Bring-your-own-device (BYOD) Policy - An end-user's perspective

[Halcyon]

I'm in the process of re-writing some IT policies at work, including our BYOD policy. Rather than think with my "executives hat" on, I'd love to hear from end-users who might have a BYOD policy at their workplace.

When it comes to IT security, there are always tradeoffs. For example, you could have the most locked down network and systems, but usability and the ability for people to do their jobs are hindered. Whilst BYOD does introduce some complexities, I believe my department should service the end-user as best as possible, while still maintaining a reasonable level of security. The easy option will be to blanket-ban BYOD altogether and put it in the "too hard" basket, but I don't operate like that. I know people will ultimately ignore such a policy and login to their email/Teams/Sharepoint/Whatever using their personal devices out of convenience (or necessity). I refuse to waste time writing policies that aren't going to be enforced, just to tick off some ISO certification or similar.

I also don't believe in forcing MDM (Mobile Device Management) on personal devices. If I wouldn't do it myself, I'm not going to force it on others. I'm thinking of going down the path of allowing BYOD, provided they comply with certain criteria. For example: Mobile devices must be running a currently maintained version of Android or iOS and must not be devices manufactured by Huawei, ZTE, OnePlus, Oppo, Xiamoi, etc... This sort of policy should be relatively trivial to enforce through Microsoft 365, so if you try to sign-in using an unsupported operating system/browser, your access will be denied. At least this way, we can accept some risk while not getting in the way of people being able to work.

Which brings me to the point of this post. What BYOD policies do you guys have out there at your workplace? What works? What doesn't work? What would you do different?

[twospoons]

Where I am currently it seems to be company devices only. Personal mobiles cannot log into the company wifi. But given that we make payment terminals, we live or die on security - so the policy makes perfect sense. And frankly doesn't hinder me doing my job at all.

[brucehoult]

I would never accept employment anywhere that didn't allow BYOD and WFH -- certainly not until employers are willing to provide equipment comparable to to what I buy with my own money at home, not low spec shitboxes with cheap monitors (if anything, the provided monitors are usually worse than the CPUs: no, 2x full HD monitors are not a replacement for a 32+" 4K). And I'll never run Windows as the primary OS -- it can be sandboxed in VirtualBox for required corporate bollocks if necessary.

It is unbelievable how employers will pony up well over US$100k a year salary, but not want to spend even $5k once every few years on the equipment to help you be productive.

My recent employers included Samsung (who are about as big and stuffy as they come), and SiFive (a San Francisco startup) and they both had acceptable policies.

Fundamentally, trust your employees and their professional judgement, or don't hire them.

[Bud]

If you wont use an MDM with enforced unified policy for BYOD you will have a Zoo on your network. I cant imagine how you will be maintaining a level of security, unless your audience is very small, 10 people or less.

[Halcyon]

If you wont use an MDM with enforced unified policy for BYOD you will have a Zoo on your network. I cant imagine how you will be maintaining a level of security, unless your audience is very small, 10 people or less.

Where I am currently it seems to be company devices only. Personal mobiles cannot log into the company wifi. But given that we make payment terminals, we live or die on security - so the policy makes perfect sense. And frankly doesn't hinder me doing my job at all.

I guess I'll answer both of these as they kind of relate.

I'm not going to be allowing any personal devices on the corporate network. WiFi is secured with certificate-based auth, so even with valid credentials, users can't connect their personal devices to our office networks.

But with most things being cloud based (email, communications, file sharing etc...) all you need is an internet connection and valid credentials to access those services. This is the space where the BYOD policy would apply.

[Kleinstein]

For work on site (in the office main site) there is little need for privately owned IT.
The other point is working in a home office or on the road / mobile. Here it can be very convenient not to have a 2nd computer or phone or printer around. It still very much depends on the work and security needs.

Already for the home office the advanatges to have a sepration to reduce destractions (e.g. notifications on private email or messages).

[Halcyon]

I should probably mention, our staff do work 99% from home. They do get given corporate laptops, but of course, you can't please everyone when it comes to corporate technology.

[50ShadesOfDirt]

You want locked-down networks, machines, and *data* ... reasons are too numerous to list, but it's the only way to protect the business.

I'd do the military-base scheme of "leave your smartphones at the door, and pick them up on your way out for a break or the end of shift", for obvious security reasons.

End-users want "something" to do some personal stuff on, so give it to them, all without allowing personal machines in the door. Use personal VM's, and don't allow the vm's to pollute your business environment or have data exchange. Set them up an AWS vm for windows, and possibly one for Android (whatever apps they feel they can't live without for 8 business hours), or combine them, to cover 99% of their needs.

Hackers will always be a step ahead, and there's just no allowing BYOD to be your chink in the armor. Insider threats will always be a step ahead, so thwart that as well. Never be in the position of closing the barn doors *after* some threat or data loss.

Hope this helps ...

[Halcyon]

You want locked-down networks, machines, and *data* ... reasons are too numerous to list, but it's the only way to protect the business.

You're absolutely right. Data classification is very important as we handle everything from private commercial information to information classified Top Secret by the Australian Government. We have a group of people with the required national security clearances and of course that data is separated from everything else. Anything classified as Secret or above won't be accessible from home or on personal devices, period.

[brucehoult]

You want locked-down networks, machines, and *data* ... reasons are too numerous to list, but it's the only way to protect the business.

You're absolutely right. Data classification is very important as we handle everything from private commercial information to information classified Top Secret by the Australian Government. We have a group of people with the required national security clearances and of course that data is separated from everything else. Anything classified as Secret or above won't be accessible from home or on personal devices, period.

Ah. Not a normal business then.

[AndyBeez]

From a UK cyber security POV these useful guides are worth a five-ten minute read:

https://www.ncsc.gov.uk/collection/device-security-guidance

https://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/mobile-device-management

If you are challenged on your policy, you can mention that you wrote for compliance with UK cyber security recommendations/best practice. I'm sure Oz has very similar.

[Halcyon]

From a corporate POV these useful guides are worth a five-ten minute read:

https://www.ncsc.gov.uk/collection/device-security-guidance

https://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/mobile-device-management

If you are challenged on your policy, you can mention that you wrote for compliance with UK cyber security recommendations. I'm sure Oz has very similar.

The UK ones are based on the Aussie Information Security Manual ;-) But yeah I'll have a looksie.

[Kjelt]

In our company we use an app to log your own device which is MAC address based then you get wifi access to the DMZ. So indeed only to check personal mail, whatsapp etc not for business.
We get the option to order a company phone (Apple SE) which then is purely business and does get access over VPN to company mail and is allowed to be used personally. Laptops are a nono, only company laptops.

[AndyBeez]

The UK ones are based on the Aussie Information Security Manual ;-) But yeah I'll have a looksie.

So glad to see HMG saving UK tax payer's money [by spending yours]. Possibly some useful case studies there. I do not know the size and scope of your organization, but would it be good policy to appoint a permanent cyber security specialist with responsibility for cyber governance? That would be a permanent position created in the company, however it is justifiable as data integrity and cyber security are equally important to a business as are human resources, supply side management, market intelligence and ensuring senior executives fly a minimum of business-plus.

From a finance perspective BYOD was the best thing to happen to IT budgets. From the IT systems perspective, a total frickin disaster. It was bad enough when the USB memory stick was invented, but then came along smart phones with HD cameras and now, no zone is secure. Spies once needed a tiny Minox camera that fitted into their undies, now they just drop a flip phone in a pocket and walk past the disinterested illegal migrant on the security desk. On an MDM note, do not forget to include the contractors/tradies and cleaners in the lock your darn cell phone in the locker provided policy.

[advert] BAE Systems: https://www.baesystems.com/en-uk/what-we-do/cyber-security---intelligence

In our company we use an app to log your own device which is MAC address based then you get wifi access to the DMZ. So indeed only to check personal mail, whatsapp etc not for business.
We get the option to order a company phone (Apple SE) which then is purely business and does get access over VPN to company mail and is allowed to be used personally. Laptops are a nono, only company laptops.

Apple has similar under their User Enrolment product.

https://support.apple.com/en-gb/guide/deployment/dep23db2037d/1/web/1.0#dep6c59a3144

MDM payloads for Apple User Enrolment: https://support.apple.com/en-gb/guide/deployment/dep6ae3f1d5a/web

[PA0PBZ]

Our policy:

 - Corporate devices will have MDM.
 - BYOD that need to go on to corporate network (why?) or use corporate email need MDM installed.
 - Private devices can use the guest network for internet access that is separate from the corporate network, no corporate email or other services allowed.

The guest network has a different outside IP address which is not in the allow list for the corporate services.
Without MDM it will be hard to enforce any rules about OS versions and such on BYOD.

[paulca]

The tier 1 investment and retail banks have BYOD policies.  In fact, for the first year of lock down I was using my personal PC for work alone.

The reason this works is simple.  Security is so high internally that even a "on site workstation" is not trusted and none of the users/employees are trusted either.  "Least trust" principle across the board.  Also, processes are incredibly intensive and self controlling.  One principle is "no single point of trust" or "no single authorisation".  All processes beyond sending an email (and if that goes external there is process) has to have more than one person authorise it and they can't be in the same team.

So the step from that to having people use there own devices is not that great.

On the other end of the spectrum, there are secure rooms which have specialist PCs and networking where people may be required to work if they do want access to live "secrets".  You're device isn't allowed in that room and it's locked while you are there etc. etc.

[nctnico]

I'm in the process of re-writing some IT policies at work, including our BYOD policy. Rather than think with my "executives hat" on, I'd love to hear from end-users who might have a BYOD policy at their workplace.

When it comes to IT security, there are always tradeoffs. For example, you could have the most locked down network and systems, but usability and the ability for people to do their jobs are hindered. Whilst BYOD does introduce some complexities, I believe my department should service the end-user as best as possible, while still maintaining a reasonable level of security. The easy option will be to blanket-ban BYOD altogether and put it in the "too hard" basket, but I don't operate like that. I know people will ultimately ignore such a policy and login to their email/Teams/Sharepoint/Whatever using their personal devices out of convenience (or necessity). I refuse to waste time writing policies that aren't going to be enforced, just to tick off some ISO certification or similar.

Which brings me to the point of this post. What BYOD policies do you guys have out there at your workplace? What works? What doesn't work? What would you do different?

Maybe you should turn the question around: why would it be acceptable for people to use their personal gear for work? How about providing people with a company owned & managed device (but not a slow & crappy one)? That also gives uniformity across devices.

If people insist on using their own device then you can enforce things like the devices needing to be up-to-date and ban certain brands.

[Halcyon]

Maybe you should turn the question around: why would it be acceptable for people to use their personal gear for work? How about providing people with a company owned & managed device (but not a slow & crappy one)? That also gives uniformity across devices.

If people insist on using their own device then you can enforce things like the devices needing to be up-to-date and ban certain brands.

You raise a good question and one I have asked myself too. I'd love to just go out and buy 50 brand new laptops that are all spec'd up, but I simply don't have the budget at the moment to replace everything (then there are people's desktop workstations to consider, I'd be looking at a $150-200k project). As it is, I'm probably going to have to consider 2 different models of laptop depending on the team/individual requirements. A "one size fits all" approach wouldn't work.

Choosing a platform is going to be hard enough. There are those that prefer to use Mac over Windows (and as I start using Mac more and more, I can certainly see why), then there are others who would never touch a Mac.

At the end of the day, people are people and they will take the path of least resistance when it comes to doing work. If that means they can quickly check emails or Teams/Slack messages on the device of their choosing, they'll do that. The tighter we screw things down, the more cumbersome it becomes from both a user and administrative perspective. We just need to find that happy balance. People will naturally find a way around obstacles.

I've worked in organisations where end-users are told "no" all the time. I'm the opposite, my default position is "yes" unless there is a compelling reason otherwise.
To simply say "because security" is a bit of a cop out excuse to me (although applicable in some circumstances). When I hear that, it's basically the IT department saying "We don't want to do the extra work to make it happen, so deal with it".

I see a proper BYOD solution as the way business operates today. It's a bit like working from home; most organisations would have laughed at the idea 10 years ago, yet today its prevalent and has been shown to work well in many sectors. I don't believe we should always stick to "the way we've always done it" and I think challenging my team to come up with a workable solution, even if it means more work for the IT department, is the better way to go.

[paulca]

I think BYOD is far too broad a topic without discussing the business itself.

As I mentioned, in the high ends of the industry, it's obviously not about cost.  Those 1 litre desktop PCs, 24" monitors and 15" laptops are available on the second hand market in their 10s of thousands for a reason.

In these places the "end device" is never trusted anyway.  If I walk into the office and sit down at a desk, it isn't "my desk" and it isn't "my PC", it's just whatever desk and PC was free.  That PC has almost nothing on it.  No office, no email, nothing.  No DNS let alone internet access. It won't accept USB devices either. It has IE installed and you can use that to authenticate to some periphery systems, but the main access is gained by authenticating to the VMWare edge proxy, requiring username, RSA token, pin code, host allocation number and the actual token.  That gets you in the outer ring from where you can launch a session on a Windows Server for IT support or you can log into your Windows VM (VDI), usually in the cloud somewhere, though you can't tell.  Usually in a location close by, but it could be on the other side of the world and it moves daily.  The security once on that VDI does not stop.  Every single services you touch requires authentication.  You have no admin and your only networking is via a webproxy.  Every web UI and ever application will time out it's authentication tokens anywhere from 1 minute to, thankfully on many dev systems 24 hours.  You honestly spend about 5% of your day logging in to things.

When we started working from home the only thing that changed was the RSA token generators had to be requested differently and exported as "remote access tokens".

As to BYOD, they don't actually care, you still have to authenticate to that edge node with all the right credentials, the connection to the VDI is secure assuming they trust the VMWare infra they maintain.

The remote access token generator can be used in "App form", on your own devices, however the list of devices supported is incredibly short.  This is because the various info-sec teams have limited resources to test and confirm security compliance across all devices.  Additionally many devices, OS's and versions of OS's are blocked due to the company not liking the security or privacy of that OS.

The company "App" will sometimes then provide additional functionality, like forwarding your call into the company Zoom or conferencing system, access email, accessing IM chats etc.  Not always, it differs.  Typically those with a bespoke application will allow access through that.  Others will provide you Office365 mobile access with the increased MFA security as a "pre-gate" to the SSO login.

On the other end of the spectrum a very common entity these days is the business with absolutely zero onsite infra and even close to zero private cloud infra either.  They base 99.9% of their business in online 3rd party cloud services like Office365, Google Business, etc. etc. etc.  HR applications are also exported to public cloud services.  So in these places there is no on-site infra to authenticate to and all authentication is handled by the "Office365" SSO stuff... or is entirely independent.  There is very little preventing access to these systems from any random location and the "company" might not even be aware.

I was using my personal PC for work for over a year when the company got bought and the new owners gave us all new laptops and told us we must use company hardware and networks to access any customer system, regardless of what the customer say.  That ended that.  So now my connection has to go out to my company infra in the cloud, "de-VPN" itself and head straight back out on the internet to a different country to the customers public IP.

A caution for people, as employees, who wish to take their company up on their BYOD policies...  Read the small print.  In many cases the software you use will have open and clear spying clauses, monitoring clauses which may, or may not extend to your phone use while the application is closed.  they will claim this is to protect their security and is legitimate use.

The laws internationally are presently far, far, far behind the present technical situation regards to data, it's distribution and usage.  Laws around "corporate privacy overreach" are still unestablished on the topics of monitoring people in their own homes and on their own devices.

Personally I refuse as much as I can now.  I insist on keeping my personal security scope isolated from my work security scope.  This is becoming increasingly difficult and the consequences for having miss-aligned views to the company (DEI Department especially) are growing rapidly.

If your company can move it's "Office workload" into Office365 you can save a lot on devices and allow BYOD access to that services and let Microsoft manage the security.

If you want personal PCs/laptops to access "onsite" infra (including private cloud infra), then provide access only to a DMZ "terminal server" or edge node.  From there you control access on an individual basis. 

If you move your infra to AWS, you had better understand the security, roles, permissioning complex nightmare that can be.

So, bottom line.  Move on site infra to the cloud.  Let the cloud handle the security.  For everything you can't use multi-staging security regions and several MFA stages.  A VPN with anti-bridging and end-point protection software might be worth enforcing while connected to said VPN.  On the internal side, these are considered "UNTRUSTED" and their operations strickly controlled.

Note, external authentication providers can span many services with single set of creds.  An example might be "Okta".  These present interesting control and ownership models based around need to know and privacy.  Typically the end user creates the account and owns the account with Okta.  They then follow an invite like to bind that Okta account to the companies authorisation.  This mean the end user has control of the data in the account and can reject or close associations with entities.

[nctnico]

A caution for people, as employees, who wish to take their company up on their BYOD policies...  Read the small print.  In many cases the software you use will have open and clear spying clauses, monitoring clauses which may, or may not extend to your phone use while the application is closed.  they will claim this is to protect their security and is legitimate use.

That is a good point I like to emphasize. I have a few customers for which I have a Google account but I only use it through a web-browser. I don't link my own phone or computer to the cloud service at all.

[aeberbach]

Have you looked into Kolide + ZScaler? I am just a user rather than an admin but it isn't bothering me as a user. I could complain that it sometimes takes 3 seconds + a browser interaction to open 1Password but there are far worse experiences to be had. On the admin side it seems to offer a lot of flexibility, it will do things like find a 1Password recovery document (the one containing passwords and QR) and make you take it offline, it will check for Chrome and OS being latest version or patched appropriately, many other things. If there is a breach of policy it doesn't break anything but it does stop you being trusted and logging in until fixed, optionally with a grace period like "You will be unable to sign in in 6 days".

The very worst "security" experience I ever had was with a thing called Carbon Black that did a round trip with every previously unseen binary to some remote server. When your job is to create binaries that's a problem, it took project compile time from around 15 minutes to around an hour. Of course all the developers learned that if you copy the repo to another machine at home and work on that it was much better. So much for "security".

[Halcyon]

A caution for people, as employees, who wish to take their company up on their BYOD policies...  Read the small print.  In many cases the software you use will have open and clear spying clauses, monitoring clauses which may, or may not extend to your phone use while the application is closed.  they will claim this is to protect their security and is legitimate use.

That is a good point I like to emphasize. I have a few customers for which I have a Google account but I only use it through a web-browser. I don't link my own phone or computer to the cloud service at all.

I've seen this in large organisations and largely it's true. Even to the point where IT can capture screen shots of your entire display for later analysis/management action.

I'm not about to do that. Firstly, there won't be "small print" in any of our IT policies. It'll be straight to the point and written in clear language. There is no point in devising a policy that is long-winded, that no one will read, or comply with. If we do eventually go down the MDM route, we'll explain exactly what is being captured, how long it's kept for and who can view it and when.

Ultimately BYOD is a choice for the employee should they wish to take it up. All we can do as the employer is give them all the facts and let the  individual decide if it's a good fit for them.

Have you looked into Kolide + ZScaler? I am just a user rather than an admin but it isn't bothering me as a user. I could complain that it sometimes takes 3 seconds + a browser interaction to open 1Password but there are far worse experiences to be had. On the admin side it seems to offer a lot of flexibility, it will do things like find a 1Password recovery document (the one containing passwords and QR) and make you take it offline, it will check for Chrome and OS being latest version or patched appropriately, many other things. If there is a breach of policy it doesn't break anything but it does stop you being trusted and logging in until fixed, optionally with a grace period like "You will be unable to sign in in 6 days".

The very worst "security" experience I ever had was with a thing called Carbon Black that did a round trip with every previously unseen binary to some remote server. When your job is to create binaries that's a problem, it took project compile time from around 15 minutes to around an hour. Of course all the developers learned that if you copy the repo to another machine at home and work on that it was much better. So much for "security".

Thanks for your perspective. This is exactly what I'm after. I want to hear from those who actually use this stuff. Good leadership is more about listening and less about dictating (if only more managers did this).

As for Carbon Black, yep, I know all about its issues. We were using VMware CBC before I started and I'm currently phasing it out on our endpoints in favour of a different solution, one that doesn't constantly phone home would be ideal (which is necessary for our protected networks which are not connected to the internet). The team and I are currently evaluating CrowdStrike and SentinelOne products.

[paulca]

LastPass (premium/corporate)
Okta
ZScaler
Always on VPN with selective routing (so you don't take the liability or privacy issues with routing user 'random' traffic across your networks).
AWS STS SSO login.
Office 365.
There are a range of "Endpoint management" systems, even from Microsoft such that you can set policies while your VPN is in use.  They are designed for the hybrid model.

For any actual "infrastructure" needed in terms of physical or virtual machines, you put into AWS and use Okta+STS auth.   EC2 whatever.

It creates a kind of dual state on the users machine.  All access to the company is authenticated by third parties (with your interests), but you protect your self from bridging, user traffic and most if not all of the malware on the users home network. 

When it comes to MDM and those aspects, I'm way behind the times.

From the user point of view as employee, I didn't feel that worried about using my personal PC to access work related stuff and work full time there.  The reason is that in very large enterprise the boundaries are extremely clear.  You know where you are.  The software in use is trusted industry wide from both sides.  The connections made are openly displayed.  So you are aware.  For example, the VMWare Horizons client shows that my 'customer' was connecting to my keyboard, mouse, webcam and microphone.  When I queried the later they explained it is because...  the want to specify the classes of device that CAN connect, but in doing so it also automatically aquires access to that set of peripherals.  So becuase they want you to be able to use your local webcam/camera and mic, they list those as "standard channels" and it auto connects.  I disagreed with this explanation because you were also unable to disable or disconnect said devices.  When I asked on the VMWare Horizons reddit the most authorative answer was, "If you do not want your third party to access those devices, either disconnect them, or disable them in Device manager, otherwise they do have access."

In smaller organisations I would not feel as safe.  I would not accept "End point protection" software in order to connect to a company VPN.  The reason is that software will scan my home system and network for what my company considers "Threats", which might include a lot of legitimate personal interests or even family interests.  The boundaries are much less clear, security on both sides is lower than optimal.  It's better to be in a digital relationship with an organisation that already sets clear boundaries and protects themselves from you and also you from them.

[Ranayna]

What we allow by now is using the VMWare Horizon Client on a private device.
The Horizon Client connects to a virtual Windows Desktop that is hosted in our datacenter. Besides Mouse, Keyboard, Monitors and USB Headsets, it allows no cross connection with the host it is running on. The neat thing: The Horizon Client is available for virtually all Endpoints: Windows, Linux, MacOS, even iPadOS.
All data stays in our datacenter.

[fluxcapacity]

MDM can be good depending how strict it is. It helps insofar as, if an employee downloads weird programs, they can, but, it'll be in a different sandbox than apps that can access company google accounts and services. So overall it lets you allow personal devices to use those logins with a reduced risk that malware will get access to corporate data.

The alternative is providing everyone with all the devices they might need to use which is easier said than done.