BYOD Policies – More than an IT Issue Part 3: Economics

#BYOD or Bring Your Own Device has moved from trend to an permanent fixture in today's corporate IT infrastructure. It is not strictly an IT issue however. Many groups within an organization need to be involved as they grapple with the risk of mixing personal devices with sensitive information.  In my opinion, BYOD follows the classic Freedom vs. Control dilemma. The freedom for user to choose and use their desired device of choice verses an organization's responsibility to protect and control access to sensitive resources. While not having all the answers, this mini-series tries to ask many the questions that any organization needs to answer before embarking on a BYOD journey.

Enterprises should plan for rather than inherit BYOD. BYOD policies must span the entire organization but serve two purposes - IT and the employees. The policy must serve IT to secure the corporate data and minimize the cost of implementation and enforcement. At the same time, the policy must serve the employees to preserve the native user experience, keep pace with innovation and respect the user's privacy.  A sustainable policy should include a clear BOYD plan to employees including standards on the acceptable types and mobile operating systems along with a support policy showing the process of how the device is managed and operated.

Some key policy issue areas include: Liability, Device Choice, Economics, User Experience & Privacy and a trust Model.  Today we look at Economics.

Many organizations look at BYOD as an opportunity to reduce some costs. Clearly, not having an equipment cost - $200-$600 per-device - can add up depending on the company's size. It might also make financial sense for a smaller company with few employees. Since the phone is owned by the employee, then they are probably responsible for the bill every month. Depending on their personal contract/plan, excessive charges could arise due to the extra minutes used for work related calls. Often, monthly charges are fairly consistent with established plans, and while there are times when the bill is higher due to an incidental charge to some other overage, many people fail to review their phone bill when it arrives. BYOD could force employees into a higher monthly service plan but it also gives users visibility into their usage, if for instance, the corporate BYOD policy allows for reimbursement. This can drive personal responsibility for how they use their minutes.

While BYOD could reduce the overall expenditure for IT issued devices and many organizations report employees are happier and more productive when they are using the device of their desire (an enablement tool), there might be other areas that costs could increase.  While the employee does spend their own money on the device, there are certainly enterprise costs to managing and securing that device.  There could also be a snag however when it comes to licensing.  Does BYOD also require Bring Your Own License?  In many instances, this is an area that IT needs to keep an eye on and often the answer is yes. 

Some of the most common enterprise software licensing agreements require licensing any device used "for the benefit of the company" under the terms of the enterprise agreement.  That often means that all those BYO devices might require a license to access common corporate applications.  This also means that even if the user already has a particular license, which they purchased on their own or it came with the device, the organization might still need to license that device under their enterprise software agreement.  This could diminish any cost savings from the BYOD initiative.  There are solutions to such as using alternative products that are not restricted by licensing but, those may not have the key features required by the workforce.  IT needs to understand if their license agreements are per-user or per-device and what impact that may have on a BYOD policy.

A few questions that the Finance department should determine is: Should the company offer users a monthly stipend? How is productivity measured?  Will the management and security cost more than IT (volume) procurement?  What are the help desk expenses and policy about support calls. There certainly needs to be discussion around mobile app purchase and deployment for work use. Are there any compliance, additional audit costs or tax implications with a BYOD initiative?

As part of the BYOD Policy the Economics Checklist, while not inclusive, should:

· Investigate the effects of a BYOD reimbursement plan on your ability to negotiate with wireless carriers

· Consider putting logging and reporting in place to monitor after-hours use

· Incorporate a “help desk as a last resort” guideline into your employee BYOD social contract

· Estimate costs for any increased need for compliance monitoring

· Ask Finance about tax implications (cost or benefit) of a BYOD policy

 

ps

Related

• BYOD Policies – More than an IT Issue Part 1: Liability
• BYOD Policies – More than an IT Issue Part 2: Device Choice
• BYOD–The Hottest Trend or Just the Hottest Term
• FBI warns users of mobile malware
• Will BYOL Cripple BYOD?
• Freedom vs. Control
• What’s in Your Smartphone?
• Worldwide smartphone user base hits 1 billion
• SmartTV, Smartphones and Fill-in-the-Blank Employees
• Evolving (or not) with Our Devices
• The New Wallet: Is it Dumb to Carry a Smartphone?
• Bait Phone
• BIG-IP Edge Client 2.0.2 for Android
• BIG-IP Edge Client v1.0.4 for iOS
• New Security Threat at Work: Bring-Your-Own-Network
• Legal and Technical BYOD Pitfalls Highlighted at RSA

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

 

Connect with Peter:	Connect with F5:

BYOD Policies – More than an IT Issue Part 2: Device Choice

#BYOD or Bring Your Own Device has moved from trend to an permanent fixture in today's corporate IT infrastructure. It is not strictly an IT issue however. Many groups within an organization need to be involved as they grapple with the risk of mixing personal devices with sensitive information.  In my opinion, BYOD follows the classic Freedom vs. Control dilemma. The freedom for user to choose and use their desired device of choice verses an organization's responsibility to protect and control access to sensitive resources. While not having all the answers, this mini-series tries to ask many the questions that any organization needs to answer before embarking on a BYOD journey.

Enterprises should plan for rather than inherit BYOD. BYOD policies must span the entire organization but serve two purposes - IT and the employees. The policy must serve IT to secure the corporate data and minimize the cost of implementation and enforcement. At the same time, the policy must serve the employees to preserve the native user experience, keep pace with innovation and respect the user's privacy.  A sustainable policy should include a clear BOYD plan to employees including standards on the acceptable types and mobile operating systems along with a support policy showing the process of how the device is managed and operated.

Some key policy issue areas include: Liability, Device choice, Economics, User Experience & Privacy and a trust Model.  Today we look at Device Choice.

Device Choice

People have become very attached to their mobile devices. They customize and personalize and it's always with them, to the point of even falling asleep with the device. So ultimately, personal preference or the 'consumerization of IT' notion is one of the primary drivers for BYOD. Organizations need to understand, what devices employees prefer and what devices do employees already own. That would could dictate what types of devices might request access. Once organizations get a grasp on potential devices, they then need to understand each device's security posture.

About 10 years ago, RIM was the first technology that really brought the Smartphone into the workplace. It was designed to address the enterprise's needs and for years was the Gold Standard for Enterprise Mobility. Management control was integrated with the device; client certificate authentication was supported; Active Directory/LDAP servers were not exposed to the external internet; the provisioning was simple and secure; organizations could manage both Internet access and intranet access, and IT had end point control.

When Apple's iPhone first hit the market, it was purely a consumer device for personal use and was not business centric, like the BlackBerry. Initially, the iPhone did not have many of the features necessary to be part of the corporate environment. It was not a business capable device. It did not support applications like Exchange, which is deployed in many organizations and is critical to a user's day-to-day activities. Over time, the iPhone has become a truly business capable device with additional mechanisms to protect end users.  Android, very popular with consumers, also offers numerous business apps but is susceptible to malware.

Device selection is also critical to the end user experience. Surveys show that workers are actually more productive when they can use their personal smartphone for work. Productivity increases since we prefer to use our own device. In addition, since many people like to have their device with them all the time, many will answer emails or do work during non-work hours. A recent survey indicated that 80% of Americans work an extra 30 hours a month on their own time with BYOD. But we are much happier.

A few blogs ago, I wrote about Good Technology’s BYOD survey, found that organizations are jumping on the phenomenon since they see real ROI from encouraging BYOD.  The ability to keep employees connected (to information) day and night can ultimately lead to increased productivity and better customer service.  They also found that two of the most highly regulated industries - financial services and health care - are most likely to support BYOD.  This shows that the security issues IT folks often raise as objections are manageable and there's major value in supporting BYOD.  Another ROI discovered through the survey is that since employees are using their own devices, half of Good’s customers don't pay anything for the employees' BYOD devices – essentially, according to Good, getting employees to pay for the productivity boost at work.

As part of the BYOD Policy the Device Choice Checklist, while not inclusive, should:

· Survey employees about their preferences and current devices

· Define a baseline of acceptable security and supportability features

· Do homework: Read up on hardware, OS, and regional variances

· Develop a certification program for future devices

· Work with Human Resources on clear communication to employees about which devices are allowed–or not–and why

ps

Related

• BYOD Policies – More than an IT Issue Part 1: Liability
• BYOD–The Hottest Trend or Just the Hottest Term
• FBI warns users of mobile malware
• Will BYOL Cripple BYOD?
• Freedom vs. Control
• What’s in Your Smartphone?
• SmartTV, Smartphones and Fill-in-the-Blank Employees
• Evolving (or not) with Our Devices
• The New Wallet: Is it Dumb to Carry a Smartphone?
• Bait Phone
• BIG-IP Edge Client 2.0.2 for Android
• BIG-IP Edge Client v1.0.4 for iOS
• New Security Threat at Work: Bring-Your-Own-Network
• Legal and Technical BYOD Pitfalls Highlighted at RSA

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

BYOD Policies – More than an IT Issue Part 1: Liability

#BYOD or Bring Your Own Device has moved from trend to an permanent fixture in today's corporate IT infrastructure. It is not strictly an IT issue however. Many groups within an organization need to be involved as they grapple with the risk of mixing personal devices with sensitive information.  In my opinion, BYOD follows the classic Freedom vs. Control dilemma. The freedom for user to choose and use their desired device of choice verses an organization's responsibility to protect and control access to sensitive resources. While not having all the answers, this mini-series tries to ask many the questions that any organization needs to answer before embarking on a BYOD journey.

Enterprises should plan for rather than inherit BYOD. BYOD policies must span the entire organization but serve two purposes - IT and the end users. The policy must serve IT to secure the corporate data and minimize the cost of implementation and enforcement. At the same time, the policy must serve the employees to preserve the native user experience, keep pace with innovation and respect the user's privacy.  A sustainable policy should include a clear BOYD plan to employees including standards on the acceptable types and mobile operating systems along with a support policy showing the process of how the device is managed and operated.

Some key policy issue areas include: Liability, Device choice, Economics, User Experience & Privacy and a trust Model.  Today we look at Liability.

Liability

In addition to IT, an organization's Legal department needs to be involved with any BYOD policy creation to make sure the liability risk for both the user and company is contained and managed. While employees are an organization's greatest asset (other than Intellectual Property, potentially), they are often the culprits of data exposure, intentional or not. Organizations need to consider employee actions and the corresponding liability. If the employee owns the device, does the liability increase or decrease? Even if liability stays neutral, the overall business risk increases any time corporate data is accessed from personal employee devices, mobile or not.

What happens if personal data on a personal Smartphone is damaged? What happens if it's remotely wiped by corporate IT, if it is lost? These are some areas that must be resolved with the BYOD policy. Some organizations are very clear about lost/stolen policy and users have the choice of opting out. That's just the personal liability.

From a financial liability standpoint, what happens when monthly charges are reimbursed? Often, financial responsibility may dictate legal obligation.

A recent Ponemon Institute and Websense survey showed that mobile devices can be a double-edge sword for enterprises.  77% of the 4640 responses said that the use of mobile devices in the workplace is important to achieving business objectives but almost the same percentage - 76% -  believe that these tools introduce a "serious" set of risks.  While organizations understand the risks, the survey showed that only 39% have security controls in place to mitigate them.  As a result, 59% of respondents said they’ve seen a jump in malware infections over the past 12 months due, specifically, to insecure mobile devices including laptops, Smartphone, and tablets while 51% said their organization has experienced a data breach due to insecure devices.

As part of the BYOD Policy the Liability Checklist, while not inclusive, should:

· Define baseline security requirements

· Assess liability of personal web and app usage

· Evaluate legal ramifications of reimbursement

· Quantify the costs of monitoring and enforcement

· Assess the risk and liability of damaging personal data

There are probably a ton more Liability questions that should be answered but this was intended as a starting point.  What other areas should legal be concerned about?

 

ps

Related

• BYOD–The Hottest Trend or Just the Hottest Term
• Will BYOL Cripple BYOD?
• Freedom vs. Control
• What’s in Your Smartphone?
• SmartTV, Smartphones and Fill-in-the-Blank Employees
• Evolving (or not) with Our Devices
• The New Wallet: Is it Dumb to Carry a Smartphone?
• Bait Phone
• BIG-IP Edge Client 2.0.2 for Android
• BIG-IP Edge Client v1.0.4 for iOS
• New Security Threat at Work: Bring-Your-Own-Network
• Legal and Technical BYOD Pitfalls Highlighted at RSA

 

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

The Evolution of Trade Show Badges

I’ve been to a few trade shows over the years and have noticed a change in the badges we wear at these events.  These wear-for-a-week necklaces offer our name, company, job title and our affiliation to the specific conference – speaker, exhibitor and so forth.  Some are high-tech also.  I have many from years ago that are printed on heavy paper stock to the ones that are on a blank piece of plastic.  I even remember the old sticker ‘HELLO’ name badges from some early conferences.   These days, many have embedded chips, printed bar codes and QR codes for the booth lead scanners along with verifying that certain people have the proper credentials (full conference vs. expo only) to attend specific sessions.  Yes, technology has even infiltrated our trade show badges.  I would imagine that a decade from now, the badges would have a little LCD/LED (or whatever the hologram technology is in 10 years) screens on the back of the badge and that would allow you to watch the current keynote right from the badge itself!  Now, that would be cool. 

I especially like the badges that have a slew of identifiers hanging off the bottom.  You’ve seen them, the ones with speaker, alumni, distinguished something, superhero, all hanging like the flags at the U.N.  They could double as a tie depending on length and color.

Even the piece that we put around our neck has changed to some extent.  The thin rope type seem to be fading into the more flat ribbon type with the sponsor’s name printed down the sides.  Those are a lot more comfortable but I can’t seem to keep the name part facing forward.  Oh yes, there are those clips with the ball-joint to twist the badge yet mine always seems backwards.  Of course those are the single clip kind in the middle but there are also the double clip that does keep the badge forward.  Sometimes analysts like to keep their badge flipped so you can’t tell who they are in an attempt to converse and have you potentially spill something that should not be shared with an industry analyst.   All mesmerizing stuff, I know.

So as TV’s, smartphones, computers, cars and all those other obvious technology type advances astound, don’t forget about all the other ancillary things we use that are also making advances, albeit not as splashy.  And if you’re wondering what events F5 will be at, check out our Events calendar on the newly redesigned f5.com

ps

Resources:

• Bringing Trade Shows to Life with RFID
• Evolution of Trade Shows (part 1): “Virtually There”
• Evolution of Trade Shows (part 2): “The Hybrid”
• Radio Killed the Privacy Star
• F5 Events Calendar
• F5 YouTube Channel

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

Oracle OpenWorld 2012: The Video Outtakes

The video takes, mistakes and outtakes from Oracle OpenWorld 2012.  Actually, I only had one this time (maybe due to the MEC2012 practice) so truth be told, this is really the Mahea screen test and outtakes edition of the OOW videos.  She excels at promoting F5 as you can see.  And if you missed any of the OOW vids, they are listed below.

 

ps

Related:

• Oracle OpenWorld 2012: Find F5
• Oracle OpenWorld 2012: Gimmie 90 Seconds
• Oracle OpenWorld 2012: BIG-IP Solutions for Oracle Enterprise Manager
• Oracle OpenWorld 2012: BIG-IP ASM and Oracle Database Firewall Integration
• Oracle OpenWorld 2012: BIG-IP Integration with Product Development
• Oracle OpenWorld 2012: BIG-IP APM Integration - Oracle Access Manager
• Oracle OpenWorld 2012: BIG-IP Optimizing Oracle GoldenGate
• Oracle OpenWorld 2012: That’s a Wrap
• F5 Solutions for Oracle applications
• F5 YouTube Channel

Technorati Tags: F5, oracle openworld, integration, Pete Silva, security, business, education, technology, application delivery,cloud,oracle, oow2012

Connect with Peter:	Connect with F5:

Oracle OpenWorld 2012: That’s a Wrap

I wrap up Oracle OpenWorld from San Francisco. Special thanks to you, the viewers, along with F5ers Ron Carovano, Chris Akker, Dennis Zhou, Dawn Parzych, Jonathan George, Robert Rexford and the entire booth staff including Sphero. And a very special Mahalo to The Mahea, F5's youngest TMM, for helping us find Booth 1527 at #OOW 2012. Great job everyone!

 

ps

Related:

• Oracle OpenWorld 2012: Find F5
• Oracle OpenWorld 2012: Gimmie 90 Seconds
• Oracle OpenWorld 2012: BIG-IP Solutions for Oracle Enterprise Manager
• Oracle OpenWorld 2012: BIG-IP ASM and Oracle Database Firewall Integration
• Oracle OpenWorld 2012: BIG-IP Integration with Product Development
• Oracle OpenWorld 2012: BIG-IP APM Integration - Oracle Access Manager
• Oracle OpenWorld 2012: BIG-IP Optimizing Oracle GoldenGate
• Oracle OpenWorld 2012: That’s a Wrap
• F5 Solutions for Oracle applications
• F5 YouTube Channel

Technorati Tags: F5, oracle openworld, integration, Pete Silva, security, business, education, technology, application delivery,cloud,oracle, oow2012

Connect with Peter:	Connect with F5:

Oracle OpenWorld 2012: BIG-IP Optimizing Oracle GoldenGate

Peter Silva interviews F5 Product Manager, Dawn Parzych, to learn more about F5's Optimization Solutions for Oracle GoldenGate replication software and how BIG-IP WOM can greatly reduce bandwidth and significantly improve throughput performance by 30-50%.

ps

Related:

• Oracle OpenWorld 2012: Find F5
• Oracle OpenWorld 2012: Gimmie 90 Seconds
• Oracle OpenWorld 2012: BIG-IP Solutions for Oracle Enterprise Manager
• Oracle OpenWorld 2012: BIG-IP ASM and Oracle Database Firewall Integration
• Oracle OpenWorld 2012: BIG-IP Integration with Product Development
• Oracle OpenWorld 2012: BIG-IP APM Integration - Oracle Access Manager
• F5 YouTube Channel

Technorati Tags: F5, oracle openworld, integration, Pete Silva, security, business, education, technology, application delivery,cloud,oracle, oow2012

Connect with Peter:	Connect with F5: