Gary McConnellClever Consulting Srl.

Come construire una strategia vincente di BYOD

BYOD – What is it?

• Bring Your Own Device – personally-owned mobile devices for business

applications– Goals

• drive employee satisfaction and productivity through the use of new technologies, while reducing their mobile expenses

– consumerization of IT• consumer preference, not corporate initiative,

– technologies not built with enterprise requirements • IT teams uncomfortable about security and supportability.

Approaches• Top of the pyramid

– Upper management & VIP users

• Broadscale– Extend to workforce

• Companies providing choice– Company paid Blackberry– Personal funded iOS or Android

• Monica Basso, Research VP at Gartner, Inc., predicted that by 2014 “90% of organizations will support corporate applications on personal devices.”

• IT teams need to prepare for a mixed-ownership mobile device environment.

Implications

• But BYOD is more than just shifting ownership of the device to the employee.

• complex and hidden implications • a strategy needs to be defined in advance of

implementation

BYOD strategy components

• Sustainability• Device choice• Trust model• Liability• User experience and privacy• App design and governance• Economics• Internal marketing

Sustainablity

• Common Problem - BYOD policies not sustainable over the long term.

• BYOD policies must meet the needs of both IT and employees:– Secure corporate data– Minimize cost to implement and enforce– Preserve user experience– Stay up-to-date with user preference and

technology innovation

Device Choice

• Building a policy :– Analyzing employee preference– Acceptance baseline - security and supportability

• Basics - asset management, encryption, password policy, remote lock/wipe, and email/Wi-Fi/VPN configuration

– Understanding the operating system, hardware, and regional variances around that baseline

– Developing a certification plan – Clear communication to users – Ensuring the IT team has the bandwidth to stay up-to-

date

Trust Model

• Trust is the foundation for enterprise security• The trust level of a mobile device is dynamic– Example – CFO with financial data

• BYOD - another layer• Privacy policies will vary• User expectations will differ.

Trust Model

• Building a BYOD trust model:– Identify and assess risk for common security

posture issues on personal devices– Define remediation options (notification, access

control, quarantine, selective wipe)• differ in severity from BYOD to corporate devices

– Set tiered policies– Establish the identity of user and device– Take a critical eye to the sustainability of the

security policy being instituted

Liability• Assess risk of employee actions & liability• Considerations:

– Defining the elements of baseline protection for enterprise data on BYOD devices– Assessing liability for personal web and app usage– Assessing liability for usage onsite vs. offsite, and within work hours vs. outside

work hours– Evaluating whether the nature of BYOD reimbursement (partial stipend vs. full

payment of service costs) affects liability– Quantifying the monitoring, enforcement and audit costs of the BYOD compliance

policy– Assessing the risk and resulting liability of accessing and damaging personal data

(for example, doing a full instead of selective wipe by mistake)

• Each organization should seek their own legal advice on how to frame and assess liability variances between BYOD and traditional mobile programs.

User Experience and Privacy

• Employee satisfaction primary goal for IT• Security & user experience - conflicting interests• The core tenet of successful BYOD deployments is

preservation of user experience• Avoid– non-native enterprise email apps, – poor battery life, – complex authentication, – lockdown of useful features– lack of privacy.

User Experience and Privacy • Social Contract

– Agreement between employer and employee – Identifying the activities and data IT will monitor

• security vs. privacy tradeoffs to make

– Clarifying the actions IT • Transparency will create trust.

– Defining the BYOD privacy policy– Critically assessing security policies and restrictions for sustainability– Deploying core services (email, mission critical apps) to the employee– Preserving the native experience– Communicating compliance issues clearly to the employee

• BYOD users will expect proactive notifications to give them a chance to self-remediate.

– user experience is the real test for policy sustainability

App Design and Governance

• Don’t assume BYOD is a device ownership decision • Trust level of BYOD device different from traditional

device– impact on app design and distribution

• Employees expect internal apps on all approved BYOD devices and not a subset

• Deeper investment in app development and testing, what apps are supported on what devices and why.

• Confusion for the user will drive calls to the helpdesk.

App Design and Governance

• Considerations– Designing mobile apps to match the trust level of

personal devices– Defining app catalog availability based on device

ownership– Committing to the resource investment– Updating acceptable use policies– Defining enforcement levels for app violations

Economics• Short-Term, eliminate cost of device purhase and move from full service

payment to predicable stipend.• Long term – may well be different, • BYOD strategies are young so difficult to definitely assess economic impact –

key dimensions to consider– Device Savings– Overage charges BYOD drives personal responsibility– Service Plans– Helpdesk– Compliance and audit

• ROI of BYOD programs -combination of the above weighed against the value of employee satisfaction and productivity.

• The hidden economics of BYOD center on the cost of complexity and the value of more responsible employee usage.

Internal Marketing

• Marketing opportunity for IT’s value– Communicating why the company is moving to BYOD– Understanding BYOD - HR initiative as much as an IT

initiative– Defining IT’s “brand”: – Supporting the brand message with appropriate

action• BYOD unique opportunity to impact perceptions

and culture across the company

Conclusion

• BYOD seems simple• Its not…

Strategic Advisory Sevices

gary.mcconnell@clever-consulting.com+349 5055451