BYOD: the benefits and challenges

Published 5:00 am Monday, June 4, 2012

There’s a growing trend of employees using their personal devices — smartphones, laptops and tablets — in the workplace.

Employers are struggling to accept and integrate the “bring your own device” to work movement, while balancing company security, employee work policy and cost. But whether they are ready or not, the shift — labeled “BYOD” — is happening.

“The move to greater adoption of mobile devices is clearly accelerating and appears irreversible,” according to the “’Bring Your Own Device to Work Movement’: Engineering Practical Employment and Labor Law Compliance Solutions” report released last month by Littler Medelson, a U.S. law firm specializing in employment and labor law. “The significant growth of mobile devices and their use by employees to conduct business — with or without the company’s support — combined with the continued blurring of the line between personal and work lives, will force employers to respond.”

Benefits for employers include a reduction in expenses from employees purchasing their own devices, improvement in employee productivity and quicker adaptation to newer technologies.

Lynnea Miller, principal broker and owner of Bend Premier Real Estate, said the BYOD movement allows her employees to conduct their business anywhere in the world.

The idea of being chained to a desk is gone, she said, along with the 9 to 5 workday. People can be doing business while they’re on the beach or on top of a mountain as long as they have cell service, she said.

Miller said there are pluses and minuses to the movement in the sense that employees have their cellphones at home so they are constantly bringing their work home with them. But, she said employees having their cellphones means clients can always reach them.

“It can increase your quality of life as a person who is working,” Miller said, “and the accessibility for your clients.”

Tablets, laptops, smartphones and Internet programs like DocuSign that provide electronic signatures, she said, make it so her employees don’t need a piece of paper to generate a transaction, eliminating the need for a fax machine or a printer.

“You don’t have to be wired in, you just need an electronic source,” she said.

But there are also challenges.

The Littler report said companies allowing the use of dual-devices — devices used for personal and company activities — face issues including who owns and controls the content and data on devices; security breaches; need for increasing network infrastructure; and deviation from company policy on what devices can be used during work hours.

Sally Sorenson, president of the Human Resource Association of Central Oregon — a member organization for human resource professionals and a local chapter affiliated with the Society for Human Resource Management — said the BYOD movement’s potential benefits depend on the industry employees are working in.

“There’s not any question that technology is changing rapidly,” she said. “In some cases, bringing your own devices will be appropriate in the workplace, and in others, there may need to be restrictions.”

Some businesses have propriety information that can’t leave the office, she said. The use of cellphones that are equipped with cameras could be detrimental if photographs were taken of proprietary information or processes, she said, as could having company documents on personal computers.

Sorenson said another concern is whether an employee is using his personal device to conduct personal business during paid time. However, she said, it is the responsibility of an employer to monitor and control such abuses for equipment ranging from landline telephones to laptops.

“Creating a flexible workplace is always desirable as long as it doesn’t interfere with business objectives,” she said. “To maintain their competitive edge, employers need to be open to technology as well as other ways to be flexible.”

Dan Cecchini, director of information technology services at Central Oregon Community College, said the college has seen the BYOD trend coming and is working to rewrite the information technology acceptable use policy for both employees and students who use COCC’s network.

“A single person can come to campus carrying multiple BYOD items, such as a smartphone, tablet and laptop,” Cecchini wrote in an email. “So 100 people may create 300 wireless connections to our network.”

In addition to maintaining traditional computer infrastructure, Cecchini said these increased connections require the college to support new infrastructure.

“With 17,000 students and hundreds of employees, the infrastructure behind the wireless connections takes time and money to implement, manage, maintain and upgrade,” he said.

Cecchini said the college also has to be privy to legal data security and privacy considerations when employees are using dual devices, since personal information — Web surfing and chat histories, email, photos, music, movies, user names and passwords, and financial account numbers — can be stored alongside work-related data on the same devices.

And because personal devices aren’t owned by the college, he said, there are limitations on what programs and software the institution can insist be installed on them, such as anti-malware software and encryption, leaving the college’s network vulnerable.

“There is a challenge to balance the convenience of the BYOD trend against the need to protect individual privacy data,” he said.

John Pritchard, IT security manager for St. Charles Health Systems, said in industries like health care, there are stricter regulations, which can make the adoption of the movement difficult.

“Within the health care industry, we see protecting our patients’ records and confidentiality as a critical component of high-quality patient care,” he said. “One of the real challenges with the mobile device movement is how to maintain that data security.”

Whether it’s a personal or corporate device, he said an employer must establish use expectations and security policies for the workforce. A company needs to have tight policies and procedures, Pritchard said, but it also has to have a management framework to enforce them and additional technical controls to help safeguard data.

Pritchard said the five basic functions an organization using the BYOD model might consider having are: the ability to password-protect a device so data is secure when it’s left lying about; the capability for encryption to make data unreadable when the device is not in use; the option to lock a device, to allow a company to safeguard it from its former owner after he has left the company; the capability to wipe a device, restoring it to a factory default-like setting and eliminating all data, applications and user customization; and the ability to segregate personal and company data, a function that may not be available on all devices.

Pritchard said St. Charles Health Systems is looking at the use of mobile devices within the health care sector, seeing where other companies have made mistakes and weighing the benefits and risks.

“Its not something you want to be on the bleeding edge of,” he said. “There are organizations in the health care sector that have failed to safeguard their patients’ data. Some of those organizations are facing millions, if not billions of dollars in litigation.”

There are trade-offs employers and employees need to think about, he said.

“Technically you can do a lot of things with BYOD devices, but people really need to think carefully whether they want to,” he said. “Do you want to give your employer access to your personal device, to control it to some degree? Every organization has to wrestle with these questions — what’s going to enable our employees to utilize technology so they can be efficient at their jobs, but … make sure data is being handled in a safe and effective manner?”

Marketplace