How to create a BYOD policy
- 26 June, 2012 11:28
Security and support policy
Under the security policy umbrella, Jansen says IT leaders need to be mindful of the fact that devices will get lost or stolen. How then will the organisation protect the organisational data that’s stored on these devices? One option is remote wiping, but then that could seriously fray IT’s relationship with employees.
Does IT also need to have a say in whether a device which has been used for BYOD purposes can be gifted or given to a third party. What happens to the business applications and organisational data which could still be on that iPhone handed down to a child or relative? Other security questions the security policy should answer include whether or not to use authentication, PINs, and remote backup, Jansen says. “How do you back it up and can you use options like the Cloud for it? What happens if I replicate information from the corporate network to the iPhone and then back that up to the cloud, do you know where that data has gone?”
Security doubts have resulted in DiData prohibiting its staff from backing up into the Cloud, Jansen says.
Under the maintenance and support umbrella, Jansen says IT leaders should consider whether to insist on employees having their own maintenance and support programs for smartphones, tablets and laptops. This is because without support, the burden and cost of helping employees with their BYO devices falls on IT. In addition, staff productivity could be affected.
“If I have a corporate device, what kind of support can I expect if I call up the help desk? If I have a personal device, what can I reasonably expect?” Jansen says are some of the questions that should be asked.
However, he warns that things can get tricky when the organisation makes corporate applications available on BYO devices. “For example, we have our online training available on iPhones and iPads. Can people expect support on that if they call up our corporate helpdesk?” he says.
IT projects to support BYOD
Turning to the second and third phases of DiData’s BYOD approach — Refine and Baseline (or normalising your IT environment for BYOD); and, Accelerate and Benefits Realisation (or, ‘Now what can we do?’) — Jansen says probably the most important project the company ran was its Citrix implementation.
“We call it a baseline project and it has been a runaway success,” he says. “What it gives us is the ability for anyone to use any device. I can control the security and application experience [employees] have and they can run any corporate application regardless of the device.”
The next major BYOD supporting project was a mobile device management (MDM) implementation. According to Jansen, MDM forces employees and guests to enrol into DiData’s BYOD program, which then gives IT influence and control over those devices.
“We can now detect whether someone is using a jailbroken device, for example, or if they have overridden the operating system,” he says. “We can also forbid devices that don’t have PINs — which is in our security policy. We can disconnect them from corporate email or stop them from accessing corporate networks.”
When selecting an MDM provider, Jansen advises IT leaders to spend the time assessing options on the market and to consider selecting one which will install a light rather than thick or heavy client on users’ devices.
“If corporate IT makes it too difficult to use that device then the [BYOD] program will fail,” he says. “We made sure it is very light touch but that it gave us the security which we require.”
Given that BYOD devices are invariably Wi-Fi capable, it naturally follows that company Wi-Fi networks also have to be capable of handling a serious uptick in data usage. In DiData’s case, Jansen says the company essentially took its existing Wi-Fi network and threw it out in favour of a new one capable of handling multiple devices. “Right now, the average number of devices per person is three — a computer, a phone and a tablet — and it won’t surprise me if that increases,” he says.
Jansen also suggests that ensuring BYOD users can also gain access to the organisation’s telephony setup is also an important consideration influencing the success of a BYOD program. To this end, DiData implemented a mobility client.
“If someone called my desk phone, my iPhone would ring — not because I’ve diverted the call — but because the iPhone is integrated into the corporate network so that there is ‘single number reach’,” he explains.
“Recently, I was in Europe and I didn’t make a single call back to Australia as I could connect via Wi-Fi back to our corporate telephony In Australia and placing an outbound call from there.”
Lastly, Jansen says DiData has also made use of Microsoft SharePoint quite heavily. “SharePoint has something called SharePoint Workspace,” he explains. “What that does is allow us to replicate data or files from your computer to the network. That by itself is not that fantastic, but when you combine it with Citrix you get full data mobility and you have a form of backup as you have a copy of the file on the network.”
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- HTC unveils new Butterfly s phone that packs more battery life
- Google Glass apps for enterprises coming by early 2014
- iPad 5 rumour rollup for the week ending June 18
- Say 'cheese', Earthlings! Spacecraft to snap home planet pic from deep space
- Social media adds spice to financial services, say banks
Solving the skills conundrum – part 1
Samsung Galaxy S4 vs. HTC One: 5 Reasons to Choose the GS4
High school students still see ICT as ‘sitting at a computer all day’: survey
Does encryption really shield you from government's prying eyes?
Solving the skills conundrum – part 1
How the Cloud Changes the Game for Line of Business Managers in Midsize Companies
It can be argued that what distinguishes midsize businesses most from large and small companies is not size, but attitude. While attitude alone cannot mitigate the challenges faced by midsize businesses, technology can help. And no technology offers more promise than the cloud. This paper, explores midsize business challenges from the perspective, not of the IT department, but of the line of business managers they support. Read on.
Securing the Promise of Virtualisation
For today’s enterprise, this whitepaper identifies three general areas of risk associated with risk; those that are traditionally areas of risk, the hazards that are exclusive to virtualisation and the more recent set of risks that are associated with newly formed hybrid environments. Read more to find out how to keep pace with evolving threats, quicker provisioning and dynamically mobile workloads.
Agentless Security for Virtual Environments
Virtualised datacentres, desktops, and cloud computing should be secured by the same strong protection technologies as physical machines. However, traditional agent-based solutions that are not architected for virtualisation can result in a number of significant operational security issues. Find out more about the first agentless security platform solution.