch from HTTPS traffic blocked for them to being one of the teams that the Mandatory SSL decryption applies to.

Instead of SSL traffic being blocked; it will be transparently decrypted at the firewall/proxy device, then re-encrypted before going to the user's browser.

Security monitoring, pattern matching, protocol analysis, data leak protection, and policy enforcement mechanisms, then analyze the decrypted SSL stream.

The disadvantage is that records may kept related to the content of any portion of any SSL stream.

For those in the Engineering department; this is suitable. For those in accounting or finance, the blocking of non-approved SSL sites may be the required method, due to security tradeoffs involved to the organization.

Citrix

[Anonymous Coward]

If you are in IT and the higher ups want BYOD then Citrix is the way to do it. You still have tight control about what they can do with data. Use access gateway for remote access and give everyone with their own device a port on the switch that is considered to be public. Citrix is the only way I would ever do BYOD.

BYOD was DOA

[VoiceOfSanity]

At the company I work for, the idea of BYOD for smartphones and laptops was tested and evaluated. The result was that the BYOD pilot programs were totally shut down and that BYOD was declared DOA. The reasons were many:

Problem #1: Our company requires a high level of security on our network, as we work with data from a wide variety of customers. US Government, Foreign governments and commercial customers all expect us to protect it. Any leak, any potential breach of data could be a disaster for both the company and the owner of the data. Yes, there are ways that the data can be protected, but that runs into problem #2.

Problem #2: People don't want to have the use of their personal equipment dictated to. A good example was the short-term availability of the iPhone within the company. The devices were locked down so that only approved applications could be installed, security measures needed to be used, passwords were required and that caused resentment by the users that they couldn't use the device in the manner they wanted to use it for: as a personal device, installing whatever software applications they wanted and no security requirements. The complaints were so many that the company decided instead of trying to get the users to treat the devices as company devices, that they would simply no longer offer the device and go back to Blackberry devices, since it was understood that they were more secure than the iPhone.

Many of these issues could probably be mitigated through training, but users have a habit of not wanting to follow the requirements put in place by Information Security. It's not IT driving these requirements, it's the need to secure the data and maintain network integrity with the devices that connect to it. Even with company equipment, we know the users won't do what's necessary which is why there's a lot of security scripts that run to ensure things like anti-virus is up to date, firewall is active and the latest rules are running, whitelisting software is running, etc. ad nauseum. And that means that IS and IT would have to control the personal device in order to make sure it's properly hardened... at which point it's not the user's device any more.

Re:"BYOD" -Define your damned acronyms in the summ

[Anonymous Coward]

This is "News for Nerds" - I think you're looking for eonline.com

Re:Does your office door have the same key as home

[charlieo88]

We had a VP that had his home locks changed to match the building front door because he only wanted to ever carry two keys. When I was going through his termination interview and asked for his key, the prospect of not being able to get into his house brought the flaw in his plan to light.

Infrastructure is a serious cost issue

[maxbash]

Smartphone and tablets means greater Wi-Fi and VPN needs. We have replaced our managed wireless system twice in the last 4 years, and the last one was exponentially more expensive than the previous. Good thing devices are going to 5ghz, because we have 2.4 ghz maxed out, meaning adding more access points will not add anymore capacity for 2.4 Ghz devices. We now have 8 times the access points that we did 4 years ago.We probably are not typical though, we have about 300 employees in a smaller city with mostly 2G cell service, Verizon has spotty 3G service here, so everyone uses the Wi-Fi.

Dream Job cleaning at a Google Data Center

[Dareth]

I would love a job cleaning at a Google Data Center. But I only have a Bachelor's of Computer Science. I do not have time to get my Master's to qualify for the position. ;)

It's all about the data

[Anonymous Coward]

People forget, what does a company care about? It's their data, nothing more.

BYOD is about data classification, control, loss prevention, etc.

You need to forget about trying to secure a device that isn't yours, monitoring your employees facebook traffic, or wiping devices or data that aren't yours wipe.

Push vendors for solutions to protect the data. DRM for business data, may unfortunately be the best way.

History rhymes - MIS / Glass House all over again

[JadedApprentice]

When it comes to BYOD, IT is often laying the groundwork for their own demise in the same way the MIS department did in the 80s when the PC upended their "glass house" model for keeping all enterprise data and services inside the data center. If it was up to MIS, the most important app on your PC would still be TN3270 and no business-critical data would EVER make it to permanent storage on your laptop.

You "BYOD over my dead body" IT guys amuse me - be careful what you wish for, lol.

MIS died for a good reason - PC's ushered in Computing 2.0 - that was the original "consumerization of IT" (how quickly we forget) and we're now at the threshold of Computing 3.0 - let me elaborate:

2.0 was all about client/server => 3.0 is all about cloud/mobile
2.0 was all about controlling the endpoint => 3.0 is all about controlling only the apps and data and letting go of the illusion of endpoint control
2.0 was all about the LAN - we bolted on the internet and tried to secure it by firewalling at the network layer => 3.0 assumes ubiquitous networking and secures the apps and data from layer 7 down using identity as the security anchor
2.0 was all about packaged software in a box that eventually became downloadable => 3.0 is about app stores and HTML5 apps with a complete cloud lifecycle

Was the PC ever as secure as a mainframe? Hell no. Didn't matter.
Was the PC ever as reliable as a mainframe? Hell no. Didn't matter.
So why the hell did PCs take over? Anything you did with them was faster and cheaper and people exposed to them could never go back to the old UX.

Any of this sound familiar?

Tell me again why you're never going to embrace BYOD, and I'll tell you why your IT department is going to be called something else 5 years from now and you'll be working for someone who doesn't give a shit about all your reasons why BYOD should never have been implemented.

re: outside malicious activity

[King_TJ]

gd2shoe: Just for the record, it's not that I overlooked that aspect. It's more of a belief that it's not an aspect that should change much, in any properly run organization.

For example, concerns about BYOD devices causing security holes on the corporate network? Strongest case for this would generally be allowing older devices on the network that run older OS's. In our workplace, we simply gave a list of approved BYOD devices users could choose from that we'd allow and support. We also adopted a policy about rooting and jailbreaking. Basically, we acknowledge it's out there and is legal to do, but also note that MOST vulnerabilities come from rooted or jailbroken devices. So I.T. takes a stance of allowing it but not supporting it. If you opt to do it - you do so understanding that if you put in a support ticket with some issue with that device, we will revert it back to a non-rooted or jailbroken state as part of our troubleshooting process (and might remove you from our network until we have time to do that).

All in all, I don't even believe that I.T. is really so "expert" in handling outside threats and attacks. How can we be? We usually don't have access to the source code to the devices we implement and often aren't even good enough at coding to figure out what it meant if we were. Ever get caught in that "balancing act" where you want to apply all new updates to a system to ensure it's "as secure as possible" but some of those updates aren't supported by mission critical software also loaded on the box? Ever do the updates that are pushed out only to find they break a server? (I sure have, especially with some of Microsoft's "recommended updates" that they later recalled and revisited.) Eventually, it happens to most sysadmins that they cause real and immediate problems trying to prevent theoretical security-related ones.

Re: outside malicious activity

[gd2shoe]

It sounds like you have spent some time and effort to address the situation on your network relative to your needs. I've seen shops where the policy was to bury their heads in the sand.

All in all, I don't even believe that I.T. is really so "expert" in handling outside threats and attacks. How can we be? We usually don't have access to the source code to the devices we implement and often aren't even good enough at coding to figure out what it meant if we were.

I didn't actually use the word "expert", but "professional" -- as in, it's part of the IT profession to understand and manage such risks.

Knit-picking aside, someone must determine various risks, attack vectors, and ways to deal with them. Like it or not, that's part of IT. That doesn't mean perfect security, releasing your own patches, or being omniscient. It does mean addressing the big three in a reasoned, balanced way: data confidentiality, integrity, availability. It does mean following industry guidelines and keeping your ear to the ground (metaphorically speaking) for changes in the field. It doesn't mean knowing each and every unpatched zero-day exploit, but it does mean knowing the broad types of exploits and how to avoid or recognize and recover from them.

Again, I largely agree with you, and think our stances aren't terribly different.

Monkey spunk

[Hognoxious]

Because you own the device, you have certain rights to what is on the device and what you can do with the device.

And because I own the workplace, I define the range of what you can do:
1) You conform to corporate policy (i.e. you do what I say).
2) You leave it at home.
3) You shove it up your ass, sideways, and waddle by HR on your final journey to the door.
--
    Your friendly neighborhood PHB

Managers and IT staff get it wrong

[Trogre]

When people do finally "get" what BYOD actually is, they'll realise how stupid it is in nearly every business environment.