Why Everyone Gets It Wrong About BYOD

snydeq writes "Brian Katz offers a simple take on the buzz around BYOD in business organizations these days: 'BYOD is only an issue because people refuse to realize that it's just about ownership — nothing more and nothing less.' A 'hidden issue' hiding in plain view, BYOD's ownership issue boils down to money and control. 'BYOD is pretty clear: It's bringing your own device. It isn't the company's device or your best friend's device. It's your device, and you own it. Because you own the device, you have certain rights to what is on the device and what you can do with the device. This is the crux of every issue that comes with BYOD programs.'"

Comments

BYOD means I/T loses some control over it

[Jailbrekr]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it. And if you do not trust your own network, you need to increase your security costs substantially and provide other resources that you would otherwise not need to offer. So while you're saving around $1000 per year per user on hardware, you're spending more on licensing for NAC and VDI/RDP/ICA. You also need to amp up the local tier1/2 support because now without standards they're going to be spending more time dealing with more types of machines. Any gains made by standardization will be utterly destroyed.

BYOD is a short sighted, stupid idea thought up by someone who sure as hell has no experience with I/T support.

Re:BYOD means I/T loses some control over it

[guruevi]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want? BYOD is not just about cell phones or property. It's about people taking work laptops home and home phones to work.

If you want to make sure everything is and remains standardized, you're going to need to implement NAC and have everything on your network be a dumb terminal.

BYOD is not just about someone saving money. It's about people expecting to have their devices work and IT in organizations being too slow or not having enough funding to give everybody their device of choice.

Re:BYOD means I/T loses some control over it

[Frobnicator]

From the IT side, it means a nasty festering pile of vulnerabilities. It means more vectors for the Chinese hackers, more attack vectors for competitors, more attack vectors for malware, more vectors for government and corporate spying, and more ways for information to accidentally leak.

From the personal side, it means being on the clock continuously without additional pay. It means additional personal liability. It means if something goes wrong at work the powers that be can brick your phone. It means that your boss or peers are always watching, sometimes expecting you to reply to emails at all hours or work on reports over the weekend.

From the bottom line perspective you may get a little more hours out of the worker, but at the cost of reduced total productivity from them never disengaging and the costs of supporting an alphabet soup of devices.

Nobody wins.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Not sure about you, but no one plugs in whatever they want to our network, all network ports are authenticated at the switch, you plug in a non authorized device the port simply shuts off. BYOD is a fucked up concept by people that simply have a poor understanding of IT that think what they do at home is "better" as the guys running the network can't possibly know more than them. I have seen BYOD in 3 places now and in all it has been 3 complete failures where it was rolled back due to the insane increases in support costs.

Re:BYOD means I/T loses some control over it

[FireFury03]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want?

Yep, I've had customers insist they don't need to worry about antivirus, etc. on their workstations because they have a company policy that no one plugs unauthorised kit into the network. A few weeks later they invariably get an infection because one of the directors ignored policy and plugged his personal laptop in - afterall, who's going to tell the director off?

BYOD is not just about someone saving money. It's about people expecting to have their devices work and IT in organizations being too slow or not having enough funding to give everybody their device of choice.

I've found BYOD is actually a big PITA for large organisations because the devices people are bringing are almost universally Android or iOS, and in both cases the OS and apps have terrible support for HTTP proxies; and many large organisations use proxies to control web access from within their networks.

Re:BYOD means I/T loses some control over it

[Frobnicator]

BYOD is not just about cell phones or property. It's about people taking work laptops home and home phones to work.

We were recently stung by this little feature.

License true-ups and program audits are fun.

People install the products on their laptops with the corporate keys, and pass it around to their co-workers saying the installs are business related. For us, a two-week network scan found nearly two million dollars in improperly-licensed and unexpectedly-installed software on all those BYOD laptops.

A whole lot of people got one-on-one meetings with management, a few lost their jobs.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Then it sounds like you and the rest of the IT staff were incompetent. I work at a company right now that's been using a BYOD approach for nearly 5 years with no real issues. And with only 4 IT staff to support around 400 people.

Re:BYOD means I/T loses some control over it

[guruevi]

So you have implemented NAC, you therefore have already sunk an insane amount of money and resources into getting this to work. And now you're protected until a home device with malware has authenticated itself...

Re:BYOD means I/T loses some control over it

[guruevi]

Both devices have plenty of support for HTTP proxies. Even then, Squid has a transparent proxy option. Or you could filter at the DNS level... options, options.

Re:BYOD means I/T loses some control over it

[guruevi]

Maybe you should improve your licensing options or choose better products with less licensing. Throwing out high quality people because a 3rd party company bullies you is not really great business practice.

Re:BYOD means I/T loses some control over it

[zidium]

Would these piracy scans be successful if the user was not logged into the domain via, say, their own personal laptop?

Or, more to the point, what is the best way for a user not to show up in these scans? Would a firewall help? What would I block?

Re:BYOD means I/T loses some control over it

[mysidia]

afterall, who's going to tell the director off?

I would... in private of course. The director must be coached, and warned, in a firm and positive way order to give them an opportunity to avoid misbehaving in the future.

This is why it's important to have security policies and IT governance rules and the consequences in writing, and signed off on by multiple members of upper management, and the board.

If you commit a violation, the disciplinary action procedure has to be initiated, no matter who you are in the organization -- even the CEO is not above scrutiny from the security department; just in the same way even the CEO is not exempt from fraud or financial embezzlement rules, as the violation of any of the important security rules is of similar severity, because it may have enabled the commission of fraud or other crimes against the shareholders.

If everyone is not held to the same standard, then not everyone has to obey the policy, and it won't work.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it. And if you do not trust your own network, you need to increase your security costs substantially and provide other resources that you would otherwise not need to offer. So while you're saving around $1000 per year per user on hardware, you're spending more on licensing for NAC and VDI/RDP/ICA.

That's the point though. BYOD isn't about enabling jack shit. It's about shifting the cost to your employee. If it breaks the employee pays. If the employee doesn't like it they had other options so it's their fault. Well here's the thing the employer wants to do that THEN lock down the device so that the end user can't use their own hardware. It's just petty and cheap. Petty and cheap is not going to facilitate security.

Re:BYOD means I/T loses some control over it

[swalve]

That seems like a lot of hassle for not a lot of payoff. Every time something breaks or gets moved, they have to call IT to reenable the port? Just so you can imagine that you have security? I guess nobody ever heard of MAC address spoofing.

Re:BYOD means I/T loses some control over it

[FireFury03]

Both devices have plenty of support for HTTP proxies.

Android Gingerbread lets you set a single HTTP proxy which applies to all networks. That means device owners have to manually enter and clear the proxy settings as they move between the office network and their home network. Not that it matters - almost all apps ignore the proxy settings anyway.

Android ICS and Jellybean let you set an HTTP proxy per wifi network, which at least means the user isn't expected to reconfigure the phone all the time. Most apps still ignore the proxy settings. Most of the apps that do pay attention to the proxy settings don't support authenticated proxy servers.

All recent versions of iOS allow the proxy and authentication credentials to be set on a per wifi network basis. That's excellent. Except that most apps (including a good chunk of the stock iOS apps that Apple ship with the phone) either ignore the proxy settings entirely or fail to support authenticated proxy servers. (Yes, Apple is aware of these problems - there are bug reports in their bug tracking system that have been open for several years, they aren't interested in fixing them).

Even then, Squid has a transparent proxy option.

Transparent proxying only works for HTTP, not HTTPS unless you are going to MITM all the sessions (which involves installing certificates on all the clients). And even then, you can't authenticate the users if you're proxying transparently.

Re:BYOD means I/T loses some control over it

[girlinatrainingbra]

Re:Throwing out high quality people because a 3rd party company bullies you is not really great business practice.

Excellent point. Licensing is key. Go FOSS.

Re:BYOD means I/T loses some control over it

[chihowa]

Ah, but from upper management's side, it means costs are shifted from purchasing physical hardware (who's cost is hitting a floor) to employee hours (which can keep going down). It means next quarter's expenses will be lower (the difference of which they can collect as bonuses now) and when the following quarter's expenses are back up (from IT having to maintain the mess), the bonus has already been collected. Then they can start looking to cut costs again by shipping the (now fungible) labor overseas, and collect another bonus. When the whole house of cards collapses, they've already cashed out.

Somebody wins (just not you).

Re:BYOD means I/T loses some control over it

[maccodemonkey]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it. And if you do not trust your own network, you need to increase your security costs substantially and provide other resources that you would otherwise not need to offer.

Right. Because corporate owned devices could never ever ever become quietly compromised. Sounds safe to me.

Re:BYOD means I/T loses some control over it

[mjwx]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want?

Managed switches.

No unauthorised devices get plugged in. Every device has to authenticate with the switch (so not simply MAC address blocking).

From the fine summary:

Because you own the device, you have certain rights to what is on the device and what you can do with the device.

Yeah right, feck off.

When you BYOD onto my network, we control it, we can wipe it, we can install and uninstall apps and if you dont agree to our terms, dont bother complaining that you cant BYOD. BYOD is not open slather, if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

Re:BYOD means I/T loses some control over it

[TENTH SHOW JAM]

Usability is the antithesis of security. With that in mind. BYOD can work for Some apps. Anything that stores sensitive data locally, no. Anything that requires much more stuffing around that opening up a web port, then no.

If PHB needs more than that to get $HisFaveApp working on his Pear uPad then he may find out there are some days when he must use the tools provided by the workplace. Diddums.

Having said this, the 80 20 rule will apply.

Re:BYOD means I/T loses some control over it

[Skuld-Chan]

1990 called - they want your manually set proxy server back.

We proxy everything, but the users are none the wiser and its a university where BYOD isn't even something we can control.

Re:BYOD means I/T loses some control over it

[mjwx]

People install the products on their laptops with the corporate keys,

Why were you giving end users corporate license keys?

Re:BYOD means I/T loses some control over it

[bdwebb]

Your company has no secure resources that you or your superiors are worried about then and you are not a candidate for NAC as the parent poster was. That or your company's IT staff, including you, is actually the incompetent group and if you ever get compromised by an outsider with malicious intent, you're fucked.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Sorry, but this part isn't negotiable

Maybe not - but I'm sure your employment is. The first time you tell the CEO to "feck off" I suspect it will be negotiated to no longer exist.

Re: BYOD means I/T loses some control over it

[Anonymous Coward]

You have 1 IT staff member to every 100 people? That is a high ratio. In my environment we have ~1650 users with only 3 people in the IT department and that includes the IT director. We also don't outsource really anything (cable runs is the only real thing I can think of), manage the network/servers and do development. There is no way we could do that if it was a BYOD environment. Our support model would be blown away. We are able to do what we do because we have a highly automated patch management and client management system, this would not be possible if we did not "own" the client systems.

Re:BYOD means I/T loses some control over it

[mjwx]

Sorry, but this part isn't negotiable

Maybe not - but I'm sure your employment is. The first time you tell the CEO to "feck off" I suspect it will be negotiated to no longer exist.

LoL,

You do realise this policy comes from the CEO.

Besides that, one data leak and it's the CEO's who's job will no longer exist. They get real paranoid when you make it clear their job is at risk. Besides this, if management wont take security seriously, I'll have another job by next week anyway.

Re:BYOD means I/T loses some control over it

[bdwebb]

There is a definite cost to implementing NAC but I'm confused as to how you believe a home device with malware is going to authenticate itself. There are many complex malware programs out there that can attempt a variety of attack vectors but none complex enough to bypass a NAC solution worth its' salt with anything but the baddest 0-day exploits.

There was a BlackHat presentation made in relation to NAC that presents some of these potential attack vectors (http://www.blackhat.com/presentations/bh-dc-07/Arkin/Presentation/bh-dc-07-Arkin-ppt-up.pdf), however in a fully secured, fully featured NAC deployment, the likelihood is almost zero. Like you said, the cost of the solution and the time and resources devoted to implementation are all high so it really needs to be an industry requirement or something of the like but a well implemented NAC solution in tandem with well developed security policies provides an extremely high level of security. IAANSE (Network Security Engineer)

Re:BYOD means I/T loses some control over it

[bdwebb]

MAC address spoofing doesn't help vs a well implemented NAC solution as the MAC address of the connecting device is not the only authentication factor. Many NAC solutions even require agents to be installed on the connected machine so that an analysis of installed software and hardware can be performed as an additional authenticator and many will pre-scan connecting devices for offending/unsecure software and quarantine them in a segregated network with no routing abilities.

Once implemented, a NAC isn't an incredible hassle to manage and 802.1X even allows for a port to be re-enabled once the offending device is disconnected from the port so you don't have to manually reenable the port every time someone plugs in an unauthorized resource. It is extremely costly, however, and the effort integrate it properly so that it can't be bypassed by simple means is huge so a NAC is not a great solution unless your industry or company requires it.

Re:BYOD means I/T loses some control over it

[ultranova]

I've found BYOD is actually a big PITA for large organisations because the devices people are bringing are almost universally Android or iOS, and in both cases the OS and apps have terrible support for HTTP proxies; and many large organisations use proxies to control web access from within their networks.

So maybe you shouldn't try to control web access from your network if you allow it at all, but rather deal with people browsing Slashdot or porn sites all day long when and if it becomes a problem?

Re:BYOD means I/T loses some control over it

[khasim]

Besides that, one data leak and it's the CEO's who's job will no longer exist.

Maybe. Maybe not. It depends upon how well he (or she) can spin it.

And the easiest way to spin it is to blame you.

So if you're having trouble getting the CEO to support the "NO BYOD HERE" policy then start hunting for a job with a more informed CEO. Leave that job and that CEO to one of the BYOD advocates. Let them deal with whatever loss happens.

... I'll have another job by next week anyway.

Maybe. It depends upon how high profile the loss is. It's easier to get a different job BEFORE the story about how the company lost $500,000 because someone in Accounting brought in an infected laptop and the CxO's and BoD are all claiming that it was your fault. Be proactive.

Re:BYOD means I/T loses some control over it

[Lumpy]

Then tell management to stop being cheapskate morons and BUY the employees tablets and phones.

Honestly the one thing that screams that the management is a bunch of Douschebags is a BYOD policy. If a company is work working for they buy you a tablet and phone if you need it as well as a laptop if you need it. The only places I have ever seen a BYOD requirement has been either fly-by-night or swirling the drain. If a company can afford to pay you 6 figures they can spend $1600 on a laptop every 2 years and $50 a month to get you a smartphone.

Re:BYOD means I/T loses some control over it

[a_n_d_e_r_s]

So they could install the programs on their corporate computers.

Re:BYOD means I/T loses some control over it

[Lumpy]

Sounds like a plan. got a FOSS version of AVID? same quality and same abilities?

No? how about a FOSS version of AutoCad? no the two toys running around out there wont work.

Well then how about a FOSS version of my automotive computer tuning software? IT supports all the modern cars, so what FOSS program is out there that does that?

Lastly how about a nice FOSS large accounting software system? no?

There are three business types that can not use FOSS even if they wanted to, and that covers a hundred thousand of businesses in the USA alone. (car repair, car shops, engineering firms, accounting firms, TV stations and studios, etc...

FOSS is an impossible answer for a large number of businesses simply because the software does not exist.

Re:BYOD means I/T loses some control over it

[Lumpy]

I watched an IT guy try to tell a CEO that his apple TV was not allowed on the network. the CEO pointed at the door and asked the guy, "what does it say on the door?"

The IT guy was one of the brighter ones and got the hint quickly... and set it up on the corporate network.

Re:BYOD means I/T loses some control over it

[vux984]

you're spending more on licensing for NAC and VDI/RDP/ICA.

Unless you aren't.

Many companies have an outbound sales force. The use a VPN + virtual infrastructure for laptops to access email email, access to the CRM, point of sale/sales quote system, and intranet resources. BYOD vs company hardware is a wash for licensing here.

You also need to amp up the local tier1/2 support because now without standards they're going to be spending more time dealing with more types of machines. Any gains made by standardization will be utterly destroyed.

Definitely true to a point.

In practice, for a lot of companies, they do end up ahead. Employees tend to treat the units better. There's no hassle with recovery after an employee leaves. They frequently tend to buy better hardware for themselves than corporate budgets would spring for. Insurance, droppage, spillage, etc is eliminated.

Ditto for smart phones -- if you don't have or need particularly stringent policies in place for email; and you already are just using some generic hosted exchange, or gmail hosting, or zimbra hosting or whatever then byod gets a lot cheaper fast.

You save on hardware, you save on support. Its your device, if the speaker stops working, or its dropping too many calls, go get yourself a new one. You don't have to manage their airtime packages and data usage. Or bill them, or monitor them. Typically you just give them a $X phone service allowance, and your done.

Not every business is paranoid about 'customer health and financial information leaking'. The sales guys knocking on doors trying to get you have their company fix your companies elevator, wash your companies buildings windows, do your companies landscaping, do the HVAC, do building envelope testing for water penetration, supply you with printer toner...

You don't always have to micromanage their devices. Sometimes you do, and then BYOD makes no sense, for all the reasons you state... but sometimes you just don't.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

Your company has no secure resources that you or your superiors are worried about then and you are not a candidate for NAC as the parent poster was. That or your company's IT staff, including you, is actually the incompetent group and if you ever get compromised by an outsider with malicious intent, you're fucked.

We have about 25,000 BYOD users and ferociously protect our IP. I wish you luck in your crusade against the customers you serve. It seems to be working out for the RIAA/MPAA.

Re:BYOD means I/T loses some control over it

[girlinatrainingbra]

Well, hey, if you can't get FOSS for what you want, at least have the ethics to realize that you have to pay fo rthe software you use. Don't use unlicensed software. FOSS software is licensed too, even if it is or is not free of cost. Freedom in FOSS is the freedom to share and the lack of a bullshit-filled license. Or at least don't keep hiring idiots who think that it's okay to steal. It's not okay to steal in either case, and your employees ought to be aware of that: a - proprietary software copied without paying for the copy or the extra license b - FOSS software that you intend to use without honoring the license If your employees can't stop stealing, perhaps they deserve being fired.

Re:BYOD means I/T loses some control over it

[octothorpe99]

You shouldn't trust your own network to begin with. How do you make sure no-one plugs in whatever they want?

Managed switches.

No unauthorised devices get plugged in. Every device has to authenticate with the switch (so not simply MAC address blocking).

From the fine summary:

Because you own the device, you have certain rights to what is on the device and what you can do with the device.

Yeah right, feck off.

When you BYOD onto my network, we control it, we can wipe it, we can install and uninstall apps and if you dont agree to our terms, dont bother complaining that you cant BYOD. BYOD is not open slather, if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

Well, if it was my choice to B[M]YOD, I'd let IT get admin privileges on my devices. But if its at the company's insistence, then hell no!
Here's the deal:
- I can do off-hours work if I get email on my phone.
- I won't carry a second phone for work
- I am willing to add my work email on my phone PROVIDED:
    -- I am not required to register my device for monitoring
    -- I and ONLY I have admin rights on my phone
    -- No remote monitoring of my phone allowed

I will, however, agree to follow policy like setting a passcode, time-out locking, enable find-my-phone and remote wipe (which I will control).

Re:BYOD means I/T loses some control over it

[war4peace]

...Which is the wrong way to do it.

Re:BYOD means I/T loses some control over it

[Benaiah]

Having worked on both sides of this fence I can say that IT are often lured into the belief that they are the core of an organisation and that they are constantly making things better for everyone by making things more uniform. Such as giving everyone the same desktop icons and refusing access to the desktop to allow users to add their own icons. They are hidden away from the rest of the workforce in artificially lit computer graveyards. The users in such a network ie, the accountants/journalists/engineers who are actually making the company money get more and more disillusioned with this system that gets less and less functional, ie submit a form signed in triplicate with a cost code attached in order to get Chrome installed. They bring their own 4G devices in and use them to do their work, or bring in windows hacking tools to give themselves local admin rights and all hell breaks loose.

Thus where I have seen IT actually play their support role is where they don't get put in the dungeon in the basement of the building but integrated into the workforce and forced to do their work in plain sight. Other staff members can see the work that they do and come and ask questions, and they can see the impact that their work has on their users. Their team meetings are infiltrated with key staff members who get to vet the plans moving forward, and key to all this, is an articulate manager who actually understands what his subordinates are doing and not just playing with dollars and cents.

Re:BYOD means I/T loses some control over it

[guruevi]

I meant the "security" a NAC gives is defeated as soon as a device authenticates itself. Whether it's your company's laptop or a home device, as soon as the user authenticates the device it has free reign over the network and any malware on the computer gains access as well while you think the network is "secure". Typical malware is installed on devices that are still used by actual users.

Re:BYOD means I/T loses some control over it

[guruevi]

NAC isn't actually all that costly. There are free (as in beer and as in speech) solutions that top the expensive, vendor-centric NAC solutions.

The problem is that NAC is not a security tool, it's a network access control tool. It gives you some control as to what devices can connect to which portions of the network and typically you bump other devices to a VLAN that goes directly to the Internet (like a guest network on WiFi).

Once a device is authenticated (either by a malicious user or more likely, shared credentials or a piece of malware an authentic user unknowingly has installed), your network is still just as vulnerable.

Re:BYOD means I/T loses some control over it

[swalve]

Proper security shouldn't depend on the client browser. If you want HTTP traffic to go through a proxy, force it to at the bottleneck (ISP connection) not at the individual clients.

Re:BYOD means I/T loses some control over it

[dbIII]

I disagree with the first point - only because accepting BYOD means you have to give up on that and have ways available for people to plug their stuff in or connect wirelessly without contacting IT or their own management, using nothing more than a password circulated by word of mouth. Once a BYOD policy is there you the good idea expressed above (you plug in a non authorized device the port simply shuts off) is just abandoned.

It means you have to have staff available and plans in place to deal with virus outbreaks from infected devices that WILL turn up eventually. It means you need staff to keep the balance between a firewall that allows out what is required (which is a moving target, since a lot of applications want to phone home on obscure ports) but locks everything else down hard (not just email) to avoid your address going on a blocklist. It means hunting down and blocking devices that are consuming all bandwidth with bittorrent. It means draconian monitoring of personal communications right down to the packet level just to spot the things causing problems but causing all kings of privacy issues along the way. It means needing extra staff to cover support of a much wider range of devices - a policy to avoid this doesn't work because you do end up having to support Macs or whatever "just this one time" or waste a lot of time trying to talk irate users down when support is refused.

Re:BYOD means I/T loses some control over it

[swalve]

Don't connect equipment with pirated software onto your company's network. Done.

Re:BYOD means I/T loses some control over it

[mjwx]

I watched an IT guy try to tell a CEO that his apple TV was not allowed on the network. the CEO pointed at the door and asked the guy, "what does it say on the door?"

The IT guy was one of the brighter ones and got the hint quickly... and set it up on the corporate network.

These CEO's often wonder why they end up with crappy IT departments.

Yes men tend to make very poor security decisions.

Re:BYOD means I/T loses some control over it

[mjwx]

Maybe. It depends upon how high profile the loss is. It's easier to get a different job BEFORE the story about how the company lost $500,000 because someone in Accounting brought in an infected laptop and the CxO's and BoD are all claiming that it was your fault. Be proactive.

This is exactly what I meant.

I'll have another job long before the shit hits the fan leaving the decision makers holding the bag.

Re: BYOD means I/T loses some control over it

[guruevi]

1 IT tech per 550 users is indeed a very unreal ratio unless you work at a place like Google where everybody is highly technically adept. Even with heavy handed standardization and lockdown, you simply cannot maintain even the most basic of communications. You would be manning 1500 users, ~2000 computers, ~50 servers, ~150-250 printers and ~100 switches, 50+ access points if you have wireless, miles of cabling you should be halfway upgrading to fiber pretty soon... with 3 people? Who is developing anything? Who is rolling anything out?

Unless you have everything outsourced to the cheapest bidder and a host of consultants that don't count towards your FTE. Even 1 of you guys falling sick or getting hit by a bus would be devastating. From my experience a typical IT person can handle ~100 desktop users, ~250 if you have a well-run tiered help desk system.

If your department truly believes you personally have a hand over 550-800 users, then simply go out there, most likely what has happened is every single department has one or more official or unofficial IT tech and a number of desktop-servers and wifi routers on the desks.

Re:BYOD means I/T loses some control over it

[dbIII]

With respect, as an AutoCAD user from 1989 onwards, AutoCAD is a toy. For the entire length of it's existence there's always been something better and the open alternatives to it are functionally just as useful, they just have a different way of getting to the same endpoint.

Re:BYOD means I/T loses some control over it

[guruevi]

A proxy never works for HTTPS, you're always going to be doing MITM. You want authenticated proxy? Why in the hell would you want that? Proxies are there for caching purposes and maybe for blocking purposes (breaking the Internet on your own network), not for authentication purposes. You're using the wrong tools, you should be using Kerberos for service authentication, 802.1x for device authentication if that's what you really want, to block access to certain sites you could be using transparent proxies or block the DNS queries. Even so, proxies are dead with the amount of user-specific content the Internet generates these days.

Re:BYOD means I/T loses some control over it

[__aaltlg1547]

1. How on Earth would you save $1000/year per employee on hardware?
2. What is this support thing you mentioned? My guess is if they're not providing devices they're also not providing support for employee-owned devices.

Re:BYOD means I/T loses some control over it

[dbIII]

That sort of thing can come in by stealth when accounting does and end run around IT and fucks over employees by suggesting a "salary sacrifice" to get a shiny new laptop to bring to work that the company should have purchased for them in the first place. You end up with a pile of machines with no antivirus, no backups, you can't get a budget to repair or upgrade them, problems are not reported because of the fear you'll see the granny porn collections on what is their personal laptops, and, to make things worse, that's how Vista managed to sneak into the building at a time when none of our printers had drivers for the thing. There's still two of those things lurking around near me, and if the company owned them they would already have Win7 on an SSD or have been replaced entirely. Since they are personal machines the owners just get to see the people around them take home newer and better devices paid for by the company while they are left out of the upgrade cycle.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

We have about 25,000 BYOD users and ferociously protect our IP. I wish you luck in your crusade against the customers you serve. It seems to be working out for the RIAA/MPAA.

I don't understand your rationale that company security policies are some 'crusade' against the customers that company serves. Customers are not the same as employees...

Maybe the 'BYOD users' you are talking about are your customers and in that case, you probably have some other heavy security mechanisms to prevent those users from manipulating your IP. Either way, your business is not a candidate for NAC and your input is pretty much irrelevant.

No, I meant 25,000 actual employees, which is about 1/3 of our total internal user base. We've been running on a BYOD basis for about four years already.

BYOD is, much like LANs were, largely user-driven with IT reacting to demand.

Re:BYOD means I/T loses some control over it

[__aaltlg1547]

That doesn't solve the problem of what happens when an employee loses a device or has it stolen, or somebody plugs a spy device into a network-connected computer. Physical access to a connected device pretty much negates most forms of NAC.

Re:BYOD means I/T loses some control over it

[CAIMLAS]

The best thing about BYOD is getting drunk dialed by your boss at 2am asking for him to come pick him up... and no, I'm not even kidding. That would be a highlight.

Re:BYOD means I/T loses some control over it

[the_B0fh]

If your company is not providing you the equipment to do the job properly, why should you provide it?

Anyone who wants to bring their own equipment in are just being divas. Your device *SHOULD NOT* work in the company. In fact, they *MUST NOT* in my environment. If IT is too slow, then management needs to fix it. Not let you introduce new issues.

I may loath and hate OutLook, but if the company tells me to use it, I use it.

Re:BYOD means I/T loses some control over it

[aztracker1]

Put all byod devices on a VLAN with a transparent proxy allowing HTTP and DNS requests only, in addition to some restricted targets/ports until authenticated.. from there (after authentication) you can offer access similar to VPN users. You don't have to give *everyone* access to everything.

Re:BYOD means I/T loses some control over it

[KingMotley]

Personally, I prefer BYODs. I couldn't get a SSD into my PC even after I cleared it with IT, and I even bought it for them. It was only after I bought it they changed their mind and refused to either install it, or let me install it. My work PC is 1/3 the speed of my home PC, has 1/10th the disk capacity, and 1/20th the disk speed. Although, they did finally replace my 1280x1024 monitor this year with a 1920x1080 one. If it was a BYOD office, I'd have a much better office PC without their stupid antivirus killing 3 hours every week because it's corporate policy to run it at 12:00 noon instead of 12:00 midnight even though the PC is on 24x7.

Re:BYOD means I/T loses some control over it

[KingMotley]

I'd rather take the $800/year in "laptop fees", and $50/month in "cellular fees" and have them deposit it directly into my checking account. Oh wait, that is BYOD.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

Could you tell a bit more, please? What are use cases for those BYOD devices, what kinds of data and applications they're used for?

The primary BYOD users are a global sales force and executive staff. The core applications are email and calendar, which is pretty typical. I'd guess something close to 100% use those two. Other deployed applications are VDI, IM/presence, VoIP, sales process, commissions visibility, and expenses. Android and iOS have the most support, and new stuff generally launches on iOS first and Android second. Blackberry is supported, but I don't know what the story is with the various flavors of mobile Microsoft platforms. Could be we support them, I've never been interested enough to look.

We publish white papers on our BYOD deployment and have detailed statistics about what kinds of devices are being used and their growth rates. It's interesting stuff. I don't want to get more specific than that because we also manufacture things that could be used in a BYOD solution, and I don't want anyone to think I'm shilling or astroturfing.

Re:BYOD means I/T loses some control over it

[beelsebob]

Sorry to tell you this, but you're not doing your job. As a network administrator, your job is to make sure that the people using the network are able to do the tasks they need for their job.

Yes BYOD means you need to be careful about what happens on the network, but it does not mean the network will instantly fall over if you, the network administrator, is even half competent. What it also means in many (most?) companies is significant productivity gains for the people using the network, and ultimately, that's why you're there – to facilitate their productivity, not to sit in your ivory tower with your pristine "perfect" network that actually doesn't do what the users need it to.

Re:BYOD means I/T loses some control over it

[smack.addict]

Then your network isn't secure to begin with. You just use your control as a pathetic crutch.

Re: BYOD means I/T loses some control over it

[mikey1134]

Modern NAC as far more sophisticated that just Mac filtering. You can use 802.1X which requires a "supplicant" on the device to login to the switch with a user/password or certificate before the port will forward traffic. The switch checks with a RADIUS server, and you can even configure the system for "posture validation" which means things like the antivirus are checked to ensure the machine is clean and up to date before to device is given full network access.

Re:BYOD means I/T loses some control over it

[JDG1980]

The problem is that unless you can make a strong legal and/or business case for it, having the top management in a mid-size or large company held to the same standards as everyone else just isn't going to happen. For that matter, you probably can't force the company's best salesman to follow IT rules either – they outrank the IT department.

You might be able to rein in upper management if you can convince them and their peers that bad IT security practices are a violation of PCI standards (which can result in them pulling your company's ability to take credit cards) or Sarbanes-Oxley compliance (which can actually get the suits thrown in jail if they're unlucky enough). But just saying it isn't best practices isn't enough. Nor is saying that it's a violation of company policy – these are the people who make company policy. You will need clear and specific documentation saying that a particular practice could get them in actual trouble with some outside body.

Re:BYOD means I/T loses some control over it

[Culture20]

4 IT staff to support around 400 people.

1 IT person should be able to support 1000-10,000 people depending on system homogeneity. BYOD makes everything heterogeneous unless the company mandates what hardware you're allowed to buy. That's why you could only support 100 people per IT person.

Re: BYOD means I/T loses some control over it

[Flere Imsaho]

Around here, the opposite is true. The technically adept people (read R&D dept) are the bane of our existence, as they constantly need changes made / make changes without consulting us.
The basic office worker drones with a standard image desktop are a walk in the park by comparison.

Re:BYOD means I/T loses some control over it

[skids]

I work in an educational environment where we've done BYOD since before the acronym got coined. Even in this very permissive environment, we still insist that certain OSes pass a basic NAC sanity scan to reduce the disease vectors inside the firewall. (It's all easily circumenventable, but less trouble to circumvent than to comply.) This brings down the infection rate to a level manageable by the help desk and IT staff.

We do have IP and PII concerns. We address them organizationally by clearly defining the boundaries where work with certain types of information may occur through user education. This generally does not constrain users to the point of hurting innovation -- interacting with this type of data is only a small part of most jobs here. Companies that fixate on technical solutions to problems that can be solved organizationally are only hurting themselves.

So the end result is people can BYOD, but they are patched up (because bypassing the NAC is 30 minutes work versus 5 minutes complying) can't be running open servers on them (as the firewall won't let inbound connections in) and are not using them to process the latest payroll, because they mostly cannot get to that data due to host/firewall policy, and where they can, they know they shouldn't do that.

Re: BYOD means I/T loses some control over it

[dkf]

The technically adept people (read R&D dept) are the bane of our existence, as they constantly need changes made / make changes without consulting us.

Only because you insist on having control.

Re:BYOD means I/T loses some control over it

[dkf]

A proxy never works for HTTPS

Yes it does, but only if the proxy supports CONNECT properly.

Re:BYOD means I/T loses some control over it

[dbIII]

That's fine with an ad-hoc situation where outside devices are allowed to supplement existing ones (and it's what I've got already for people's phones and the odd thing they bring in for personal reasons), but I see this discussion as being about BYOD policy with actual work expected to be accomplished on the BYOD devices - thus they can't be restricted as much without impeding work.
It all depends on the level of communication. If IT is just expected to get out of the way and hide in a corner then vastly more work is required than managed risk. In some places, despite it being a good idea, your suggestion would be seen as IT being unwilling to give up control and not embracing a BYOD policy.

Re:BYOD means I/T loses some control over it

[Jane Q. Public]

"Not sure about you, but no one plugs in whatever they want to our network..."

I agree with you 100%. And I go further: if the company wants me to BMOD, then they can damned well pay me for the use of it. It's okay... I'll rent it to them at the going commercial rate.

Re:BYOD means I/T loses some control over it

[nojayuk]

AutoCAD is the basis of an entire ecology of add-ons and workflow tools, many of which can cost ten times the basic cost of the package itself and then some. Oil refinery piping layouts, dynamic flow analysis, bill of materials, finite element analysis tools, import and export to other engineering packages, 3DMax visualisation etc. etc. Unless and until the FOSS alternatives to AutoCAD can plug in as a one-for-one replacement to that ecology then they're not going to make big inroads in the multiseat engineering/architectural world.

Re:BYOD means I/T loses some control over it

[SuricouRaven]

"Not sure about you, but no one plugs in whatever they want to our network, all network ports are authenticated at the switch, you plug in a non authorized device the port simply shuts off" .1x? We use that too. No-one has yet figured out that the network printers, scanners and phones don't support it, so anyone could just unplug one of those. It doesn't get them on the main VLAN, but it's a foot in the door.

Re:BYOD means I/T loses some control over it

[symbolset]

You said you do it successfully, but didn't say how. I can respect that.

People are going to attack you for that because they don't know how. It's not your job to teach them how.

Incompetence reigns in enterprise IT, as it always has. Fixing that isn't your problem as long as you do well by your charges.

Eagles may soar, but weasels don't get sucked into jet engines.

Quite.

Re:BYOD means I/T loses some control over it

[SuricouRaven]

"1 IT person should be able to support 1000-10,000 people depending on system homogeneity. BYOD makes everything heterogeneous unless the company mandates what hardware you're allowed to buy"

So the company gets the equipment they want, and someone else pays for it. Management must love that idea. Way to externalise those costs!

Sure, it'll upset the employees. But what are they going to do about it?

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

We use FOSS counterparts to AVID and AutoCad in commercial production settings so yes that works. And the best accounting software systems that scales in enterprise deployments are FOSS (and based on Java EE). As for automotive computer tuning software I haven't used them so I cant say something about that.

So possibly with the exception of car repair you are dead wrong in your ancient beliefs on where FOSS can be used. In fact some of your examples are business that are totally dominated by FOSS, and often based on the Java stack (Jboss, Liferay, Apache OFBiz etc).

Re:BYOD means I/T loses some control over it

[symbolset]

Could you tell a little bit more, please? What is the IPv4 address range for your routers?

Re:BYOD means I/T loses some control over it

[SuricouRaven]

FOSS isn't always viable, true. But those applications are all very specialised - I can't imagine many employees would want to steal the key for a car-tuner or corporate accounting program. Things like office suites or DTP software are the problem, and in those areas FOSS is, if not always as good a solution as the established commercial software, at least good enough that it can be considered as an option.

Re: BYOD means I/T loses some control over it

[symbolset]

At Google you can't even interview without being IT tech qualified. Even for accounting, marketing or shipping. I'm pretty sure the guy who sweeps the warehouse could teach IT at your local community college.

Re:BYOD means I/T loses some control over it

[symbolset]

1 IT person is good for nothing because humans need downtime to function correctly and tech needs to function correctly 24/7. At 400 users a good minimum is 4 IT folk. Fewer users: outsource it. From 400 to 3,000 you shouldn't need more though. After that somebody needs to assume a leadership posiiton.

Re:BYOD means I/T loses some control over it

[FireFury03]

A proxy never works for HTTPS, you're always going to be doing MITM.

You're wrong. Without MITMing the encrypted traffic you will, of course, never get access to much of the information being transferred. But you do get access to the host name being connected to, what useragent is being used, etc.

You're using the wrong tools, you should be using Kerberos for service authentication

Yes, HTTP proxies support Kerberos just fine.

802.1x for device authentication if that's what you really want

802.1x would certainly be ideal; but frequently not feasible due to the amount of integration required within a network - you're going to need to replace all your switches with 802.1x capable ones, integrate it with DHCP and firewalling, etc. and the overhead of managing the certificates on hundreds of devices is quite extreme.

to block access to certain sites you could be using transparent proxies

As mentioned elsewhere, transparent proxying isn't possible with HTTPS unless you're going to MITM the encrypted traffic.

or block the DNS queries.

That's a very blunt instrument - you're talking about blocking all access to a host for all client software, rather than blocking specific parts of a website.

Even so, proxies are dead with the amount of user-specific content the Internet generates these days.

I don't see how "user-specific content" is at all relevant to the conversation. Sure it reduces that amount of content that a proxy can cache, but not greatly so - there is a *lot* of static content around still (javascript, css, images, etc) and caching it certainly has a big impact on the performance of a network. Its generally only the HTML and JSON traffic that is user-specific and uncachable, which tends to be a small proportion.

Re:BYOD means I/T loses some control over it

[FireFury03]

So maybe you shouldn't try to control web access from your network if you allow it at all, but rather deal with people browsing Slashdot or porn sites all day long when and if it becomes a problem?

1. You're assuming this is just about stopping people wasting their time browsing porn all day, whereas filtering web traffic is very useful for security purposes (e.g. blocking phishing sites, malware, etc).
2. You're assuming I'm dealing with adults. I'm not.

Re:BYOD means I/T loses some control over it

[gd2shoe]

These CEO's often wonder why they end up with crappy IT departments.
Yes men tend to make very poor security decisions.

???

That was a non-sequiter. You took an example of bullying and tried using it to rail against men. Lots of men make great security decisions. Lots of jerks with power don't -- both men and women. This isn't a gender issue.

Calling someone a "hater" only means you can not rationally rebut their argument.

Are you trying to be inflammatory? If it was a joke, it was badly formed (and not funny).

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

Well then I won't bring my own device. ( Actually I will, but I will not tell you about it. If I can I will go around your precious security features to use it. Or just use it outside _your_ network ). You will not get to wipe _my_ device. I'm not sure why anyone would even want to carry their own device around for work related things. I'd rather use someone elses hardware, that way it's their problem if I lose or break it.

Re:BYOD means I/T loses some control over it

[dbIII]

It is called system integration and is done with things that are less of a toy than AutoCAD.
Also I cannot understand why you wasted your time listing those things - some of which I've been aware of for decades and some (like the FEA stuff) that is inaccurate since the data doesn't have to come from just AutoCAD. I knew of all those things before I gave my opinion, and attempting to lead things even furthur offtopic gets us nowhere.

Re:BYOD means I/T loses some control over it

[shitzu]

How do you make sure no-one plugs in whatever they want?

IEEE 802.1X

Re:BYOD means I/T loses some control over it

[ttucker]

The stupid thing about NAC to protect from trusted internal users, is that their machines have to authenticate, and therefore have the keys to authenticate. Extracting them becomes a relatively simple process. All that it really provides is some notion of who is connected... but even then, a key can be stolen from a coworker.

Re:BYOD means I/T loses some control over it

[dreamer-of-rules]

"Yes men" .. people (of any gender) who say "Yes" to higher-ups. A brown-noser.
http://en.wiktionary.org/wiki/yes_man

Re:BYOD means I/T loses some control over it

[DarkOx]

There you go, a ratio of 1:100 is pretty bad for operations staff by today's standards. You should be able to handle, 2500+ clients with that. One support phone guy. Then 1 network engineer, 1 wintel guy, one *nix guy. The latter three all crossed trained engough to moonlight covering for each other and deal with a support escalation as well as handle the interdisciplinary stuff like VM infrastructure. You can do that if you have standards.

Re: BYOD means I/T loses some control over it

[DarkOx]

Yea well we learned at my organization you have to keep control. You get good engineers that just are not it experts. If you don't have control you pretty soon find then doing things like FTPing schematics home to work on then there. Sure they are smart guys and understand the potential problems with that when you explain it to them, but that is not the sorta thing they spend there time thinking about. Unless you want to waste there time having the it security talk weekly rather than anually, a good electronic fence implemented on equipment it controls is a more efficient way to keep everyone on the strait and narrow

Re:BYOD means I/T loses some control over it

[DarkOx]

I am sorry but people like you who have that attitude toward it are absolutely every bit as wrong as the it types who think the answer to everything should be "no".

When some gets a worm on your network and it takes the entire business offline for the better part of a day while everyone chases down and cleans the machines you will still say IT failed to do the job you refused to let them do.

When you customer list is published on wiki leaks, or near perfect copies of your flagship product trade secrets and all start coming off the boat from china you will say it did not do their, which you refused to let then do.

Yes, IT needs to help you be productive but they also need to protect you and the company, which means they can't just let you do *anyhing* any time. It's not that simple, you need to stop looking at IT as your bitch and start thinking of then as trusted advisors just like you do your legal department or your HR people.

Re: BYOD means I/T loses some control over it

[Flere Imsaho]

Totally agree. "It's nothing to do with control" was probably a bit strong. I meant it's not about controlling people just because you can.
We aim to be secure, but transparent. If there's a conflict the business decides on the risk level we go with. I'll always push for secure in that situation - it's my responsibility to do so. I try to be reasonable, but hey, if nothing else I've done my job well and can sleep at night.

Re: BYOD means I/T loses some control over it

[Flere Imsaho]

Crap, didn't mean to say "We have a great relationship with the rest of the business" I meant to just say "...with the business" - all of it.o_0

Re:BYOD means I/T loses some control over it

[Flere Imsaho]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it.

I think having a network means you can no longer trust your own network. Air-gap it, or assume the worst and plan accordingly! :-)

Re:BYOD means I/T loses some control over it

[Lumpy]

You are full of carp on the AVID replacement. there is nothing . N O T H I N G that is FOSS that can replace avid. Hell there is nothing FOSS that can replace Adobe Premiere.

Everything that is FOSS for video production is either a toy for home movies or is so buggy that you lose money by the bucketload. When you are paying a professional editor $90 an hour to edit your film you dont want Cinerella to crash yet again and take out the last 4 hours of work.

Oh and ignore that to use FOSS you have to transcode all your footage because it will not work with RAW video or with AVCHD (if you work in ENG you have to live with AVCHD as all the pro sony cameras use it) so now you need to transcode and get a mild generation loss PLUS waste about 6 hours to convert the 12 hours of footage you shot.

Unless you have some hidden FOSS project out there that we have not been able to find. Because every single one I have tried is utter, utter, crap compared even to the Jokes of the industry like Premiere and Canopus.

Oh and please tell me what you are using to replace After Effects? Dont even try to say blender. Eventually Blender will be able to do some of this, but not now.. not if you are paying someone to work with it. Workflow in blender for anything outside of 3D CGI is a nightmare.

Re:BYOD means I/T loses some control over it

[Lumpy]

Key theft is not a problem if the IT department did not hand it out freely and they actually did their jobs.

Re:BYOD means I/T loses some control over it

[higuita]

pick on some of the money you would pay in each of that software and invest it in the FOSS companies to build one for you, fixing the things missing on the current software. on short term still use the closed programs until things get better. on short term you pay more, but the long run you will save a lot of money.

each of the software you point, each one cost huge amount of money, even a small part of it would help making FOSS software to get better

Remember, FOSS is software that someone build to solve his problem... if this is your problem, help fixing it. If everyone is waiting for the next guy to do it, none will do it. If you cant program, pay someone to do it.

Re: BYOD means I/T loses some control over it

[Bill, Shooter of Bul]

Ha! I used to work at a place with a real honest to god genius. Who was almost irreplaceable and by far the primary engine behind the company's growth. He also hated, hated any and all attempts to restrict his access to anything that interested him. We went through several network administrators that thought they were smarter and didn't want him to sporadically take down the network when one of his side projects unrelated to work brought down the network. I felt bad for the poor bastards that were in that no win situation.

Re:BYOD means I/T loses some control over it

[quetwo]

If you don't understand that for your IT department, your employees are your customers then no wonder you don't like and can't deal with BYOD. I bet you also lock down their screen savers because it's easier for you to deal with as well.

The issue is that IT has become commoditized. With a lot of the basic services out there, employees have found ways around IT that treat them like dirt (we are the monopoly, and you HAVE to use us to do your job!). That is where the conversation around BYOD begins.

In my organization, the IT department was forcing all the users to use Windows phones as the only option to check email. This was up to about two years ago, and Windows Mobile 6.1 devices were the only approved ones because "it made sense to standardize devices across the organization" They couldn't fathom using an Android, iOS or BlackBerry to do our jobs. Windows Mobile made it easier for them, so that is all they allowed. Then one day they were told by the BOD that they were going to carry Android phones. Then the exceptions happened, and now they are forced, kicking and screaming, into the serving their customers.

Re:BYOD means I/T loses some control over it

[Chris Mattern]

You misparsed the sentence. Not "Yes, men tend to make...", but "Yes-men tend to make...".

Remember kids, punctuation is important! It's the difference between "Let's eat, grandma!" and "Let's eat grandma!"

Re:BYOD means I/T loses some control over it

[Gr8Apes]

You can do both you know. NAC is used for a "secure" network, which has a certain level of trust internally. BYOD is on a second, lower trust level network, and access to your "secure" network is gated and monitored. Note that neither case ever relieves you of the need to monitor and manage your "secure" network, nor the intended "secure" resources, which should still be gated and monitored separately.

I have one case where you're supposed to go through a proxy to hit resources in a "secure" network, but the incompetent network folks did not VLAN that network, nor did they firewall it, or sincerely do even the most basic of activities to actually secure that network other than proxying HTTP/HTTPS traffic. That is not a secure network by any stretch of the imagination. I can hit it directly from almost anywhere in their network and guest network, once I have access to any single system on it.

Re:BYOD means I/T loses some control over it

[goose-incarnated]

When some gets a worm on your network and it takes the entire business offline for the better part of a day while everyone chases down and cleans the machines you will still say IT failed to do the job you refused to let them do.

The problem with that is that in my experience, even when a worm takes down half the locked-down-to-hell-and-back machines on the network, the IT dept who refuses to let the "peons" do anything still doesn't get blamed! I figure, since you aren't getting blamed when my machine gets infected, why the fuck are you restricting what I can run on it? I get blamed in any case while IT get's to increase their lockdown.

Re: BYOD means I/T loses some control over it

[Agent0013]

If you don't have control you pretty soon find then doing things like FTPing schematics home to work on then there.

So what are you saying? You would much rather have them copy the schematics to their laptop or USB key and bring them home that way? I don't really see how FTP makes things any less secure, just less convenient.

Re:BYOD means I/T loses some control over it

[dargaud]

if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

That's insane. There's no way I'll give admin priviledges to my hardware to anybody, much less a coworker with an attitude. And that's even counting if I have it in the first place. If I want to use my smartphone on the wifi at work, unless it's rooted I'm not even admin on that, so why should you ?!? Do what sane network admins do: register the systems and put them on separate networks. For starters.

Re:BYOD means I/T loses some control over it

[MachineShedFred]

It's possible to do BYOD, but it requires having a shload of infrastructure in place first. Example:

- Only certify certain hardware as qualifying - basically the hardware compatibility list of:
- run a bare-metal hypervisor on the hardware, like XenClient
- have your corporate image as an image running on the hypervisor, with the user image running in a different sandbox side-by-side
- have your corporate image authenticate with the network, and only talk to your corporate network (or a VPN concentrator).
- have your corporate network only talk to your corporate VM image, and actively deny any connection that doesn't authenticate through provisioned TLS.

This would keep the company secure, as well as allow the user of the device their own place for their stuff.

Re:BYOD means I/T loses some control over it

[FreeUser]

Honestly the one thing that screams that the management is a bunch of Douschebags is a BYOD policy.

That depends on the BYOD policy. I work for a company that gives you a choice: company iPhone, or BYOD and they give you a stipend that covers the majority of the cost of most cell phone plans. It's a pretty good deal whichever way you roll.

But then, my employer isn't trying to get people to buy their own laptops or workstations. Any employer doing that is a real douchegab.

Re:BYOD means I/T loses some control over it

[MachineShedFred]

Try getting PCI compliance if you aren't using some form of network port control - 802.1x or otherwise. You won't pass the audit, and for the company that I work for, that's literally a billion dollar problem.

That's not about being user-surly, that's about being a responsible employee.

Re:BYOD means I/T loses some control over it

[MachineShedFred]

I work for a company where the director of corporate information security has actively told the CEO that he can't have that device, and then gave him good reasons why (safe harbor, encryption of proprietary data, accidental financial disclosure risks, etc.).

Was the CEO happy? Actually, yes - he knew that he had competent employees that were doing their jobs and looking out for the company, and not looking to be Yes Men.

Re:BYOD means I/T loses some control over it

[MachineShedFred]

The fix for that: automated software deployment.

If the users never get the installation media, and never get the license keys, and are not administrators because they no longer need to be, you don't have this problem. Also, you can audit your licenses because they've all been centrally deployed.

We've been doing that now for about 7 years, and it's much more convenient for someone to fire off an email and have the software installed an hour later, than have non-IT staff wasting their time muddling through IT work that can be automated using free-from-licensing solutions that are available for practically every platform. There's some that you can pay for and have some really nice features, but even small business can do automated software deployment now.

Re:BYOD means I/T loses some control over it

[unixisc]

This is correct from the office's POV - it's stupid and shortsighted from that end. From the employee's end, it's only a good idea if the employee - and unfortunately, there are too many of them - freely uses his work computer for personal/private use, and vice versa.

Otherwise, it's completely inane and unethical - if I'm using a laptop or phone for my personal use, why on earth should I use it for work? First of all, when using office computers, employees are always made completely aware that anything they put on that belongs to the employer, and so they can't legally object if the network sniffs their personal info and does something w/ it - such as them interviewing another company. But if I am in a BYOD environment, there is no way that such an item belongs to the IT department, but I may have to use software that the office requires. That is meddling into my control of my own device.

My solution - keep it simple. Don't use office laptops or phones for your personal stuff, such as checking your bank account, sending e-mails to a recruiter or your personal accountant, or things of that sort. Similarly, don't use your personal laptop to make office presentations, reports, spreadsheets or other such documents. Keep usage of those things completely separate, and there will be no issues about ownership.

Re:BYOD means I/T loses some control over it

[hobarrera]

If you were blindly trusting your network just because you owned the devices, you were doing it all wrong.

The moment someone else physical has access to a single computer on your network, you should treat the entire network as untrusted. Anything less is just asking to have a security breach.

Re: BYOD means I/T loses some control over it

[denmarkw00t]

getting hit by a bus would be devastating

Note: This is true regardless of company size and/or IT staffing

Re:BYOD means I/T loses some control over it

[hobarrera]

Why do you need to filter web access through a proxy?
I've yet to see an organization with a valid excuse for this.

Re:BYOD means I/T loses some control over it

[hobarrera]

BYOD is not just about someone saving money. It's about people expecting to have their devices work and IT in organizations being too slow or not having enough funding to give everybody their device of choice.

I've found BYOD is actually a big PITA for large organisations because the devices people are bringing are almost universally Android or iOS, and in both cases the OS and apps have terrible support for HTTP proxies; and many large organisations use proxies to control web access from within their networks.

If users bring their own devices, and those have OSs that don't even support HTTP proxies, then that's the users' problem.
You can't have a BYOD policy and then have to deal with devices that have network support that looks like it's 2001.
What's next "my device doesn't support TCP/IP"?

Re:BYOD means I/T loses some control over it

[hobarrera]

I agree. Even before the age of the internet, users had the change of bringing in a floppy with Monkey Island on it, buy nobody did that because they know they'd get fired for fooling around in work time. The same needs to apply to modern internet usage: you don't restrict it, but make sure people aren't slacking off all day long.

Re:BYOD means I/T loses some control over it

[hobarrera]

Maybe you should improve your licensing options or choose better products with less licensing. Throwing out high quality people because a 3rd party company bullies you is not really great business practice.

Yeah, really high quality employees which were illegaly redistributing copyrighted works inside a corporate enviroment!

Re:BYOD means I/T loses some control over it

[hobarrera]

When you BYOD onto my network, we control it, we can wipe it, we can install and uninstall apps and if you dont agree to our terms, dont bother complaining that you cant BYOD. BYOD is not open slather, if you want to bring your own device, fine, we welcome that but you will be registering it with our MDM (Mobile Device Management) system before you're even so much as able to put mail on there, that means our policies get enforced on your device (and your administrative privileges for that device get taken away). Sorry, but this part isn't negotiable.

BYOD isn't a priviledge. I'm actually putting additional resources onto my job to do it more efficiently. Why do I also have to give YOU control over it?

I use my personal PC for work. If my boss want access to wipe it, install stuff etc, my answer would be "No. I own it. If you want control over it, give me one payed by yourself. I want to do whatever I want on it on non-work time. Also, don't expect me to ever carry it with me the moment I leave the office."

Re:BYOD means I/T loses some control over it

[Penguinisto]

I suspect you would be better served to ask how many subnets/VLANs he uses, and how they're structured to isolate the BYOD bits from the rest of the infrastructure.

Re:BYOD means I/T loses some control over it

[petermgreen]

Also with some software it's trivial to get the license key from an installed copy of the software. I've even seen at least one program that showed it on the splash screwn at startup.

Re:BYOD means I/T loses some control over it

[Hatta]

Oh, your users know. They know and they hate you for it. You only don't know that they know because there is no mechanism to petition for a redress of grievances.

Re:BYOD means I/T loses some control over it

[drinkypoo]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it.

You never did, and if you've been assuming that you have, you don't understand network security.

Re: BYOD means I/T loses some control over it

[drinkypoo]

We went through several network administrators that thought they were smarter and didn't want him to sporadically take down the network when one of his side projects unrelated to work brought down the network. I felt bad for the poor bastards that were in that no win situation.

If they were smarter, they'd have got him his own network and his own WAN link to play with.

Re: BYOD means I/T loses some control over it

[aceboomblain]

Those folks might be the "bane of your existence", but the corporation as a whole probably considers them to be critical assets; unlike the IT folks, who can be replaced much more easily. It is IT's job to serve them (and everyone else), not the other way around.

Re:BYOD means I/T loses some control over it

[Anonymous Coward]

When some gets a worm on your network and it takes the entire business offline for the better part of a day while everyone chases down and cleans the machines you will still say IT failed to do the job you refused to let them do.

No, any IT department that can't protect its networks from a rogue device is incompetent.

Any competent IT department will be able to properly segregate user devices from critical corporate infrastructure. Hell, even if you're totally incompetent you should be able to set up a goddamned Wi-Fi network that's connected to the Internet outside the corporate firewall.

If your HR department advised you not to ever allow employees to speak to one another to avoid personnel conflicts, you would fire the HR director.

If your Legal department advised you not to do business outside my state of incorporation to avoid liability, I would fire my head counsel.

If my IT department can't secure critical data from a hypothetical rogue device, then it can't secure it from a determined hacker, either.

Re:BYOD means I/T loses some control over it

[SecurityGuy]

It was just made up on the spot, like 73% of statistics are.

Re:BYOD means I/T loses some control over it

[g0bshiTe]

It's called a GPO to disable USB ports on PC's. Also on a network the DHCP range is limited to 5 ip's which also shoots our IT dept an email when a lease is issued AND I have a server setup to monitor ARP (it's to prevent man in the middle attacks) I still get a notification when a new device appears on the network.

Do you work in IT or did you just stay at a Holiday Inn Express last night?

Re:BYOD means I/T loses some control over it

[g0bshiTe]

BYOD of 400 users across 4 admins, your IT guys are overloaded, there's your issue.

Re:BYOD means I/T loses some control over it

[g0bshiTe]

Actually sounds more like a App Store dev house.

Re:BYOD means I/T loses some control over it

[vux984]

Other companies do just need the equal security of SSL and have their CRM/ERP/ETC as a web application. That really removes a lot of management overhead. VPN client and remote desktop replaced with web browser. Same security, less work.

A web application is not a substitute for all but the simplest scenarios.

The only case when you need extra security you really need end to end security. Tamper-proof bios, firmware and operating system. That means you need to run ChromeOS which are the only OS that currently have end-to-end security.

Just Yuck. Interesting, but still yuck.

Re: BYOD means I/T loses some control over it

[Bill, Shooter of Bul]

They weren't given the budget to do that, and that would have just caused him to link the two together in an unorthodox fashion and kill both anyway.

Re:BYOD means I/T loses some control over it

[Yakasha]

BYOD means you can no longer trust your own network because you no longer have the same level of control over the devices on it.

Didn't read, didn't understand, or didn't agree with the article?

Three things, 1 from the article, 1 anecdote, 1 question.

Article: The article, and the summary, stated that the primary and only real difference between COPE and BYOD is ownership. Why do you automatically assume that "BYOD" means "Bring absolutely anything you want from an iPhone to a kitchen sink and plug it into our network without running past IT first."? BYOD in no way prevents you from saying "Bring your own Windows 7 or 8, OSX 10.6-8, or RedHat 7 laptop; iPhone 4+ or Android 4+ phone; And install this software we provide...; No CentOS; No BB; No XP; No 10.5". You don't have to relinquish control or standards, you don't have to give up your Terms of Use for your network. The only thing that has to change is who pays the invoice when the computer is delivered.

Anecdote: I worked on a contract with Lucent about ... wow 10 years ago. As a vendor I obviously brought my own laptop (well, my company's, but same difference as far as Lucent is concerned... its not theirs). The first thing I had to do when I plugged in though was install their software. I still have no idea what it did beyond letting me join the network (and pop up a friendly little window when I did connect, reminding me of Lucent's right to monitor, record, restrict, or redirect absolutely anything sent over their network). But as soon as its there, guess what? They had whatever control they wanted over their network and my PC. What would have happened if their software didn't work on my PC? Who knows...

Question: Considering the anecdote above, what is the difference between having a BYOD policy and not providing a brand new laptop to every vendor and contractor that walks through your front door?

BYOD is a short sighted, stupid idea thought up by someone who sure as hell has no experience with I/T support.

Spoken like a grunt with no management experience that didn't think things through. :)

Re:BYOD means I/T loses some control over it

[Vlado]

BYOD is a stupid idea?
No IT support experience?

Tell me something then: how do all the websites survive? How does the e-banking survive? It's designed on BYOD concept from the get-go.

And before you say anything about web apps, I don't expect every application to be web-enabled. But I DO expect it to work for me from everywhere and on pretty much any device that I have available to me, at any given time.

I work in company that has a majority of users who travel globally on a daily basis. We're expected to both consume and produce intellectual property securely and constantly (even while we travel). Our work devices have to be our private devices as well, otherwise we would die of boredom on long trips or would have to carry two of each.

In my particular branch office we have zero IT support/admin guys. At the same time we have pretty much zero IT support issues that are not actually caused BY the IT department (email server going offline 2 or 3 times a year). And we're not all IT pros. We have our share of office administrators and so on who are proficient in Excel, Word and web-app usage but no more. But guess what: they don't have problems. Things work, because they're set-up so that they work.

And yes: our network is not 100% secure. It's secure enough. But on the other hand, no network is 100% secure. Just the other day there was report here about Chinese hackers stealing F-16, Aegis and whatnot blueprints from "secure" governmental networks. The thing is that we make sure that the due-diligence is observed. Employees understand which data is important and secure it additionally to prevent it's leakage in a reasonable way. At the same time we don't get our panties in a bunch about security being more important than the work that we have to do.

BYOD rocks!

Re:BYOD means I/T loses some control over it

[Methuseus]

And this is why BYOD isn't accepted many places. I deal with HIPAA. BYOD is a big no-no with that in most cases.

Re:BYOD means I/T loses some control over it

[war4peace]

In this case, the employee did something against the Internal company Procedures (HR, Software Usage, Security, etc). In other words, it's called theft and they deserve the punishment handed to them.

Re:BYOD means I/T loses some control over it

[akpak]

No it's not. If you BYOD, you'll likely get nothing at all in terms of hardware/service costs.

Re:BYOD means I/T loses some control over it

[Cederic]

A proxy never works for HTTPS, you're always going to be doing MITM.

The web proxy server at my previous company, and my current one, both do MITM attacks against HTTPS traffic. If you're using the default desktop browser you don't see this as they've added their own certificate authority to the default browser install.

I use my own browser, and I get informed of invalid certificates on every HTTPS connection I make. Shrug, it's their network; if it's that sensitive I'll use my own network.

Re:BYOD means I/T loses some control over it

[fostware]

Schools.

Duty of Care requires the school to at least *try* to block porn at school.

If they did nothing it'd be like a chip to seagulls when it hits the lawyers...

Re:BYOD means I/T loses some control over it

[fostware]

MagicJellyBean says I can get the keys without asking IT...

Re:BYOD means I/T loses some control over it

[Specter]

I notice that you don't list an MDM in your deployed applications. For email, how are you dealing with lost devices?

Re:BYOD means I/T loses some control over it

[hobarrera]

Those same kids that use their cell phones at school have 3g/4g, so they still have perfect access to porn.
They probably have internet at home as well.

Re:BYOD means I/T loses some control over it

[Specter]

"Why do I also have to give YOU control over it?"

Because you want to put your corporation's data on it. It's completely reasonable for your employer to require that you take the steps necessary to protect data that they're letting you have access to.

Re:BYOD means I/T loses some control over it

[gd2shoe]

Not misparsed. That would imply the source text obeys the target grammar.

Thanks, though. I'm glad someone could interpret that. There's so much bad punctuation on the Internet that one must frequently guess what the punctuation ought to be. I just got it wrong this time.

Re:BYOD means I/T loses some control over it

[gd2shoe]

Typically, everything under "--" is a signature. The signature is a snippet of text that the user chooses in advance and rarely has anything directly to do with the specific post it is attached to.

Yeah, I got that moron. Signatures are occasionally declarations of what a poster intends to do on the forum. A .sig like that could easily be a declaration that someone is going to start trolling for or against a "minority" group.

Also, someone with such as weak grasp of English as to not recognize the phrase "yes man/men" should not offer advice as to what constitutes a badly formed joke.

"Yes, men..." is a far more common phrase to start a sentence than "Yes-men". I took a left instead of a right. Sue me.

"Weak grasp of English"? Really? Maybe you're constantly surrounded by people who use the phrase "yes-men" all day long... but most of us aren't. Aside from particular business interactions, it really isn't a very common phrase. On the other hand, all of us ask questions. "Yes" is one of the two most common answers, and frequently starts sentences. Yes, that means it was an easy mistake to make.

Re: BYOD means I/T loses some control over it

[Hognoxious]

It's probably his responsibility if it goes pear-shaped, so wanting control is hardly unreasonable.

Re: BYOD means I/T loses some control over it

[Hognoxious]

Meh. If they were even smarter than that they'd have framed him for kiddy porn or - if they wanted to be real bastards - copyright infringement.

Re:BYOD means I/T loses some control over it

[gd2shoe]

Actually, the hyphen is non-optional. Hyphens prevent ambiguity.

(Yes, there was no comma there. It's the Internet. Commas are frequently treated as optional. Hyphens too, apparently.)

Re:BYOD means I/T loses some control over it

[fostware]

You missed the point... it's not somebody thinking of the kids. It's so school legal can say "won't somebody think of the kids, because we did our best" and deny parents financial recourse.
Once the kids surf porn via 3G it's a pastoral care issue, and responsibility can be shared with the parents or guardians.
"Those" kids also end up usually blowing their data plan which then becomes the financial issue for the carers.

Re:BYOD means I/T loses some control over it

[Trogre]

Yep, I've had customers insist they don't need to worry about antivirus, etc. on their workstations because they have a company policy that no one plugs unauthorised kit into the network. A few weeks later they invariably get an infection because one of the directors ignored policy and plugged his personal laptop in - afterall, who's going to tell the director off?

802.1x for all network access would fix that.

Re:BYOD means I/T loses some control over it

[Hognoxious]

You claim to be a developer, so you ought to know what you're doing. Still, there's no harm in getting everything checked. it's not like you need to install a new IDE three times a day.

But those twats from marketing? I'm not sure how you'd educate them. They know everything already.

Re:BYOD means I/T loses some control over it

[Hognoxious]

And the parents can blame (or sue) the school over those because...?

Re: BYOD means I/T loses some control over it

[Rakarra]

The technically adept people (read R&D dept) are the bane of our existence, as they constantly need changes made / make changes without consulting us.

Only because you insist on having control.

If you're there to take the fall without having control over your work, then that job has a disfunctional design at that company.

Re:BYOD means I/T loses some control over it

[Anonymous Psychopath]

Sure you do. Riiiiiiiiight. Welcome to /., where there's always someone with an anecdote, no matter how absurd.

http://media.www1.good.com/documents/Good_Data_BYOD_2011.pdf

"Companies already supporting BYOD policies tended to be largetoverylarge enterprises on average, with 81 percent having more than 2,000 employees, nearly 60 percent having more than 5,000 employees, and 35 percent having more than 10,000 employees."

Re:BYOD means I/T loses some control over it

[hobarrera]

If my employer doesn't trust me with sensitive data (which I need for my own work), then they should not keep me their employee.

Re:BYOD means I/T loses some control over it

[the_B0fh]

Why? What's the security risk with an Apple TV? Especially if it's set up on the guest network that doesn't touch anything inside the network?

Re:BYOD means I/T loses some control over it

[AK Marc]

Not if it's locking your fence when you have no gate on your driveway.

Re:BYOD means I/T loses some control over it

[Skuld-Chan]

Hardly... You can browse any site you like on our network (porn, pirate sites etc) you'll just be missing a ton of inline ads.

Get infected? We have sensors setup to jail your mac address/port.

News flash...

[fuzzyfuzzyfungus]

In case our good buddy Brian missed the past couple of decades, nothing is simple about 'ownership' in our delightful brave new world of digital devices...(even if we might want it to be)

"Licensed not sold", DRM in all its myriad permutations, encrypted bootloaders, SIM-locked cell modems, systems that phone home faster(and in much greater detail), than ET, activesync policies that give IT the ability to nuke your phone if you want to connect to your email, all the good stuff.

Even in his article, purporting to be all progressive and whatnot about recognizing 'ownership, he says "The good news is that plenty of tools allow you to isolate all your business data from employees' personal data. Those tools can let you wipe business data from their devices without touching their photos and private emails." This is, in effect, a polite way of saying that "There are plenty of tools that allow you to gain control over a slice of somebody else's device in a way sufficiently robust to keep them from messing with that slice'.

Above and beyond all the usual amusements of negotiations between dubiously equal parties, contemporary computers offer ample power to enforce restrictions of virtually arbitrary complexity over what we quaintly pretend that you 'own'.

Re:News flash...

[fuzzyfuzzyfungus]

For those of us that's not Windows users thats Solaris Zones/Containers or Linux Namespaces/SELinux in a nutshell. Or software partitioning, kernel virtualization and many other names/labels.

You are missing the relevant bit: All those partitioning technologies, right back to when LPARs crawled out of the primordial mainframe at the dawn of time, let the owner of the system do whatever they want to the subordinate partitions/zones/containers/etc. The system protects the subordinate containers from one another; but not from the entity at the top of the pyramid.

If you are on a system with a partition you can't look into, that's a very good sign that you aren't the owner.

Leased

[Anonymous Coward]

It's your device, and you own it.

Not if it's running an Apple or Microsoft OS.

Re:Leased

[stoborrobots]

The concept of "leasing" vs "ownership" is not one of whether you're paying every month or not - it's about whether you have legal control over the asset. If you paid the entire cost of leasing a house up front, that doesn't mean that you own it.

A leased asset is yours to use, because another entity continues to permit you to use it, however they may revoke your permission to use it at any time. They have the legal control over the asset, you get to use it because they allow you to use it as long as you play by their rules (which may or may not involve repeatedly paying them money).

When someone else says "you can use an iPhone, as long as you don't install Cydia or other unapproved software on it, and if you do, we reserve the right to remotely disable it", that's indicating that they have the control, and dictate the terms under which you use your device.

Re:Leased

[arth1]

Get a new phone, and then try to port it to another carrier. Its leased in they sense you pay, but the carrier "owns" it.

None of the mobile phones I've owned have ever been locked to a carrier. Why anyone would buy a locked and usually crippled phone, commit to a long term contract and end up paying 50-100% more for the phone in the long run boggles the mind. It's like buying eyeglasses from the eye doctor - you know you're going to overpay and only get to choose from a few models, so why do it?

Re:Leased

[armanox]

You're not in the US, are you? Choice doesn't really exist.

Re:Leased

[arth1]

You're not in the US, are you? Choice doesn't really exist.

I am indeed in the US. Choice exists, but most people here are ignorant, including those who sell services - I've had to escalate on at least two occasions to find someone who even knew about the unadvertised BYOP plans.

For about four years, I paid $19.95 a month for a plan with unlimited data, because I brought my own phone. Which also allowed sideloading, bluetooth data, music downloads and everything that the provider's own phones were locked from doing. Win all around.

Yeah? Hidden?

[magic maverick]

I'm pretty sure that's what a lot of people here on /. have been saying about "bring your own device". You know, "it's mine, and I don't want corp. IT to tell me how to use it, or what software to have on it, or to be able to remotely delete everything on it". And, "why should I have to pay for company equipment? If it's for work, they can pay".

Gee, who'd'a' thunk it?

In other news, a smug Linux user commented that Linux doesn't crash nearly as often as M$ Windoze does. And, moreover, the GIMP is a more than sufficient replacement for Photoshop for most casual users.

Re:Yeah? Hidden?

[jeauxkewl]

I would mod this up if I had points. This came home to roost with me just this week. I started a contract gig for one of the O&G supermajors whose new contractor policy is BYOD and they use a vmware/mokafive VM to give you access. So here I am, doing the same work their employees are doing with powerful dedicated machines and multiple displays on my laptop running a Win7 VM on top of Win7 (see: splitting resources) because said company is too tight to provide tools to do the job. I guess it's not a problem if it takes me longer to read the fine print or manage issues as I'm on their very generous hourly rate but I'll be damned if I'm gonna drag my dock and 24" displays to the office. Sure, VM makes sense to them from a cost perspective (no capital for workstations) but the cost savings end there. Another clear case where bean counters rule.

Re:Yeah? Hidden?

[Ironhandx]

Especially when workstations are so cheap these days. On bulk purchases you can get quad core workstations with dual displays for under $500 fully provisioned...

Umm no.

[TobinLathrop]

Or maybe it is because I work at place with SOX/HIPAA/DOD/etc requirements. Even though I am vendor I have to use the customer supplied device as I admin their servers and thats what security will allow for me to do my work. I don't have admin rights on the supplied laptop itself and everything is whitelisted to run.
Every time I hear about this at least from my side of the fence of IT support I just think of the support and security nightmares. Also if the company wants me to install their stuff on my personal pc. well they can buy me one. Same goes for a phone. They need to call me as an employee they can provide a cell phone too.

BYOD means IT imagines less control over it

[crow]

No, BYOD means that IT still has no real control over the devices on the network, but now has to stop pretending that they ever did.

In an engineering environment, many of the locked-down MSWindows systems that are deployed are wiped by the users to install Linux. Other systems may be mostly locked down, but users will run their own systems in virtual machines. The network may have a nice secure firewall, but lots of users set up backdoors through their home VPN connections to bypass the tight web filters.

And then there are the Chinese hackers who have infiltrated the network.

Any company that relies on controlling the systems on their network for security is practicing security through imagination. A real security model has to assume that there will be issues at every level. BYOD may help force companies to recognize the need for comprehensive security, but it doesn't create the need.

Re:BYOD means IT imagines less control over it

[mysidia]

many of the locked-down MSWindows systems that are deployed are wiped by the users to install Linux. Other systems may be mostly locked down, but users will run their own systems in virtual machines. The network may have a nice secure firewall, but lots of users set up backdoors through their home VPN connections to bypass the tight web filters.

These are all things that can more or less be prevented or detected.

For starters... the implementation of 802.1X authentication of Windows computers, Network Access Protection

The other big one is a semi-deny by default webfilter policy; with a firewall device that validates the HTTP stream is actually HTTP (identification by protocol regardless of TCP/UDP port), allows access to only IP space on known web hosting providers, datacenters, and large Enterprises, but specifically doesn't allow connections to VPN services; and only allows HTTPS to specific known destinations.

VPN attempts can then be screened for and detected based on traffic anomolies: HTTP session duration and Download to Upload ratio.

Any session with a high Upload ratio sets off alarms, and gets blocked in a short period.

Re:BYOD means IT imagines less control over it

[tepples]

Then watch requests to whitelist particular web sites take up half the IT department's time.

Re:BYOD means IT imagines less control over it

[mysidia]

Then watch requests to whitelist particular web sites take up half the IT department's time.

Legitimate web sites would still generally get through, because they'd be categorized by a decent filter.

For those that don't.... require sufficient paperwork, that the user is doing most of the work, before a whitelisting request can be made.

Tier 1 tech: "You want us to allow you access to a site being blocked?" "OK; here, fill out this 3 page form, and sign here, here, and here, and have your supervisor sign here on page 2 and on page 3..."

Re:BYOD means IT imagines less control over it

[tepples]

Tier 1 tech: "You want us to allow you access to a site being blocked?" "OK; here, fill out this 3 page form, and sign here, here, and here, and have your supervisor sign here on page 2 and on page 3..."

Then watch requests to whitelist particular web sites take up half of everybody's time.

Re:BYOD means IT imagines less control over it

[mysidia]

Then watch requests to whitelist particular web sites take up half of everybody's time.

Then IT will be allocated 15 minutes a day to review whitelisting requests, and department managers' requests get priority.

Any requests that don't get handled within a week are rejected, and may be resubmitted in 15 days.

Re:BYOD means IT imagines less control over it

[vux984]

At least he's a 'job creator' :)

Re:BYOD means IT imagines less control over it

[jrumney]

many of the locked-down MSWindows systems that are deployed are wiped by the users to install Linux. Other systems may be mostly locked down, but users will run their own systems in virtual machines. The network may have a nice secure firewall, but lots of users set up backdoors through their home VPN connections to bypass the tight web filters.

These are all things that can more or less be prevented or detected.

Which is what is wrong with IT. You can't see past your own policies to the fact that users have genuine business needs to use Linux on their laptops or in VMs, and those web filters you install to stop anything with *p?rn* in the URL are preventing access to sites that people need to access to do their work.

Instead of "OMG, people are bypassing our restrictions! How do we stop them?", your first response should be "why do they feel the need to do this, and how can we accommodate their business needs?".

Re:BYOD means IT imagines less control over it

[Eristone]

I had this problem with my parent company - Engineering and R & D would be trying to find coding examples and the sites they would end up trying to reach were flagged by the web filters as hacking sites or game sites (which they were a lot of times). The train of thought they were following would stop because it took days to get an approval for opening up a site. They finally said to heck with it and started using their phones as hot spots, plugged their computer into the corporate network and then used local route statements to define what went where - Internet traffic vs. corporate traffic (tech savvy developers).

The key for security is having it in such a fashion that people use that security vs. trying to work around it to get what they need.

Re:BYOD means IT imagines less control over it

[JDG1980]

Congratulations – you've now set up your IT department to be a universally hated roadblock. Don't look too surprised when they decide to outsource you to "the cloud".

Re:BYOD means IT imagines less control over it

[mysidia]

Congratulations – you've now set up your IT department to be a universally hated roadblock.

It's not IT department that makes the decision about web filtering; it's information assurance/security department, that ultimately falls to an org's chief security officer: who should thoughtfully have some file folders full of of case studies showing where companies got hacked or sued as a result of employee surfing activity would be on hand to show anyone questioning the wisdom.

The approval requirements just go there, to demonstrate that the employee is not wasting business resources requesting a web site be opened up for personal or reasons not essential to the carrying out of the organization's mission.

It's just the outcome of deferring to the HR department for their guidance on ensuring that, which results in approval processes and requisite allocations of staff time.

And everyone knows you don't outsource security to the cloud, unless you want to get pwn3d.

Re:BYOD means IT imagines less control over it

[mysidia]

Engineering and R & D would be trying to find coding examples and the sites they would end up trying to reach were flagged by the web filters as hacking sites or game sites

See... I don't recommend that Enterprises use their web filters to block 'game sites' or 'hacking' sites.

I recommend that they used to block web traffic to pornography, overseas IP address space, Known VPN providers, and Cable/DSL/Dialup provider IP address ranges -- such as attempted connections to any IP address listed in the Spamhaus PBL or SORBS DUHL.

As well as attempts to access sites on foreign ccTLDs such as ".RU" or ".PW"; which are essentially guaranteed to be related to malware distribution

Re:BYOD means IT imagines less control over it

[JDG1980]

So your whole company is a giant bureaucratic clusterfuck. Got it.

Re:BYOD means IT imagines less control over it

[sithlord2]

In most companies, doing all this will just get you fired...

Re:BYOD means IT imagines less control over it

[mysidia]

Don't you see, it's doing boneheaded stuff like this that leads to people installing Linux on locked-down Windows machines, and plugging their laptops into their phone for EDGE access.

Windows itself is an existential security threat; therefore, people putting Linux there is not inherently a bad thing; so long as Linux is implemented on the workstation in a manner compliant with IT and IS policies, including the ones about privileged user access being strictly controlled by the organization.

Re:BYOD means IT imagines less control over it

[Jahta]

No, BYOD means that IT still has no real control over the devices on the network, but now has to stop pretending that they ever did.

I'm not sure why this was marked insightful. Where I work (a financial institution) there are strong network controls that not at all illusory. Connect an unknown device to the network and it gets instantly quarantined (and you get fired). Reformat your official device and install some other OS, it gets instantly quarantined (and you get fired).

Any company that relies on controlling the systems on their network for security is practicing security through imagination. A real security model has to assume that there will be issues at every level. BYOD may help force companies to recognize the need for comprehensive security, but it doesn't create the need.

It's true that there's no single magic bullet for security; defense in depth is the only way. But if you let employees connect random devices to your network it's already largely game over.

If we introduced BYOD the financial regulator would be all over us like a rash; some of our competitors have had serious and costly data breaches. All our portable devices have full disk encryption (and restricted networking options). 99.99% of all our end-user devices have removable media disabled; the .01% that can use removable media are heavily monitored. Even the data we use for internal system testing is tightly controlled. There's no way we would allow staff access sensitive corporate or customer information from an unmanaged device.

Re:BYOD means IT imagines less control over it

[Jahta]

So your whole company is a giant bureaucratic clusterfuck. Got it.

Sheesh, way to demonstrate a fundamental lack of understanding.

Apart from the obvious fact that your employer is paying to, you know, do some actual work and not spend your day goofing off on the web, there are other good reasons to restrict web access. The company could get sued if, for example, female co-workers see you surfing pr0n on a company computer and take a sexual harassment suit. Even better, if you are doing something illegal online, the company could face criminal charges for letting you do it on their time and dime.

So no, it's not a "giant bureaucratic clusterfuck"; it's commonsense business management.

BYOD means YOU pay for it, you support it

[Anonymous Coward]

That's why businesses like it.

Point = missed

[girlintraining]

Because you own the device, you have certain rights to what is on the device and what you can do with the device. This is the crux of every issue that comes with BYOD programs.'"

Okay, let me make this simple; You're in IT security. Let's say you just threw open the doors and let anyone bring their own laptop in to work. Well, you know, and I know, that people are stupid. They're going to be infected with malware, viruses, APTs, and god only knows what. And that's the point: You don't know what's being brought in. You have no control now. And let's say as a result of someone doing this, they pass on a piece of malware, not to your super-secure corporate systems, but to another employee who's also brought in their own device.

Who's legally at fault here: The employee who accidentally (or neglegently!) brought in an infected laptop, the other employee who connected their own laptop and accidentally (or neglegently!) got it infected... or the company whose network policy facilitated this? And here's a better question: Who do you think both employees are going to sue, thus costing your company millions in unrecoverable legal fees (even if you win, you ain't going to see that money again).

Ownership here is indeed the issue; Just not device ownership. Specifically, the cost of ownership; which if you allow this stuff on your network, the cost of owning that network is going to rise due to incidental costs. How much, nobody knows for sure -- this is still a relatively new thing (in the business world anything less than 10 years old is 'new').

Re:Point = missed

[TENTH SHOW JAM]

How about you set some standards?

I $user in connecting my device you your $companies network, do swear and aver that
* My antivirus software is paid for and up to date.
* My device (to the best of my knowledge) is patched and up to date.
* Assume all risks to the IT system that are traced to me to a value of $20 M
* Will follow IT policies and procedures (and not look at porn at work) while device is connected.
* (insert whatever you want here)

Risk of infected laptop has now been transferred to the device owner.

Re:Point = missed

[tepples]

My antivirus software is paid for

Are you referring specifically to the fact that Microsoft Security Essentials runs only on the first ten PCs in an organization and that a lot of the freeware Windows AVs likewise have policies against business use? And what antivirus do you recommend for an Ubuntu installation that I keep patched?

Re:Point = missed

[techno-vampire]

And what antivirus do you recommend for an Ubuntu installation that I keep patched?

ClamAV. Not because you need it to protect your own computer but because having installed and running kills two birds with the same stone. First, of course, it allows you to say that you've got AV software installed and running. Second, it will (or should, at least) catch any infected files that you're co-workers send you before you pass them on to somebody else who might get infected by them.

Re:Point = missed

[stephanruby]

Who do you think both employees are going to sue, thus costing your company millions in unrecoverable legal fees (even if you win, you ain't going to see that money again).

Millions? That's a little much. Were their laptops even worth that much?

And has this actually happened? The legal system in the US is bad enough, we don't need to start making up new scary stories about it.

Re:Point = missed

[arth1]

ClamAV. Not because you need it to protect your own computer but because having installed and running kills two birds with the same stone.

Yep. RAM and CPU.

Re:Point = missed

[armanox]

Last I checked Avira had a Linux client

Re:Point = missed

[drinkypoo]

ClamAV has no on-access component last I looked, and even if it did you could disable it if you're not worried about infection of the host system. You can run it on a schedule during a lull, like dog intended.

"BYOD" -Define your damned acronyms in the summary

[Anonymous Coward]

And not just with a link. No, this is not a well known acronym yet.

what about disasters from BYOD

[Joe_Dragon]

what about disasters from BYOD can you bill some for damage with little to no proof? can you make some go out buy some thing new right after they just go some due to change requirements and so no? What some who is not very technically informed goes and get's the best buy special POS and who fixes that mess?

and if they go the way of making employees pay out of pocket for a specific device and subject it to complete IT control so that no personal apps or data could be used on it. This is akin to not only buying your uniform from only this supplier, but also ensuring it is kept clean and pressed and not only but based on the cost and labor laws that can pull some under min wage for that pay period and in other places it may fall under Business Expenses.

Also you can be hit with same laws even if not as locked down / you must use this system.

Re:what about disasters from BYOD

[Joe_Dragon]

what about disasters from BYOD?

Can you bill some for damage with little to no proof? Can you make some go out buy a new system new right after they just got one due to changes in requirements ? What some who is not very technically informed goes and get's the best buy special POS and who fixes that mess?

and if they go the way of making employees pay out of pocket for a specific device and subject it to complete IT control so that no personal apps or data could be used on it. This is akin to not only buying your uniform from only this supplier, but also ensuring it is kept clean and pressed and not only but based on the cost and labor laws that can pull some under min wage for that pay period and in other places it may fall under Business Expenses.

Also you can be hit with same laws even if not as locked down / you must use this system.

Re:what about disasters from BYOD

[KingMotley]

That is not english.

what about disasters from BYOD?

What should be capitalized.

Can you bill some for damage with little to no proof? Can you make some go out buy a new system new right after they just got one due to changes in requirements ? What some who is not very technically informed goes and get's the best buy special POS and who fixes that mess?

Can you bill some(one/thing/where?) for damage, with little to no proof? Can you make some(one/thing/where?) go out (and) buy a new system right after they just got one due to changes in requirements? What some(one/thing/where?) who is not very technically informed (I give up, this sentence is just a bunch of random phrases tossed together with no conjunctions).

Your device, their data

[DigiShaman]

The problem with BYOD is that users often want access to corporate data. But companies have a right, no, make that a duty to protect their own data. The problem is that in order to do that, the company has to have some control of your hardware. Mainly with regards to encryption and holding the keys from you. Again, your device, their data. And that's often the point of contention between staff and IT personnel.

Re:Your device, their data

[fermion]

And the solution is to go back to the good old days when corporate controlled data and user only had terminal access. This with todays technology this is not so hard to do. User devices are display only. All storage and processing is done on IT controlled servers. The average worker bee does not need a high end PC, and has not needed one for years. At least not for work. It has been a perk that companies supplied a PC that could also be used for entertainment purposes.

The real downside, to me, is support. If a user device is not working, then no work will get done. This means that the firm has to fix the device or lose productively. This is not such a big deal because modern devices, especially non-MS Window devices, are very reliable.

Re:Your device, their data

[bdwebb]

If the terms of your employment are that you BYOD and comply with company security policies then you do that or you don't have a job. I'm not saying you're wrong...I also believe they should be responsible for providing you with a company resource to comply with security policies. In fact, almost every company with a BYOD policy actually does do this and BYOD is simply a policy that allows users to work in a more convenient fashion with their own equipment.

Almost every BYOD policy I've seen implemented is due to complaints about not being able to get on the corporate network with their iPad or connect to the corporate network with their personal laptop via VPN. In the case where users want that access, it is up to the company to either allow it and enforce security on those BYOD devices just like they are company resources or to disallow them entirely and tell the personnel to eat it. All the BYOD policies I've ever seen that require a user provide their own equipment operate through Virtual Desktops anyway so there are no strict compliance rulesets for the devices people use..just simply that they have web browser access and can install a Citrix agent or something along those lines.

Re:Your device, their data

[Mr. Freeman]

That is EXACTLY HIS POINT!

The problem is that many users demand both that they be able to use their own device and that they be allowed to access company data on their device. If they were demanding one or the other, it wouldn't be such an issue.

Re:Your device, their data

[JDG1980]

If the terms of your employment are that you BYOD and comply with company security policies then you do that or you don't have a job.

Those terms of employment may violate labor law. Forcing employees to buy their own workplace equipment is generally not permitted.

Re:Your device, their data

[RabidReindeer]

If the terms of your employment are that you BYOD and comply with company security policies then you do that or you don't have a job.

Those terms of employment may violate labor law. Forcing employees to buy their own workplace equipment is generally not permitted.

I wouldn't take that as a blanket statement. There is a place on the US Form individual Income Tax return specifically to allow people to deduct unreimbursed business expenses, including equipment and supplies.

What an an employer can or cannot demand is subject in large part to local restrictions, so it's best to consult a lawyer if there is reason to make an issue of it.

Brian doesn't have a fricking clue.

[Chas]

"It should be about enablement"

Spoken from the self-entitled end-user's perspective!

Sorry, but it IS about control. Control of company data. Security of company data. Compliance with various laws such as HIPAA, SOX, etc.

No sane company WILLINGLY bends over and spreads by giving unfettered access to their dearly bought client and company data.

I've dealt with numerous clients over the years who've been suing former employees for data theft. And they TOOK precautions!

And you're telling me I should let someone walk around with uncontrolled access to a multi-million dollar client list, documents, etc, in their pocket?

FUCK YOU!

Re:Brian doesn't have a fricking clue.

[iggymanz]

you have some misconceptions. Enterprise software can manage the access of data on the device: requiring device have password lock, separation of client and company data, wiping of the device by the company if stolen (yes, employees made to sign agreement). All this can be done on Android, iPhone, Blackberrry

Re:Brian doesn't have a fricking clue.

[iggymanz]

also should mention my employer actually will buy the device for the employee, it is the employee's property and yet they pay the bill each month, HOWEVER note the agreement the company can wipe the device upon termination, theft of device or any other reason.

Re:Brian doesn't have a fricking clue.

[JDG1980]

Spoken from the self-entitled end-user's perspective!

You do realize that the end-users are why we have jobs, right? As IT, our job is to make their jobs easier and more productive. You forget that at your peril. Once you start acting like Mordrac The Preventer, other people in the company will start looking for ways to get rid of you.

And you're telling me I should let someone walk around with uncontrolled access to a multi-million dollar client list, documents, etc, in their pocket?

If they have access to that list on their device, it doesn't matter if you control the device or not. Nothing stops them from emailing the list to an outside address they control, or copying it into a notepad file and saving it to a thumb-drive, or, if all else fails, just writing the damn list down on a piece of paper. Maybe if you're in a super-secure military installation where all this stuff is locked down, that might stop them (or maybe not – see the recent article about the Chinese hacking into U.S. military aircraft plans). But in a normal business environment, the remedies against someone walking off with your confidential data are legal, not technical.

Taxes

[macemoneta]

I'm sure that eventually someone will realize that companies are deriving a benefit from an asset they don't own (not on their books), and thus should be paying tax and or compensation.

Re:Completely misses the point

[jedidiah]

> - Heck, how can the user even load the coporate ergonomic software

That's not a bug. That's a feature. That kind of crap is why end users want to control their own devices to begin with. The employer provided devices are all crap. It's because of nonsense like "corporate ergonomic software".

The PCs they give you in "enterprise" environments are one of the biggest reasons to avoid "enterprise" environments in general.

You also lose rights on your device

[cyberspittle]

If there is company property on your device, they have every right to it. Not as good as it seems.

Re:You also lose rights on your device

[armanox]

Read you're company's policies, or speak to HR or a company officer. I'm sure they'll be able to answer that for you (and the answer is usually, no, it doesn't go the other way).

BYOD moves between work and home

[Hentes]

BYODs move between work and home thus transferring sensitive information out and moving viruses in.

Re:Completely misses the point

[Todd Knarr]

Well,

Discovery: there's legal issues there, yes, but there's also the fact that it's not your property that the data's on anymore. With physical documents a discovery order for the company doesn't give the company the right to come in and search my home for documents that might relate. Why should it be any different for electronic documents? The pattern should be that of any other case: the company responds that some of those documents are not under their control and supplies the contact information of the people who do control the documents.

Break/fix plan: not the company's problem. It's my device, fixing it is my job. And frankly I build stuff so my break/fix plan is "Buy a replacement.". I try to design things so I can hit Fry's and get replacement parts if it's really an emergency, mostly that means I'm down for an hour or three depending on which one I have to go to.

Exising desks etc.: again not the company's problem. I shouldn't need a docking station just to plug in a power cord and Ethernet cable, and the monitors should be using standard VGA/DVI/HDMI connectors.

Corporate software: this should've been dealt with before you started a BYOD program. If you require software that's got complex licensing requirements, figure out how you're going to let users use it first.

Failed app installs: this mostly shouldn't be a problem unless your apps have some really hairy dependencies. Despite this being a common scare tactic, I've rarely run into situations where an app wouldn't install because of some complex interaction with a personal setup. Most often it's because of stupidity like "We designed it to only work with one specific patch level of Java 1.5, and the user's got current Java 7 installed.". Often it ends up being the corporate developers who created that problem. For example that Java app before would run just fine in current Java 7, the only problem was that the corporate developers deliberately set the configuration to refuse to run except with that one specific patchlevel of one specific version of Java. Take that restriction out and presto, app works perfectly.

Smart Card mandate: again this is something the company ought to be working out beforehand. Remember that when you want to use someone else's equipment you can't always mandate what it has to be capable of or how it must operate. You either deal with this up front, or you acknowledge that the company needs to own the equipment which means it's not going to be BYOD.

The big problem seems to be that companies want to have employees paying for and owning the equipment, but want to treat that equipment as if the company owned it. The company needs to change it's attitude if it wants to use BYOD, design things to not require the company to own and control the equipment. It's not like it's a big deal, it's not like Oracle or Adobe or Intuit or Blizzard or any other software publisher hasn't had to figure out how to make their software live and work on machines they have no control over. If they can do it, I'm positive the problem isn't insoluble.

What about risk of damage to your BYOD?

[Katan]

Think about the risk that has transferred over to your personal devices. You take ownership of a BYOD as your own, even if you receive a stipend for its purchase. So now a BYOD affects you personally, and not only the company. For example, if you work in an environment where your BYODs could be damaged. This could range from the basic (spilled coffee) to the extreme (working outside in a harsh environment). What if its cosmetic damage?

Obviously I have some personal experience in this. I took a BYOD (Macbook Retina) on a business trip, and we were making coax cables. My colleague dropped his end and the center conductor whipsawed onto my brand new screen, leaving a scratch. So now my supposedly best in class screen has a smiley face scratch on it. You could argue it is cosmetic. So how you handle this? I talked with my boss and it became clear that having a BYOD means accepting some liability. To be clear, my job is fairly office environment-esque, just general IT tasks for the most part. I use my laptop for email, programming, office suite etc. But I could see days where I need to bring it on a man-lift or in a harsh environment. Not a great prospect.

There are certainly extremes where you can expect some company liability, but it opens many questions about how determine if/when risk of BYOD damage is a customer issue.

I'm not going to spend this much money, stipend or not, and have it get all jacked up. I'm leaning towards letting the company carry the risk going forward...

BYO(Body)

[LionKimbro]

I can see an argument that a person's device is effectively part of their brain or their body.
I own it, I control it.
Also. Both my device and my body can catch a virus.

Perhaps the problem with BYOD is sick days.

UGGG!

[certain death]

I am waiting on the host file rant, at least it would break the cycle of it's mine, no, it's mine!! GAWD!!

Just say NO to BYOD

[canadian_right]

I would never use my personnel devices at work. One, if work wants me to have device xyz they can pay for it. Two, I like to keep my private and work life separate. Three, I've never worked for a company so insane that they actually thought BYOD was a good idea.

Didn't read article, summary is ridiculous

[Luke has no name]

Of COURSE the problem is ownership! That's the first question every worker in my IT department asked when we got offered BYOD!

"So, if I can have company data on my phone (email), what are y'all doing to my phone? Oh, you're putting it in an encrypted sandbox? Oh, you're reserving the right to wipe that sandbox remotely (and possibly my entire phone)? Oh, you're not taking any liability for accidental wipes? Oh, you're not issuing a phone number that hides my personal cell (ala Google Voice/giving me a SIP address)?"

Ya, fuck that noise. Give me my crappy work-iPhone 5 that, rather than using native apps like the Blackberry I had, gets to use "GOOD for Enterprise" apps that don't integrate with the rest of the phone.

Let's have our cake

[Zeromous]

Look, where I am BYOD is totally OK. We are provided lots of options for secure OTG access and training to avoid breaches.

Here's my person opinion and what I advocate for in my work:
I support doing everything you can to isolate clients from servers- from data access to workflow/process. There is no reason this level of authentication cannot be implemented on BYOD as the next step. That said, BYOD is only sustainable long term if accompanied by a mature self-service support model. IT should provide the virtualized environment setup, but once it's on your device you are "on your own". Devices now are so homogeneous- soon it won't be an issue to support random/phones/tablets/PCs. Save money supporting on the front end, consolidate your back end and support the hell out of it. Companies should supply replacement and loaner hardware if they need to confiscate a user device, for say, legal reasons or company interests.

Dual SIM, Dual OS

[ChunderDownunder]

Partition the phone into work/private.

The 'work' profile runs whatever your corporate masters inflict upon you. It's for work calls only.

The 'home' profile uses its own SIM and runs inside its own OS. You can load Android, FireFox OS, Ubuntu, whatever - it's you're personal space with your environment, private contacts, phone contract & data plan.

When an employee leaves, the personal profile could be easily exported to be transferred to another phone (the image is just carried across to the hypervisor running on the new phone).

Dual SIM tech exists. Hardware virtualization exists (arm v7a extensions).

Re:Dual SIM, Dual OS

[farble1670]

Hardware virtualization exists

the problem is that support for it needs to be built into the mobile operating system. you can't have virtualization provided by a mobile app simply because of the restrictions put upon mobile apps. so now the problem is getting google or apple to implement virtualization support. that doesn't exist.

vmware has an android vritualization solution on the market,
http://www.youtube.com/watch?v=HX_Kmc2n82k

it's pretty slick. a true android virtual machine that runs an "enterprise" guest android gingerbread under your host personal device. the problem? it requires a custom android dist for each device it's released on.

Re:Dual SIM, Dual OS

[ChunderDownunder]

Obviously Apple is a non-starter. But Android is open source.

I'm not saying off the shelf solutions exist but any startup could create a niche by supporting one device and targeting virtualization solutions for that hardware. requires some partnership with chip vendors, device makers and big corporates.

I'm thinking of the reverse of what you suggested. The company still supplies you with a work phone, with an "enterprise" image loaded. The worker then has the freedom to load a "personal" guest profile, even using a second SIM to maintain the work/life separation.

Possibly that's a slight improvement over "here's a blackberry. if you want a personal communications device, carry a second phone in your other pocket "

Re:Completely misses the point

[LDAPMAN]

Discovery only applies to data you control. Once it's on an employee owned device the company has no obligation to produce the data. The court then needs to go after the user directly if they want that. Note that there are exceptions for company officers.

BYOD @ Your doctor, bank, accountant, government?

[deadlydiscs]

Here's the simple question...

Perhaps without knowing all of the risks associated with BYOD in a corporate environment, or any environment were information management is expected or required, how comfortable would you personally be if you knew that BYOD was implemented as a standard anyone-can-have-it end-user offering at:

- Your Doctor and/or health care provider
- The financial institutions you use (e.g. banks, brokerage, 401k, etc.)
- Any small/large company that is storing your personal information (SSN, DOB, name, address, salary info, etc.)
- Your attorney, accountant, etc.
- The networks of your government


Shoot. After typing this, I half wish there was a BYOD disclosure requirement to customers/citizens of the above organizations.

Financed

[tepples]

T-Mobile USA doesn't lock phones anymore because it's switched from a subsidy model to a more transparent loan model.

Pick 2...

[stove]

You can have:

* Company data that is not world readable
* Low cost (time and money) support.
* Users bringing in their own devices that are not editable by the company.

Attempts to have "all three" mean that the cost was underestimated.

TFA point?

[manu0601]

I have readen TFA and could not say what its point is. It seems just void thinking to me.

Done properly in Australian government departments

[MavEtJu]

http://risky.biz/byodauscert

PRESENTATION: BYOD in government, a high level talk
Handy talk for CIOs and CSOs...

Start the discussion 0 Comments
May 23, 2013 --

The following is a recorded presentation from AusCERT. It's by Al Blake, the Chief Information Officer of the Department of Sustainability, Environment, Water, Population and Communities. In it he talks about BYOD, basically, from an Australian government perspective. It's not an overly technical talk, but it is a good overview of what a CIO like him has to consider when allowing staff to use their own devices in a heavily regulated environment.

That was one of the stupidest things ever written

[gelfling]

In the history of people. It wasn't even complete sentences and thoughts. It was word salad bullshit. If that's what "CIO Magazine" calls 'best practices' and data security regulatory and privacy law compliance, then we're all doomed and we can burn down all the data centers and go back to the 18th century.

No BYOD doesn't mean data is safe.

[Isaac Remuant]

Well, you don't need BYOD to take the company's data home. You can use a portable hard drive, cd, use a cloud service, email, etc.

Too bad he wasn't fired .....

[King_TJ]

Having done I.T. for over 25 years and counting now, I'm *really* getting fed up with all the authoritarian sysadmin wanna-be's who impose all sorts of rules on what people CAN'T do on a network, instead of ENABLING people to do more with the resources available.

You want an AppleTV on the corporate network (most likely for the purpose of easily projecting things onto a conference room television instead of physically connecting a video cable between the PC and the TV)? Great! Why the hell NOT allow it? It's pretty much the same guts inside as an iPod touch, except with a locked-down version of iOS. Not exactly anything I'd be concerned about. (If your main objection is something along the lines of not liking the fact it lets people stream TV shows or music when that's not what they're hired to do? Guess what! It's not YOUR job or problem to concern yourself with that! Like the telephone on someone's desk, it's a TOOL. In I.T. you're paid to provide it and make sure it functions well. It's not YOUR problem to try to stop them from making personal calls instead of work-oriented ones. The person's direct supervisor can be concerned with all of that.)

As just one of the extreme examples .... my current boss just told me a story of his previous boss at a casino he did I.T. work for. The guy was SO intent on having 100% control and lockdown on things, he wouldn't even give the I.T. staff administrator rights to any of the boxes, except on an "as needed" basis. My boss was trying to install and configure SQL servers on a number of Microsoft servers, so each time he had to load the product, he was required to call or email and request admin access -- which was only granted JUST long enough to get the product installed! At least a couple times, this caused people to sit around and do absolutely nothing productive for the better part of a day, when he forgot they needed admin rights back for a project they were assigned to do and HE wasn't available to give it to them.

At the end of the day, when you work in I.T, or network/systems administration, it's your job to construct and maintain a computer environment that everyone finds as productive as possible. Yes, "computer security" has value ... but at the end of the day, it's just about having a documented process in place to show you tried/are trying. It's not actually some sort of goal you can achieve, and the more you try, the more difficult you make it for everyone to just USE the tools they're given.

I think this is why people make BYOD into a FAR bigger deal than it needs to be. Again, the cellphones and mobile devices are simply tools people can use to do their jobs. If you TRUST an employee enough to give them access to your digital information in the first place, then who really cares if your company has the legal right to wipe the device on demand or not? That's like issuing them a pad of paper and pencil and saying, "If you're terminated or quit, you must return the pad of paper to us." Never mind the person might have already torn out the pages where he or she scribbled down the proprietary information you were trying to protect. (Anyone with a smartphone could synchronize the contents to some personal device, off of the company-owned one, so they still possess the data you wished to wipe.)

What protects your DATA is the legal stuff.... non-compete clauses or signed agreements and documents promising you won't do certain things with the info. The BYOD or the company owned devices are just tools that can temporarily hold some of the data for people. Who buys the device is little more than a detail for accounting -- and shouldn't even matter much from the I.T. perspective.

Re:Too bad he wasn't fired .....

[Anonymous Coward]

Having done I.T. for over 25 years and counting now, I'm *really* getting fed up with all the authoritarian sysadmin wanna-be's who impose all sorts of rules on what people CAN'T do on a network, instead of ENABLING people to do more with the resources available.

Having done IT for over 10 years, I am really getting fed up with all the lazy and irrelevant staff that is crying about "enabling" functionality that is completely not work related and in the end just "enables" YouTube and Facebook for them - so they can hide more easily that they're not doing any useful work.

Re:Too bad he wasn't fired .....

[gd2shoe]

I think this is why people make BYOD into a FAR bigger deal than it needs to be. Again, the cellphones and mobile devices are simply tools people can use to do their jobs. If you TRUST an employee enough to give them access to your digital information in the first place, then who really cares if your company has the legal right to wipe the device on demand or not? That's like issuing them a pad of paper and pencil and saying, "If you're terminated or quit, you must return the pad of paper to us."

I largely agree with you, but there is a very important aspect that you're overlooking. You're focused almost entirely at malicious insider activity. From this perspective, you're absolutely right.

What you're missing is outside malicious activity. The average employee hasn't a clue how to keep intruders out. Aside from minimal training, they can't be expected to. They aren't professionals at keeping computer systems secure and running. That's ITs job.

IT must therefore find strategies to enable other employees to keep the network secure and running. BYOD causes all kinds of problems in this regard. It must be addressed with time, effort, and resources, or prevented (again costing time, effort, and resources).

Remember, the problem here isn't (principally) what employees do with their devices. The problem is what their devices do despite them.

Re:Too bad he wasn't fired .....

[Flere Imsaho]

We insist on a mobile device manager client being installed. It's a basic firewall and AV for 'Droid, Symbian, Blackberry and Win Mob, and select/full remote wipe for those plus iOS. It can white/blacklist apps, but we don't at the moment. We can push apps, which is nice as we're writing a couple of in-house SAP apps. That should make support a lot easier - pushing updates, etc. We can google map to locate a stolen device, but the user gets alerted, so you can't abuse it for shits and giggles.
.
Our people seem to trust we don't snoop and no-one's seemed perturbed the slightest when we install the client.

Speaking of AppleTV, I found one only because it was jabbering away at the firewall, trying to find Steve in the aether. The sudden appearance of a new host getting constantly blocked at the edge tripped the IDS/IPS and I got an email alert.
No biggie - I have no problem with devices being added to the network. One day it'd sure be nice to get a email letting us know what's coming, and maybe inquiring if we have any concerns. I could have reserved it an IP and tried to proxy it out to the big bad world for updates, etc, or given it it's own little firewall policy if it can only do direct WAN access. Which is what I did anyhow...

In a post above, someone accused me of some dictatorial scheme. Tosh - you just have to find a compromise between security and usability. We insist on being secure but aim to be transparent. If a conflict in those two ideals occurs, then sure, every time I'll recommend the secure option, but ultimately the business will decide how much risk they can afford - in both senses of the word.

http://friends.banksophilia.com/guestbook/

Re:Too bad he wasn't fired .....

[bill_mcgonigle]

Maybe this IT guy knows exactly how to grab the AppleTV's MAC and put the connection into a VLAN and route it out the firewall only onto the Internet. But the same CEO refused the funds to upgrade the switches to handle VLAN's and the Internet connection is completely full from 7AM to 6PM every day.

Meanwhile the IT guy is personally responsible for information security under federal regulations.

Re:Too bad he wasn't fired .....

[ab0mb88]

While I agree with you about excessive control in some IT departments I have to say your example is not the best. Casino security is well known to be extreme. Your boss should not be surprised in the least that there was this level of security. Honestly it would be surprising to me if there were not screen captures of the entire session that the user was logged in as administrator just to keep the Security Officer happy. Anyone who works in a casino that doesn't have to strip down to their underwear at the beginning and end of every shift is lucky.

Re:Too bad he wasn't fired .....

[drinkypoo]

You deserve a $CIGAR. The policies are in place for a reason, sometimes even the result of something the CEO said once, like "bring our network into compliance with applicable regulations", but probably less pithy.

Re:Too bad he wasn't fired .....

[SecurityGuy]

Having done I.T. for over 25 years and counting now, I'm *really* getting fed up with all the authoritarian sysadmin wanna-be's who impose all sorts of rules on what people CAN'T do on a network, instead of ENABLING people to do more with the resources available.

This is mostly right. Realize, though, that sometimes those authoritarian sysadmins aren't imposing the rules in any more than a technical sense. Requirements are imposed on them, too, and sometimes the only way to meet those requirements is to say sorry, guys, you can't just install whatever you want. Clearly the story you relate goes WAY beyond that.

At the end of the day, when you work in I.T, or network/systems administration, it's your job to construct and maintain a computer environment that everyone finds as productive as possible.

Nearly everything is a balancing act, and nearly every statement that something should be "as X as possible" is wrong, because it fails to take that into account.

What protects your DATA is the legal stuff.... non-compete clauses or signed agreements and documents promising you won't do certain things with the info. The BYOD or the company owned devices are just tools that can temporarily hold some of the data for people.

This, however, is completely wrong. Non-competes, NDAs, etc. don't protect your data at all. They merely give you stick to smack people with if they fail to protect your data if they had an obligation to do so..

Who buys the device is little more than a detail for accounting -- and shouldn't even matter much from the I.T. perspective.

IT doesn't care who buys it. IT cares who manages it because there's an implication about how it's managed, what it does, who uses it, etc.

Re:Too bad he wasn't fired .....

[akpak]

It's not YOUR problem to try to stop them from making personal calls instead of work-oriented ones.

This is pretty much how I approach it also. I don't really care if people are surfing at work, but we do crack down on streaming because we still have to pay for our bandwidth. So long as your "personal activities" aren't endangering or slowing our network, I really don't care.

Re:Too bad he wasn't fired .....

[Specter]

Time to head back to school: your information about corporate IT legal liability is about 25 years out-of-date.

Who cares, you ask? Lots and lots of government regulatory agencies, especially in Western Europe. Did you fail to take the minimum standard of care to protect data deemed sensitive by your local regulatory authorities? Congratulations! Your data leak just earned the company a big fat fine or, in extreme cases, jail time!

BUT WAIT, THERE'S MORE! Who else cares? The payment industry! Good luck getting approved to take electronic payments when your answer to "How are you securing our customer's payment PII" is a blank stare and a piece of paper.

BUT THAT'S NOT ALL! Do you know who else cares? Your customers! I guarantee that if they're not asking for it now, your customers will soon be asking you to demonstrate that you're taking industry standard measures to secure their confidential information. Failed to implement commercially reasonable information security? Loss of revenue! Loss of customers! Lawsuits! What fun!

Re:Too bad he wasn't fired .....

[ImprovOmega]

You want an AppleTV on the corporate network (most likely for the purpose of easily projecting things onto a conference room television instead of physically connecting a video cable between the PC and the TV)? Great! Why the hell NOT allow it? It's pretty much the same guts inside as an iPod touch, except with a locked-down version of iOS. Not exactly anything I'd be concerned about. (If your main objection is something along the lines of not liking the fact it lets people stream TV shows or music when that's not what they're hired to do? Guess what! It's not YOUR job or problem to concern yourself with that! Like the telephone on someone's desk, it's a TOOL. In I.T. you're paid to provide it and make sure it functions well. It's not YOUR problem to try to stop them from making personal calls instead of work-oriented ones. The person's direct supervisor can be concerned with all of that.)

You have to restrict streaming in some fashion because otherwise everyone's internet slows to a crawl because guess what - no budget for a faster pipe. The rules that need to be in place the most are the ones protecting users from themselves. Now this should be coupled with a good communications plan explaining that you're not doing it to be a douche, but limiting streaming is *exactly* something you should be concerned about as a network admin. Any one person doing something? No big deal. 1,000 users doing something? You need to limit it or ration it out somehow so that you make effective use of the resources available.

Re:Does your office door have the same key as home

[octothorpe99]

Do you ask them to rekey your office door and the building access to match the doors at home?
I thought not.. you carry one key for home, and one key for work.

If they wanted me to buy my own lock then I would

The point here is your employer cannot demand to control your property. You want to control something you pay for it.

Whether or not I will agree to carry a second phone is orthogonal. I might if my job required it but not if it was just for being able to work off hours. But again, that's beside the point.

Re:Indeed

[JDG1980]

Well since that is such a big issue for you, Since I control the network, I guess you WONT be bringing your own device and using it at work. Chew on that ......

You're fired.
Signed, Your CEO

Re:"BYOD" -Define your damned acronyms in the summ

[Culture20]

And not just with a link. No, this is not a well known acronym yet.

Bring Your Own Beverage. Context of the summery was clear that BYOD is Bring Your Own Device.

WTF is a trusted network or network device?

[symbolset]

30 years a network and systems admin and such a thing has to now been hypothetical or mythical. I'd love to hear about this wonderful new thing and the miraculous science through which it was achieved. Does it involve quantum physics?

Re:Die proxy servers

[FireFury03]

Proxy servers are relic of a time before NAT. Please, please, please stop using this old hack to "share" your office Internet connection.

Thats not the purpose of a proxy server in a modern environment. A great many large organisations use web proxies to control web access; this involves stuff like anti-virus/anti-phishing (by examining the http traffic); accellerating a busy internet connection using a cache is also a big performance boost, especially in certain environmnet where you can expect a large number of people to simultaneously access some specific resources. You may consider them a relic, many organisations don't and have actual legitimate use for them beyond sharing a connection (just a look at the traffic on the Squid mailing list will show you that it is still extremely popular).

If you want to prevent SMTP/FTP/IRC/etc traffic on your network, set up a proper firewall that blocks those port ranges.

What on earth have SMTP/FTP/IRC got to do with a conversation about http proxy servers?

As you pointed out, using a proxy server in 2013 is going to give grief to anybody that has to touch it.

Its funny, Windows and OS-X, and the applications that run on them largely handle proxy servers without any problems. Its basically Android and iOS (mostly iOS) that causes problems - Apple's implementation is so utterly half-arsed and bugridden I'm often left wondering why they bothered implementing it at all.

Licensing

[DUdsen]

The BSA will have a field day slamming companies that migrate off site licensing windows and MS Office for using limited licenses or even worse pirated software on the BYOD equipment used to conduct the company's business. if you don't actually provide employee's with a licensing budget or depend s

To get around it means getting in t equally big trouble with labor laws banning the nonfree-freelancer loophole some companies have used to pretend they to not have obligations as an employer in the past.

The main problem with BYOD is the fact that you cant legally demand that your employee's bring the device you want them to without compensation, at least not in the civilized part of the wold. ie no matter what the company is going to wind up paying most of the HW bill, and all of the licensing bills. And you still need to support the equipment.

The problem here is not as much that you cant manage the security aspects but that you cant just slash your IT budget without breaking contract and employment law. And without the option of cutting IT budgets most BYOD business cases just fall a part.

Tax Write-off?

[some old guy]

Wouldn't the "owner" be entitled to claim the purchase cost, maintenatnce, and service charges as allowable cost-of-employment expenses, similar to a mechanic's hand tools or a salesman's unreimbursed automobile mileage?

IANAL, so I was just wondering.

You own it and it's your responsibility.

[Mattsson]

One thing that many people overlook when they voluntary bring their own hardware to work is that when it breaks or is worn out, it's their own responsibility.

For instance, if you use your private laptop 8 hours a day at work and the fan or battery is worn out after a year, it's your own responsibility.

Or, if you bring your laptop to work and it breaks, it's also your own responsibility.
You'll have to pay for repairs or a new laptop yourself.

Unless, of course, if you have a contract with your employer about them taking responsibility for private equipment.

Coding examples hosted overseas

[tepples]

Engineering and R & D would be trying to find coding examples and the sites they would end up trying to reach were flagged

I recommend that they used to block web traffic to pornography, overseas IP address space, Known VPN providers, and Cable/DSL/Dialup provider IP address ranges

This would interfere with essential duties of R&D in the way that Eristone and I described if the "coding examples" happen to be hosted on a web site in another country.

A block that interferes with the mission

[tepples]

The approval requirements just go there, to demonstrate that the employee is not wasting business resources requesting a web site be opened up for personal or reasons not essential to the carrying out of the organization's mission.

When an engineer performs a Bing or Google search for information "essential to the carrying out of the organization's mission", but most of the results are blocked because they happen to redirect all HTTP traffic to HTTPS as an anti-Firesheep measure and are not one of a few "specific known destinations", this block interferes with "the carrying out of the organization's mission".

Re:A block that interferes with the mission

[mysidia]

When an engineer performs a Bing or Google search for information "essential to the carrying out of the organization's mission", but most of the results are blocked because they happen to redirect all HTTP traffic to HTTPS as an anti-Firesheep measure

With the proper paperwork, the engineering group can switch from HTTPS traffic blocked for them to being one of the teams that the Mandatory SSL decryption applies to.

Instead of SSL traffic being blocked; it will be transparently decrypted at the firewall/proxy device, then re-encrypted before going to the user's browser.

Security monitoring, pattern matching, protocol analysis, data leak protection, and policy enforcement mechanisms, then analyze the decrypted SSL stream.

The disadvantage is that records may kept related to the content of any portion of any SSL stream.

For those in the Engineering department; this is suitable. For those in accounting or finance, the blocking of non-approved SSL sites may be the required method, due to security tradeoffs involved to the organization.

BYOD was DOA

[VoiceOfSanity]

At the company I work for, the idea of BYOD for smartphones and laptops was tested and evaluated. The result was that the BYOD pilot programs were totally shut down and that BYOD was declared DOA. The reasons were many:

Problem #1: Our company requires a high level of security on our network, as we work with data from a wide variety of customers. US Government, Foreign governments and commercial customers all expect us to protect it. Any leak, any potential breach of data could be a disaster for both the company and the owner of the data. Yes, there are ways that the data can be protected, but that runs into problem #2.

Problem #2: People don't want to have the use of their personal equipment dictated to. A good example was the short-term availability of the iPhone within the company. The devices were locked down so that only approved applications could be installed, security measures needed to be used, passwords were required and that caused resentment by the users that they couldn't use the device in the manner they wanted to use it for: as a personal device, installing whatever software applications they wanted and no security requirements. The complaints were so many that the company decided instead of trying to get the users to treat the devices as company devices, that they would simply no longer offer the device and go back to Blackberry devices, since it was understood that they were more secure than the iPhone.

Many of these issues could probably be mitigated through training, but users have a habit of not wanting to follow the requirements put in place by Information Security. It's not IT driving these requirements, it's the need to secure the data and maintain network integrity with the devices that connect to it. Even with company equipment, we know the users won't do what's necessary which is why there's a lot of security scripts that run to ensure things like anti-virus is up to date, firewall is active and the latest rules are running, whitelisting software is running, etc. ad nauseum. And that means that IS and IT would have to control the personal device in order to make sure it's properly hardened... at which point it's not the user's device any more.

Re:Does your office door have the same key as home

[charlieo88]

We had a VP that had his home locks changed to match the building front door because he only wanted to ever carry two keys. When I was going through his termination interview and asked for his key, the prospect of not being able to get into his house brought the flaw in his plan to light.

Infrastructure is a serious cost issue

[maxbash]

Smartphone and tablets means greater Wi-Fi and VPN needs. We have replaced our managed wireless system twice in the last 4 years, and the last one was exponentially more expensive than the previous. Good thing devices are going to 5ghz, because we have 2.4 ghz maxed out, meaning adding more access points will not add anymore capacity for 2.4 Ghz devices. We now have 8 times the access points that we did 4 years ago.We probably are not typical though, we have about 300 employees in a smaller city with mostly 2G cell service, Verizon has spotty 3G service here, so everyone uses the Wi-Fi.

Dream Job cleaning at a Google Data Center

[Dareth]

I would love a job cleaning at a Google Data Center. But I only have a Bachelor's of Computer Science. I do not have time to get my Master's to qualify for the position. ;)

History rhymes - MIS / Glass House all over again

[JadedApprentice]

When it comes to BYOD, IT is often laying the groundwork for their own demise in the same way the MIS department did in the 80s when the PC upended their "glass house" model for keeping all enterprise data and services inside the data center. If it was up to MIS, the most important app on your PC would still be TN3270 and no business-critical data would EVER make it to permanent storage on your laptop.

You "BYOD over my dead body" IT guys amuse me - be careful what you wish for, lol.

MIS died for a good reason - PC's ushered in Computing 2.0 - that was the original "consumerization of IT" (how quickly we forget) and we're now at the threshold of Computing 3.0 - let me elaborate:

2.0 was all about client/server => 3.0 is all about cloud/mobile
2.0 was all about controlling the endpoint => 3.0 is all about controlling only the apps and data and letting go of the illusion of endpoint control
2.0 was all about the LAN - we bolted on the internet and tried to secure it by firewalling at the network layer => 3.0 assumes ubiquitous networking and secures the apps and data from layer 7 down using identity as the security anchor
2.0 was all about packaged software in a box that eventually became downloadable => 3.0 is about app stores and HTML5 apps with a complete cloud lifecycle

Was the PC ever as secure as a mainframe? Hell no. Didn't matter.
Was the PC ever as reliable as a mainframe? Hell no. Didn't matter.
So why the hell did PCs take over? Anything you did with them was faster and cheaper and people exposed to them could never go back to the old UX.

Any of this sound familiar?

Tell me again why you're never going to embrace BYOD, and I'll tell you why your IT department is going to be called something else 5 years from now and you'll be working for someone who doesn't give a shit about all your reasons why BYOD should never have been implemented.

Re:Die proxy servers

[fostware]

So why are schools using them for "Duty of Care" to cover their arses from "my kid surfs porn during school days and it's your fault"?
So why are web companies putting reverse proxies in front of farms to speed up all those new cable and FTTN connections world wide?
So why are companies with offices in remote areas using them on their GPRS- or satellite-based internet connections?

While you have a nice 20Mb connection mum or work pays for, not every-one else has the luxury.

re: outside malicious activity

[King_TJ]

gd2shoe: Just for the record, it's not that I overlooked that aspect. It's more of a belief that it's not an aspect that should change much, in any properly run organization.

For example, concerns about BYOD devices causing security holes on the corporate network? Strongest case for this would generally be allowing older devices on the network that run older OS's. In our workplace, we simply gave a list of approved BYOD devices users could choose from that we'd allow and support. We also adopted a policy about rooting and jailbreaking. Basically, we acknowledge it's out there and is legal to do, but also note that MOST vulnerabilities come from rooted or jailbroken devices. So I.T. takes a stance of allowing it but not supporting it. If you opt to do it - you do so understanding that if you put in a support ticket with some issue with that device, we will revert it back to a non-rooted or jailbroken state as part of our troubleshooting process (and might remove you from our network until we have time to do that).

All in all, I don't even believe that I.T. is really so "expert" in handling outside threats and attacks. How can we be? We usually don't have access to the source code to the devices we implement and often aren't even good enough at coding to figure out what it meant if we were. Ever get caught in that "balancing act" where you want to apply all new updates to a system to ensure it's "as secure as possible" but some of those updates aren't supported by mission critical software also loaded on the box? Ever do the updates that are pushed out only to find they break a server? (I sure have, especially with some of Microsoft's "recommended updates" that they later recalled and revisited.) Eventually, it happens to most sysadmins that they cause real and immediate problems trying to prevent theoretical security-related ones.

Re:Indeed

[mjwalshe]

in 95% of companies the CEO is just another employee

Re: outside malicious activity

[gd2shoe]

It sounds like you have spent some time and effort to address the situation on your network relative to your needs. I've seen shops where the policy was to bury their heads in the sand.

All in all, I don't even believe that I.T. is really so "expert" in handling outside threats and attacks. How can we be? We usually don't have access to the source code to the devices we implement and often aren't even good enough at coding to figure out what it meant if we were.

I didn't actually use the word "expert", but "professional" -- as in, it's part of the IT profession to understand and manage such risks.

Knit-picking aside, someone must determine various risks, attack vectors, and ways to deal with them. Like it or not, that's part of IT. That doesn't mean perfect security, releasing your own patches, or being omniscient. It does mean addressing the big three in a reasoned, balanced way: data confidentiality, integrity, availability. It does mean following industry guidelines and keeping your ear to the ground (metaphorically speaking) for changes in the field. It doesn't mean knowing each and every unpatched zero-day exploit, but it does mean knowing the broad types of exploits and how to avoid or recognize and recover from them.

Again, I largely agree with you, and think our stances aren't terribly different.

Monkey spunk

[Hognoxious]

Because you own the device, you have certain rights to what is on the device and what you can do with the device.

And because I own the workplace, I define the range of what you can do:
1) You conform to corporate policy (i.e. you do what I say).
2) You leave it at home.
3) You shove it up your ass, sideways, and waddle by HR on your final journey to the door.
--
    Your friendly neighborhood PHB

Managers and IT staff get it wrong

[Trogre]

When people do finally "get" what BYOD actually is, they'll realise how stupid it is in nearly every business environment.