Understanding the Power of Policies for BYOD

Shadow IT is a credible security threat. For a time, the bring your own device (BYOD) trend was seen as a major contributor to that threat. BYOD does not have to compete with security demands, however. If you embrace it with education and engagement, BYOD can be a tool to launch your company forward.

Consider the Need for a Well-Strategized BYOD Policy

Policy drives most of what we do in the corporate world, from permissible work attire to the person we turn to if we need assistance. Regulations drive policy development in human resources and accounting, but who is directing the way your company combats shadow IT? One study from late 2015 found that out of 447 diverse business owners, as many as 53 percent admitted that they hadn’t invested in a formal BYOD policy, and more than a quarter of them don’t even have a formal policy or systematic approach to digital security.

Developing an effective BYOD policy is not something you can afford to push to the back burner. If you work in a heavily regulated field such as finance, law, or medicine, your approach to BYOD may affect your ability to maintain compliance with privacy and security regulations. Even if you don’t work in a regulation-heavy industry, a BYOD policy will affect your overall approach to security and the way your customers view your brand.

Avoid Going to Extremes with BYOD Policy

Some companies look at the risks of BYOD and decide to draw a bold line restricting all but the most innocent of activities. This type of policy makes sense if you expect your IT strategy to work as it did in the past. In practice, however, it tethers employees to their desks and ruins productivity, making them resort to whatever apps and digital resources they need to get the job done.

In today’s world, shunning the use of mobile technology is kind of like trying to work with one hand tied behind your back. Other companies allow employees to use their devices unchecked, for any number of purposes. While employees love this level of autonomy, it opens the company to serious risks from a virtually limitless array of digital backdoors because IT teams can’t keep up with security demands if they don’t know which programs and devices to monitor.

Extreme responses raise the security risk level beyond the point of acceptability, and employees are often left feeling trapped or confused. The only viable solution to combat shadow IT is to embrace the modern network and develop a BYOD policy based on education, risk management, and engagement.

Invest in a BYOD Policy that Minimizes Risk and Maximizes Productivity

To protect your company and support your employees, now is the time to evaluate the shadow IT risk and create a BYOD policy that is consistent with your business operations. Strong policies will consider these factors:

• Baseline information: Know where you are to see where you’re going. Define sensitive data, determine an acceptable level of risk, and consider your budget for maintenance and innovation. In November of 2015, IBM acquired cloud broker Gravitant, designed to help businesses see what devices and applications employees are accessing on the job. The tool could offer companies another way to oversee security and optimize online activities for improved productivity and efficiency.
• Hardware and software approvals: Your company does not need to develop a policy for every device your employees want to use. Instead, consider the devices that your employees need to use to get the job done and pare down the types of devices you will support by considering software accessibility and permissions.
• Education and engagement: The last component of your policy is undoubtedly the most important. Without education and engagement, the other facets of a BYOD policy crumble because employees will ignore them. You need buy-in from those whom the policy affects as well as accessible training and resources to improve adoption rates.

If an employee knows the risks of shadow IT and company policy, he or she can begin to play a proactive role in security management. Instead of relying on a centralized IT team to manage BYOD, give your employees the tools they need to self-regulate.

Any technology-based policy needs to embrace change to maintain efficacy. Devices are often obsolete within two or three years, and software often changes at a more rapid rate. Keep your BYOD approach flexible enough to support your employees using smartphones and other devices today and those who may want to use IoT (Internet of Things) devices in the coming years.

This post was brought to you by IBM Global Technology Services. For more content like this, visit Point B and Beyond.

Photo Credit: RobVelasquez via Compfight cc