Preparing for Mobile Device Management & Bring your Own Device

Editor's Notes

• #4: Blured line – mobilily is already part of the major workforces, it is no longer a question of whether to do/alow it or not, it is more which devices/OS’s are supported
• #10: NR
• #17: Not either or.. Highlight Myths MDM Corp – MAM BYOD – it’s not necessarily the case Apps need to be developed
• #18: Bring your own device (BYOD) (also called bring your own technology (BYOT), bring your own phone (BYOP), and bring your own PC (BYOPC)) refers to the policy of permitting employees to bring personally owned mobile devices (laptops, tablets, and smart phones) to their workplace, and to use those devices to access privileged company information and applications.[1] The term is also used to describe the same practice applied to students using personally owned devices in education settings http://en.wikipedia.org/wiki/BYOD
• #20: CH
• #21: BYOD is happening! Mobility is already part of the major workforces, it is no longer a question of whether to do/allow it or not, it is more which devices/OS’s are supported 10% who do not support are probably still being bypassed!
• #22: Emails Laptops Devices USB Direct Access/VPN Work folders (New to Windows 8) From the “cloud”. E.g. Office 365/Google Apps Rights Management Data classification User policies help, but without technology to enforce user error or misuse can still happen
• #23: DPA penalties and the ICO (Information Commissioners Office) – up to £500,000 and can lead to prison sentances http://ico.org.uk/enforcement/fines
• #28: NR
• #29: http://www.microsoft.com/en-gb/business/community/hints-and-tips/design-your-byod-acceptable-use-policy Lawyers are still arguing over the intricacies of BYOD Acceptable Use Policies (AUP). In truth, it is probably impossible to define a watertight legal framework at this moment. However, even the smallest company can benefit from identifying the challenges and mitigate them by having clarity on paper where possible. Our experts, Cesare Garlati (CG) and Jessica Keyes, Ph.D. (JK) offer this powerful Top Ten as a starting point: Privacy (CG). Mobile Device Management tools are the software which secure company information when it’s on a mobile device, whether connected to the company network or not. That’s fine when it’s a company computer, but what if you’re monitoring traffic on an employee’s PC? Without clear rights and responsibilities, this represents an invasion of privacy, or possibly even hacking. Who pays for what? (JK). When an employee uses their own device for both work and play, overages of both phone and data usage can easily occur. Who pays for what must be clearly spelled out. Your policy should precisely define which categories the business will cover, and which not. This will also indemnify you against any potential fringe benefit tax issues. Third Parties (CG). Personal devices are often shared around the family – think of the laptop or tablet which Dad shares with the kids, for example. Even a watertight acceptable use policy can’t be signed on behalf of other family members. Your employees cannot be held responsible for their kids’ use of a family device: if that affects your attitude to data, then it also ought to affect your attitude to BYOD. Work v. Play: what we do after hours (JK). The fundamental challenge of BYOD is differentiating between work activities and what employees do when off the clock. As ever, on a company-purchased device, AUPs can clearly define what users may do. On an employee-owned device, things are much less clearly defined. There are plenty of situations where an employee may be using their device, in their own time, and therefore the relevance of their actions may only be apparent because the company has been able to discover it at a later date; a discovery which would not have been possible if the home/work gulf had not been breached. What, for example, if an employee makes a defamatory or discriminatory remark on a social network, or even in a private email? Work v. Play: what we do in work (JK). The same issues apply on the job. Even on their own device, it’s unacceptable for an employee to engage in harassment, or to compromise workplace safety (for example by texting whilst driving). Company responsibility for personal data (CG). Garlati notes that his own son woke up one morning and, in an understandably desperate bid to play Angry Birds, tried multiple passwords on a tablet and thus triggered the Remote Wipe security function. That’s a great security tool, rightly mandated by the company to protect its data. But when the wipe occurred, what about all the personal photos etc. on the machine? It is arguable that the business could be responsible for them – even if the wipe was caused by a genuine thief! Licensing (CG). Home computers usually include home-use licensing of software. If that software is then used for commercial purposes, not only is the employee breaching the terms of their license, but the company can be accountable as an accessory to the license infringement. Microsoft offers licenses of Office software under Office 365 Small Business Premium to resolve precisely this problem. Your HR Conduct (JK). The electronic record of an employee’s device usage may be used against you- especially after acrimonious terminations. It could, for example, show that an employee is working all hours of the day and night (even without your knowledge) – which might bring up issues of liability for unrecorded overtime, or minimum wage problems. Device Disposal (CG). It’s an employee’s right to dispose of their old property however they want. There are apocryphal stories of phones left on planes and in taxis ending up on eBay. Businesses must, of course, require Remote Wipe functions to be activated, and an AUP should also include the condition that company data is rigorously removed before planned disposal. Litigation (CG). Finally, if your company should find itself mired in litigation, the court can seize devices for ‘e-discovery’; i.e. the hunt for electronic evidence; even if it’s a personally owned device. Your employee probably won’t get it back soon, if at all; and their personal content will likely be exposed.
• #33: http://www.macrumors.com/2014/02/17/ios-7-1-mdm/
• #34: CH