technology: byod 15 The Bring Your Own
Device dilemma Employees are increasingly using their own personal devices for work purposes. Nadine Bhantoa of Penningtons Solicitors LLP examines the pros and cons for businesses
A Bring Your Own Device (BYOD) scheme is an attractive option for organisations looking to provide a more flexible work environment and save on the costs of maintaining employees‘ phones, laptops and tablets. However, it also exposes them to a higher risk of data protection and confidentiality breaches which need to be actively managed.
Data protection
Under the Data Protection Act 1998 (DPA), all organisations must keep personal data secure and take appropriate technical and organisational measures against ‘unauthorised or unlawful processing of personal data and against accidental loss or destruction of or damage to personal data‘.
If an employee uses a personal device to access an organisation‘s systems for work purposes, it is likely that they will also be able to access personal data for which the organisation is responsible. An employee‘s personal use of such devices increases the possibility of damage or unauthorised access to data, particularly if the user introduces a virus from downloading content or if the device is lost or stolen.
Confidentiality
If a business operates a BYOD scheme then it must be clear about what information can be accessed from a personal device. For example, it may be appropriate for a project manager working out of the office to access emails through his own device, but not for an HR employee to use a personal laptop to access payroll information.
BYOD policies
Businesses should manage these risks by implementing a policy to control the use of personal devices for work purposes. The following considerations should be taken into account:
Evaluate if it is appropriate for the BYOD scheme to apply to all
THE BUSINESS MAGAZINE – THAMES VALLEY – APRIL 2013
www.businessmag.co.uk
employees, bearing in mind the nature of information that will be accessible. The organisation should retain its discretion whether or not to allow the use of BYODs and should have the right to deny access to its systems at any time.
Only allow personal devices to be used for work purposes if they comply with the business‘s information security policies.
Require employees to notify the business in the event the device is lost or stolen.
Obtain employees‘ consent to the installation of software that enables remote wiping to protect against unauthorised access.
Consequences
Failure to implement appropriate security measures to protect personal data will be a breach of the DPA and could also put the business in breach of confidentiality provisions in its contracts. The Information Commissioner‘s Office has the power to impose penalties which could include fines of up to £500,000 on the business, rather than the employee at fault.
Details: Nadine Bhantoa
nadine.bhantoa@
penningtons.co.uk www.penningtons.co.uk
Bring your own device (BYOD) to work sounds great but …
Being able to use your own device (laptop, smartphone or tablet) at work and being able to connect seamlessly to other devices and the organisation’s network sounds great. However, Julian Thrussell, security specialist at Ultima Risk Management (URM) raises two notes of caution.
Support
A major concern with BYOD is the time and cost of the IT department supporting a wide range of devices, each of which has its own idiosyncrasies and vulnerabilities. With each new device, there is going to be the problem of bugs and incompatibilities, whereas with old legacy devices, they may not support the latest applications your business wants to use. One cannot overstate the ’economies of scale’ benefits attached to purchasing and supporting a limited number of hardware and software applications.
Security
With BYOD, a major security concern for organisations is the difficulty in controlling the usage of these devices. Corporate policies and processes relating to usage of computers are inevitably a lot harder to apply with BYOD. With the proliferation of devices comes unsupported applications, file sharing, 24/7 social media and huge storage capacity. The more attractive the device and its applications, the greater the likelihood of it being accessed and used at home by family members and friends and also the greater the risk of sensitive corporate
data being compromised. A specific and very real threat to all businesses is that the greater the number of devices, the greater the difficulty in applying anti-virus controls.
Compliance with standards such as ISO 27001 (International Standard for Information Security Management), the Payment Card Industry Data Security Standard (PCI DSS) and Sarbanes Oxley (SOX) is going to be more difficult with BYOD. A key requirement of all these is the need to demonstrate control over the usage of devices. This is going to be more difficult when you don’t own the device. Most devices can be made secure but there is high degree of trust on the users/device owners.
If your company decides to introduce BYOD, Julian Thrussell advises that you think carefully through the implications, revisit your policies and processes and provide staff with training and clear guidelines on what is and isn’t acceptable.
Details:
info@ultimariskmanagement.com 0118-9027450
Julian Thrussell
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40