This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →

Everyone is talking about it these days: how it's a huge risk, it's hard to manage, it's getting out of control, there are lots of unknowns, and since it's new, ...blah blah

First off, it's really not new, it's only newly recognized as a phenomenon, because of consumerism and technology becoming more accessible to ordinary people. These forms of BYOD already existed before, in the sense that they put a foreign system in contact with (or reach in from) the organization's systems:


Corporate IT buzzwords get popularly made official once the problem is popularly understood, but that in no way means it's new...

Another recurring and current problem is "time theft", which is precisely caused/helped in part by BYOD and weighs in the balance, because blocking BYOD entirely is not a solution: it hurts productivity, trust and commitment to the company. Same thing for blocking websites like Facebook, Twitter and co. They may well be time thieves, but they're very popular nowadays and anyway, if they're not reachable through the organization's network, they will be through a smartphone or tethering.

Consumerism brought accessibility to technology and, at the same time, its popularization. Then, being easily accessible and popular, plenty of mass phenomena grew around it, which shows in the long run that it isn't very manageable, whether socially, administratively or technically.  With a cellular network that reaches pretty much everywhere in big cities and in most offices, no need to depend on the work network connection to do what you want anymore!  That doesn't change the fact that external devices sit right next to the company's equipment, though.  Such proximity makes interactions between the 2 kinds of systems inevitable.  And with that, BYOD brings BYOP (Problems!).

A network is already at risk, and the security policies and measures normally in place aim to reduce that risk factor.  Allowing external devices to interact (even more so than USB keys) amounts to increasing the risk of risks.  Their attack surface makes smartphones and other devices prime targets, especially wireless ones, since not everyone is able to locate devices and the range can be pretty surprising...  Other potential headaches include license management and increased access to virtualized resources or cloud services while also having access to internal resources.

Here are some interesting links on the topic:

http://www.technologyreview.com/news/427790/ibm-faces-the-perils-of-bring-your-own-device/

http://www.lemondeducloud.fr/lire-10-evidences-que-les-informaticiens-doivent-accepter-51611.html

For every problem, there are solutions to suggest...


Strict policies can cope with this added risk (not added value), and do so technically, in order to reduce the management of the human factor as much as possible.  To tune those technically enforced policies, in some workplaces, adjusting them based on time slots could be an excellent idea.  However, that wrecks the very reason BYOD has its place (what you want, when you want), and it would be better to focus on network segmentation (VLANs) or a higher-level communication layer for sensitive data.  Once this kind of policy is accepted, it's good to put everything in writing very clearly and to explain the positions well, because all too often a standard isn't stated clearly and abusers take advantage of that "loophole".  Examples of policies to enforce technically:


That's all well and good, but it costs a lot, doesn't it?  Think about the potential risks...  Still thinking about saving money?  Security remains a science of trade-offs against system functionality.  Would it be cheaper to give each employee a preconfigured cell phone, partly paid for by the company and the rest by the employee?  That can enforce control over resources, and the employee can still have what they want...within reason.  In some environments, restrictions that are too strict will hurt productivity and, if they aren't justified, are less likely to matter to staff and therefore be respected...so says the human factor.  The latter requires so much follow-up that it becomes unmanageable, especially since you need some counterweight to "enforce" the rules on offenders.

The further we go, the more it seems we won't escape BYOD one way or another...  Times are changing and end-users are gaining control, like it or not, and the solutions on the market or coming soon are good proof of that...  for example, Ubuntu with their docked smartphones replacing desktop systems.  One essential point not to lose sight of is employee productivity thanks to the working conditions that come with the  BYOD phenomenon (letting them do more or less what they want)), but there's always a trade-off...so the compromise is fair on both sides!