By Mike Sarokin, HP Fellow, HP Enterprise Services
Bring Your Own Device (BYOD) policy is a large enterprise security debate. As employees embrace innovative tablets and smartphones that allow them to work from any location, BYOD is causing concern for many enterprises. One of the fundamental responsibilities of Enterprise IT is to protect the company assets, and data on employees’ personal devices extends the enterprise risk into areas of concern.
About 61 percent of business leaders in the U.K.—and 58 percent in the U.S.—believe BYOD poses a much greater enterprise security risk than company-issued devices, according to a study by ISACA (formerly the Information Systems Audit and Control Association). However, John Pironti, an advisor with ISACA and president of IP Architects, suggests that the devices are being given too much credit.
“The data is where the focus needs to be, not the device,” he says. “It’s the same conversation we’re having about the cloud. The real questions for the enterprise are: Do we want to allow these devices to touch everything? And we don’t have control over where it’s stored? Probably not.”
BYOD policy isn’t entirely new
Although the proliferation of personal mobile devices blurring the lines with work life is relatively new, the conversation about what will be allowed on employee-owned devices is not. It began in the 1990s with laptops, and has merely evolved with technology—and seemingly without resolution.
“If focusing on the device was the answer, we would have solved this problem years ago,” Pironti notes. “Everyone wants to talk about the widget, but they need to focus on the data first and the technology second. The device is just a vessel; the value is in the data. You have to decide what environments that data will be allowed to operate in, according to your individual risk appetite.”
To do that, Pironti says the enterprise must classify its data and establish criteria for what will—and won’t—be allowed on employee-owned devices. When data reaches a certain level of sensitivity, it would be prohibited, which means high-level executives would probably not be candidates for using their own devices to store and transport company information.
Other enterprise BYOD policies could include:
Safeguarding enterprise devices
“Mobile device usage is like ants marching. You can’t stop it. But it’s time to think about the problem differently,” Pironti says. “We need to stop fighting with BYOD, we need to embrace this immediately and educate users on our expectations.”
Increased education will result in a more security-aware user. However, security audits will be needed to reinforce the corporate policy.
“Users can become our greatest asset,” Pironti says. “Because as we educate them about the threats and vulnerabilities on their devices, and educate them as to why they might want to use them more carefully, they are going to work with us to keep that information secure.”
Security in the cloud is also high on the list of challenges for today’s enterprise. Join HP Fellow Ed Reynolds in his Innovation INSIGHT webcast, It’s About Securing Your Enterprise, Not Your Cloud.
