We all know the wonderful term BYOB. We also know the term
BYOD. While the acronym BYOD is only one letter different, it’s not nearly as
fun yet it’s equally as necessary.
Let’s discuss the current state and movement of the IT
industry. Over the past few years tablets have grown to become an additional
necessity to our lives, smartphones have gotten bigger and smarter, and
operating systems that once catered to the workstation lifestyle now cater to
the mobile device lifestyle. The once known “personal computer” is slowly
evolving to become the “personal device”. Today, we do still have a line
between smartphone, tablet and PC but that line is extremely blurry. Only one
day a week when the moon and sun align just right can we see that this line
exists.
What’s the problem with that? We all love our big screens and skinny tablets. The problem comes when attempting to write any sort of BYOD policy for a company. This blurry line does not line up well with the well-defined, black and white line that policies draw in the sand. This device evolution makes the attempt to declare what a device is, and how you can use it in the enterprise more difficult every day… or does it?
A common thought is that a smartphone poses less risk than a
tablet, and a tablet poses less risk than a laptop. Why do we think this and
where did it come from? Size. Our subconscious makes us think that “hey, this
little thing in my hand is so tiny, it’s not nearly as powerful of a device as
that laptop sitting over there… you can do ANYTHING with that laptop, this
phone is limited”. Organizations need to understand that in order to keep ahead
of this we need to be more vague and encompassing in our policies. No matter
what electronic device: smartphone, laptop, tablet, smartablet, laphone,
tabletop… you get the idea; it is in the end, a device. Size does not matter. A
smartphone can be loaded with all the hacker tools that a laptop can. In fact,
maybe we should consider smartphones a larger risk than laptops. Who’s going to
stop a stranger looking down at their smartphone walking around your building?
How about a laptop? Yeah, that’s right… the laptop looks more suspicious.
Let’s go back to how the evolution in mobile devices makes writing policies more difficult. A lot of the time people go at this from the wrong angle. They ask the question: “What kind of devices do we want to address? Smartphones and tablets? Only laptops?” What we need to be doing is classify devices not by what they are or who owns them but what do we know about them? If we take the policy and instead of making tons of classification buckets (personal phone, company phone, personal tablet, company tablet, personally purchased company tablet… etc…) we make two: managed and unmanaged. Stop trying to quantify the risk differences in these devices and keep them all under the same tree as a “device”. This in fact is why it’s called “BYOD” and not BYOPC, BYOT, BYOSP, BYOLT.
If we stop thinking about the risk associated with your smartphones
and instead think about the risk associated with unmanaged devices it will put
us in a position to weather the mobile device evolution. If someone wants to
bring in their own device and gain access to your network; that device must be
moved from the unmanaged classification to the managed classification. You and
your company’s requirements determine what those two categories mean.
