The Challenges Of A BYOD Policy
By Pedro Pereira, Field Technologies magazine
Companies should address cost, legal, and security issues before allowing the use of employee-owned devices.
One way to look at the BYOD (bring your own device) trend in the enterprise is it lets companies off the hook for having to issue their employees mobile devices. But dealing with technology trends is never that simple, and in this case, enterprises are struggling with a host of issues, including IT management, legal policies, regulation compliance, security, and cost, as they seek to implement policies that minimize the risks associated with noncorporate devices tapping their networks.
What complicates this new development is that, as opposed to past practices where companies chose and issued devices based on criteria matching budgetary and strategic goals, with BYOD, employees often decide which device to use. This has staffing and cost implications for IT departments seeking to manage and secure a plethora of devices and platforms. “IT departments can become overwhelmed trying to support multiple hardware devices representing different operating systems and ways to manage them remotely,” says Brad Wall, director of mobility sales at mobile device maker Datalogic. “Multiple devices become a distraction for IT departments — the product cycle is so short today that they will be scrambling to keep up.”
Determining Your BYOD Need
Before setting BYOD policies, companies must decide whether BYOD is right for them. Instead of allowing employees to bring in their smartphones or tablets, a company could simply choose to stick with the practice of issuing, managing, and retaining control over the devices. “This is really no different from how traditional PCs and laptops have been treated, where devices and data are in their most ‘locked-down’ state,” says Vizay Kotikalapudi, senior manager of the Enterprise Mobility Group at security vendor Symantec.
The downside of this strategy, he points out, is expense. Many companies are choosing a different path, a BYODbased model in which the company attempts to manage only the relevant apps and data on the devices. “The benefit here is that companies can save on procurement costs and active management overhead. This can be done securely through mobile application management, which allows safeguards to be applied directly on key business applications and data, negating the need to apply controls over entire devices,” Kotikalapudi says.
Harry Lerner, CEO of Janam, a rugged computing device manufaturer, notes there are benefits to allowing employees to use devices they own because they treat them better than company-issued assets and because “of the comfort of already knowing the device.” But he cautions that BYOD is not right for all applications. “If the tool needs to be used for not just viewing but capturing and manipulating data, BYOD becomes less elegant. Then the device has the potential to bring operations to a standstill if it is not functioning correctly. That’s where BYOD may not make sense. It really needs to be a dedicated, application-specific device that has been built to survive the rigors of the enterprise,” Lerner says.
Wall cautions against deploying a BYOD strategy until an organization has completed an assessment of resources, needs, and potential costs. “Number one is to look at your resources,” he says. “Do you have the resources to manage multiple platforms? If not, don’t go there. BYOD, like all technology, should be enabling productivity to keep employees focused on their tasks. If you can’t support it, then it becomes a distraction.”
Compensation For Use Of Personal Devices
Once a company implements BYOD, it must tackle the question of compensation. Employees want reimbursement for the cost of using their own devices for work. The problem is, wireless service can get expensive, and roaming charges and termination fees generate thousands of dollars in expenses.
Such charges, Brandon Hampton, director at MOBI Wireless Management, a wireless managed service vendor, says can account for more than 25% of the overall wireless expense. Letting employees expense their wireless charges typically leads to a significant increase in wireless costs for the employer, he adds, unless the company caps the allowable expense amount. Caps can solve issues related to roaming and excessive device use, but even with a cap in place, Hampton says there are other costs. “No matter what the level of reimbursement is, processing expense reports is expensive. The internal cost can range from $18 to $30 per report,” he says.
Accounting burdens can lead companies to rethink their BYOD strategies altogether, which is what happened with a company that Wall knows. “The employees wanted to use their own iPhones. Sounds easy enough, but rather than paying one corporate phone bill, 25 employees had to submit expense reports. This taxed the managers and the accounting department.” Ultimately, he says, the company canned the BYOD policy, angering employees.
An alternative to expense reimbursement is a stipend. Stipends, Hampton says, offset some or all of the cost of the device and service. But he points out there is a downside. “Managing this inventory of users can be as difficult and resource-intensive as managing a wireless device inventory.”
Addressing BYOD Complexity
Enterprises must also address a host of other issues related to BYOD, including data protection, network security, and policies to address legal matters and compliance with state and federal regulations. Legal policies can become so complex, notes Lerner, that in some cases it may just be easier to stick with company-issued hardware, which is already set up according to corporate policies.
The legal aspect doesn’t get enough attention, says Hampton. “To combat the scary situation of having corporate data residing on a device that the company doesn’t own and has limited control over, organizations must have an ironclad policy that is enforced rigorously.”