Reference no: EM133209916

Is BYOD Good for Business?

Just about everyone who has a smartphone wants to be able to bring it to work and use it on the job, and many employers would like workers to do so. A survey of BYOD trends by MarketsandMarkets found that adoption rates among North American companies approached 50 percent by the start of 2018. Research from Sapho workplace productivity experts found the average worker saves 81 minutes per week in productivity by using a personal device at work.

Will BYOD become the new normal? Not necessarily. Half of all enterprises believe that BYOD represents a growing problem for their organizations, according to a number of studies. Although BYOD can improve employee job satisfaction and productivity, it also can cause a number of problems if not managed properly. Support for personally owned devices is more difficult than it is for company-supplied devices, the cost of managing mobile devices can increase, and protecting corporate data and networks becomes more difficult.

When every employee brings his or her own device to work, IT departments lose almost all control over the hardware. They can't control what apps or programs are installed, how the devices are secured, or what files are downloaded. In the past, the firm was able to control who had what technology in order to prevent privacy breaches, hacking, and unauthorized access to corporate information. Inability to control the hardware means more vulnerabilities. That is the big tradeoff with BYOD: offering employees greater flexibility while potentially exposing the company to danger.

BYOD advocates have argued that it increases employee productivity, but that is not always the case. When employees bring their own devices to work, they may be tempted to use them on the job for entertainment or catching up with friends. It's incredibly easy for employees to get sucked into an endless black hole of text messaging, YouTube videos, and checking Facebook updates. Productivity will suffer (see the Chapter 7 Interactive Session on Management).

BYOD requires a significant portion of corporate IT resources dedicated to managing and maintaining a large number of devices within the organization. In the past, companies tried to limit business smartphone use to a single platform. This made it easier to keep track of each mobile device and to roll out software upgrades or fixes because all employees were using the same devices or, at the very least, the same operating system. Today, the mobile digital landscape is much more complicated, with a variety of devices and operating systems on the market that do not have well-developed tools for administration and security. Android has over 80 percent of the worldwide smartphone market, but it is more difficult to use for corporate work than Apple mobile devices using the iOS operating system. iOS is considered a closed system and runs only on a limited number of different Apple mobile devices. In contrast, Android's fragmentation makes it more difficult and costly for corporate IT to manage. There are about 25,000 different models of Android-based devices available around the world, according to a report by OpenSignal, which researches wireless networks and devices. Android's huge consumer market share attracts many hackers. Android is also vulnerable because it has an open source architecture and comes in multiple versions.

If employees are allowed to work with more than one type of mobile device and operating system, companies need an effective way to keep track of all the devices employees are using. To access company information, the company's networks must be configured to receive connections from that device. When employees make changes to their personal phone, such as switching cellular carriers, changing their phone number, or buying a new mobile device altogether, companies will need to quickly and flexibly ensure that their employees are still able to remain productive. Firms need a system that keeps track of which devices employees are using, where the device is located, whether it is being used, and what software it is equipped with. For unprepared companies, keeping track of who gets access to what data could be a nightmare.

With the large variety of mobile devices and operating systems available, providing adequate technical support for every employee could be difficult. When employees are not able to access critical data or encounter other problems with their mobile devices, they will need assistance from the information systems department. Companies that rely on desktop computers tend to have many of the same computers with the same specs and operating systems, making tech support that much easier. Mobility introduces a new layer of variety and complexity to tech support that companies need to be prepared to handle.

There are significant concerns with securing company information accessed with mobile devices. If a device is stolen or compromised, companies need ways to ensure that sensitive or confidential information isn't freely available to anyone. Mobility puts assets and data at greater risk than if they were only located within company walls and on company machines. Marble Security Labs analyzed 1.2 million Android and iOS apps and found that the consumer apps on mobile devices did not adequately protect business information. Companies often use technologies that allow them to wipe data from devices remotely or encrypt data so that if the device is stolen, it cannot be used. You'll find a detailed discussion of mobile security issues in Chapter 8.

Intel was a pioneer in the BYOD movement and has successfully implemented an enterprise-wide policy covering more than 30,000 employee mobile devices. Another major issue surrounding a corporate BYOD policy is the potential lack of trust between workers and management when management has access to personal data on employee devices. To deal with this issue, Intel has established clear-cut guidelines informing employees about exactly what information can and can't be seen when administrators manage personal devices. Intel will quickly respond to any questions employees might have regarding BYOD. The company also allows employees to choose among different levels of mobile access to corporate systems, with each tier accompanied by different levels of security.

SAP, a leading global vendor of enterprise software, is another tech company that has implemented BYOD successfully. The company developed a specialized mobile platform for various work-related applications, enabling employees to work from anywhere with their mobile devices. SAP has also created a security system for decommissioning a mobile device within a minute whenever a smartphone or tablet is lost or stolen. All SAP divisions across the globe have reported some form of success with BYOD. SAP Australia/New Zealand reports that the policy is key in attracting younger workers who are attached to their mobile devices and constantly use the apps.

The global reinsurance giant Swiss Re believes every employee should be able to work in the way they choose and has more and more staff using their own smartphones and tablets to access its intranet and personal information management (PIM) apps. Swiss Re successfully implemented BYOD by choosing a secure, highly scalable Enterprise Mobility Management (EMM) system that could support multiple operating systems, and a local partner to manage all of its technical and organizational aspects.

Over the past six years, 4,500 employee-owned iPhones and iPads have been added to the system alongside existing company devices. About one-third of the smartphones and tablets are company-owned and the other two-thirds are owned by employees of Swiss Re. Swiss Re manages these devices using MobileIron's EMM system, which enables global enterprises to secure and manage modern operating systems in a world of mixed-use mobile devices and desktops. It incorporates identity, context, and privacy enforcement to set the appropriate level of access to enterprise data and services.

The multi-OS EMM solution was rolled out with the help of local partner Nomasis AG. Likewise, Android is a possibility in the future. If it meets the company's security requirements, staff wishing to use Android devices will probably be allowed to do so as part of Swiss Re's BYOD strategy, obviously within the framework of MobileIron.

Supporting nearly all current mobile operating systems is a big technical and organizational challenge for Swiss Re, but management feels it has been worthwhile. Mobile devices have helped the company experience a significant rise in user productivity, because staff can access documents more quickly, whether they're in the office or traveling on business.

Blackstone, a global investment and advisory firm, has implemented a BYOD policy, but it has placed limitations on the types of devices employees can use. Blackstone's BYOD policy only allows employees to use their own Apple products such as iPads. For that company, Apple devices were the easiest to support and required little maintenance compared to other mobile tools. Any other devices would add to the workload of Blackstone's IT department, thus eliminating the cost savings that often come with BYOD. Due to Apple's popularity, few employees have objected.

At Venafi, a cybersecurity company, employees have the option of bringing their own smartphones, tablets, and notebooks to work with them or using company-issued devices. The company has a well-developed BYOD policy. Venafi's IT department does not support employees' hardware devices because it would be too difficult to handle all the different mobile devices and software available to consumers. That means employees are responsible for troubleshooting and repairs of their personal equipment. However, Venafi does ensure that each device is securely connected to the corporate network.

According to Tammy Moskites, Venafi CISO and CIO, the biggest challenge in defining a BYOD policy that leaves everyone satisfied has been balancing risk with flexibility. Although Venafi has given employees the choice of using their own mobile devices, it has also written contracts with language describing the terms and conditions for bringing one's own device into work, including the ability to remove company data from the device if needed.

Many corporate BYOD policies restrict access to time-wasting sites like Facebook, YouTube, or Twitter. But Venafi management believes that instead of resorting to measures like blocking YouTube or Facebook and forbidding the use of mobile phones, companies should focus more on performance. As long as the employees are motivated and performing well, they shouldn't be subjected to unnecessary restrictions. Employees typically don't understand the implications of BYOD and the dangers of lax security. Venafi's IT department tries to educate employees about realities of BYOD and gives them the power to use their devices responsibly.

Iftekhar Khan, IT director at Toronto's Chelsea Hotel, remains less sanguine. He believes BYOD might work for his company down the road but not in the immediate future. Khan notes that the hospitality industry and many others still want employees to use corporate-owned devices for any laptop, tablet, or smartphone requiring access to the corporate network. His business has sensitive information and needs that level of control. Although the hotel might possibly save money with BYOD, it's ultimately all about productivity.

Question 1. What are the advantages and disadvantages of allowing employees to use their personal smartphones for work?

Question 2. What management, organization, and technology factors should be addressed when deciding whether to allow employees to use their personal smartphones for work?

Question 3. Evaluate how the companies described in this case study dealt with the challenges of BYOD.

Question 4. Allowing employees to use their own smartphones for work will save the company money. Do you agree? Why or why not?