Bring Your Own Device

WHAT IS BYOD AND WHY SHOULD YOUR ENTERPRISE CARE?

We can bet that your enterprise has heard of and probably considered implementing a Bring-Your-Own-Device (BYOD) model over the past couple of years. No, we’re not psychic — BYOD became an industry staple when the first wave of iPhones entered the workforce, and it’s remained one of the hottest trends in enterprise mobility ever since.

To refresh your memory, BYOD mobility programs allow employees to use their personal devices for work purposes. This model was introduced as an alternative to the more traditional (and still widely used) corporate-liable ownership. The corporate model, in which the enterprise owns the devices and assigns them to users, is relatively straightforward from a management perspective and can be considered an employee benefit. However, in recent years it has proven expensive, inflexible, and unwieldy to meet the new demands of modern mobility. Enter BYOD. 

BYOD allows employees to use the devices they know and love, allowing organizations to reap the benefits of increased productivity without incurring the costs associated with constantly financing new device models to keep up with technology trends. Organizations across the globe have adopted BYOD with open arms, often without much thought given to the security implications (more on this later). According to a recent survey conducted by the Corporate Counsel Business Journal (CCBJ), nearly 70 percent of organizations now allow employee use of personal devices for work-related purposes, and this number is only expected to grow over the coming years. 

Whether you’re considering a BYOD model or have already implemented one and are facing management challenges, we’re here to help. In this piece, we walk you through everything your organization needs to know about bring-your-own-device, including key benefits and disadvantages, trends and best practices, security concerns and recommendations, and more.

Before any major business decision, particularly those that will affect each and every one of your employees, it’s important to weigh the benefits against the disadvantages. So let’s start with a good, old-fashioned pros and cons list.  

BYOD Benefits

Increased Employee Productivity

The main (and most exciting) benefit associated with a BYOD policy is increased employee productivity. This should come as no surprise, since it makes sense that employees would feel more comfortable using their own devices instead of ones their employer has picked for them. According to BT Global Services, 42% of employees say their productivity has improved since their employer adopted a BYOD policy. As an employer, that’s probably enough to make you think: “WOW! That’s all it takes? We’ve got to implement this as soon as possible!”

Guess what? It gets better. Studies show that employees work more hours and are generally more engaged in the workplace when using personal devices. According to Fliplet, companies gain an extra 240 hours of work per year from employees due to mobile working. Not only are devices taking over the workplace, but they’re allowing your employees to work on flexible schedules and stay in constant contact with their peers, subordinates, and clients. We can certainly understand why organizations are eager to maximize productivity and output year-over-year with a BYOD policy.

Cost Reduction

Every organization out there is looking to cut costs, especially when it comes to mobility. Device costs represent a big chunk of an organization’s IT budget, and this chunk is only expected to grow as new technologies make their way into the office. According to Gartner, worldwide IT spending in 2019 was a whopping $3.79 trillion, a 1.1 percent increase from 2018. Connecting and empowering your workforce comes with a hefty price tag, so cost should always be a top consideration when evaluating ownership models, mobility software, or management providers. 

It’s often difficult for organizations to keep up with recent technology launches and trends. With a new iPhone model coming out every year, it would be incredibly costly and time-consuming for companies to continually purchase new devices for their employees to stay up-to-date. A BYOD policy allows your employees to pick and shop for their own devices, taking the pressure off your internal team.

Employee Experience

We’ve left our personal favorite for last: employee satisfaction. Your organization should consider implementing a BYOD model because employees tend to prefer this model to the corporate-liable one. Not only do they feel more comfortable using their own devices, but they gain the flexibility to work remotely, which is becoming increasingly common across the globe.

Studies show that, whether you like it or not, your employees are already using their personal devices at work, usually without the knowledge of your IT department. A recent Microsoft study found that 67% of people use their personal devices at work regardless of the organization’s official device policy. This trend is known as shadow IT, and it can have a detrimental impact on your IT department’s ability to control and monitor enterprise data. Instead of forcing your employees to use their devices secretly, compromising everyone’s security, let them do what comes naturally.

BYOD Disadvantages

Security Concerns

The main disadvantage of BYOD is the security concern associated with allowing employees to access confidential information on personal devices, particularly outside of the workplace. Under BYOD, it is more difficult to enforce security compliance. In fact, end users may object to intrusive security requirements such as remote wipe, making it more challenging to enforce these policies. We’ll delve deeper into BYOD security in an upcoming section, which covers measures organizations should take to best secure corporate and employee privacy. 

Most enterprises put off or reject implementing a BYOD policy because they are not prepared to handle the cybersecurity threats that often come along with it. The Verizon 2019 Data Breach Investigation Report found that 80% of breaches stem from stolen or weak credentials on employee phones and laptops. As a result, it’s critically important to have the systems and processes in place to avoid or prevent leaks.

Program Administration Challenges

Most organizations struggle with tracking personal devices and responding to helpdesk support requests under a BYOD program. After all, you’re dealing with hundreds of devices across a number of operating systems, wireless networks, and geographies.

Many organizations continue to rely on their internal IT department to manage their mobility ecosystems despite the substantial cost savings and optimizations associated with outsourcing such responsibilities to an expert mobility management partner. BYOD program administration responsibilities can range from device approval to inventory management to corporate compliance, many of which involve time-consuming manual processes that hurt the department’s overall productivity. 

Until now, most large enterprises have outsourced IT help desk services to overseas call centers in order to minimize costs, which creates an inconsistent and frustrating UX. Employees often wait for days, if not weeks, to receive stipend reimbursements, which diminishes their productivity (more on this later). Given the critical importance of the user experience in the mobility ecosystem, many organizations have chosen to work with an MMS provider that can take over helpdesk services to streamline customer support. The goal is to create a smooth, flexible mobile work environment for employees while still achieving the cost benefits of a BYOD program.

Security is the number one concern when it comes to BYOD, so let’s delve in a little deeper. It’s important for organizations to invest in both MDM and MAM software ahead of time, and connect this software to their overall digital ecosystem, in order to prepare for the security challenges of a flexible mobility model.

Mobile Device Management

Mobile device management (MDM) (otherwise known as unified endpoint management or UEM) belongs to the “security” phase of the device lifecycle and can be described as the process of monitoring, managing, and securing employees' devices across multiple service providers and operating systems. It is incredibly difficult for organizations (particularly those that choose not to work with a mobility management partner) to track and secure hundreds, if not thousands, of mobile devices and keep their enterprise safe from cyber attacks.

MDM software can be used to automate and enforce compliance policies, lessening the administration burden on your internal IT team. Depending on the solution your organization chooses, MDM can include device security capabilities such as remote IT access, location tracking, and data wiping. Remote access is perhaps the greatest benefit, because it allows your team to disable unauthorized users or applications and delete confidential information from any device. MDM software also allows your IT team to plug employees’ personal employee devices into the corporate ecosystem, enabling increased productivity without compromising security. 

Mobile Application Management

Mobile application management (MAM) is the process of provisioning and controlling access to mobile apps, and also belongs to the “security” phase of the device lifecycle. A common misconception among enterprises is that MDM and MAM are interchangable, or that MDM encompasses MAM. The distinction here is critical: MDM provides device-level functionality, and does not allow you to track and control the data within individual applications. Most organizations need both to effectively secure devices, especially when those devices are used for both personal and business applications.

Many organizations struggle with preserving user privacy while protecting corporate data across mobile apps. Private employee data on mobile devices, such as conversations with family members on Messenger, should be free from corporate interference for obvious reasons. Organizations struggle with segregating personal applications from business applications, particularly on employee-owned devices, if they haven’t invested in MAM software. 

MAM software is used to automate user protection and data compliance and provides your IT department with a powerful set of granular controls to secure application data. The software automates application installation, configuration, optimization, and deletion, eliminating unnecessary tasks for your internal team and reducing the need for human intervention. However, most importantly, this software is often leveraged to perform “application sandboxing” or “containerization”, which means isolating corporate applications from other applications on the mobile device. For example, your employees’ phones will likely contain business applications such as Asana, as well as recreational applications such as Whatsapp, which creates the opportunity for data leaks and malware. MAM allows your organization to separate work and play, thereby respecting employee privacy without risking enterprise security.

It doesn’t seem fair for employees to shoulder the cost of enterprise mobility entirely, does it? Most organizations want to continue to offer devices as an employee benefit while enjoying the advantages of a BYOD model. The answer is easy (or so it seems): stipends and reimbursements. Depending on the type of policy your organization chooses to enforce, employees can either expense a portion of their device cost or earn stipends to defray the cost of mobile service. 

Stipend management is a common challenge for organizations adopting a BYOD policy, particularly when they’ve operated under a corporate-liable model for many years. The stipend management process can get complex as different tiers are created and environments grow, particularly without a consistent method to track stipend eligibility and amount. Sakon recommends creating a tiered stipend model that defines roles and reasons for reimbursement, and preferably only subsidizes the device itself as an additional benefit to employees. The amount of the reimbursement is typically determined based on the work that the employees in that specific tier do, and how dependent it is on the devices in question. However, this strategy will inevitably result in backlash from employees that disagree with your evaluation and are unhappy with the tier they are placed in. 

This causes an unnecessary strain on your IT department and often leads to delays that hurt employee loyalty and productivity. To avoid the headache, work with a mobility partner that already has the technology and processes in place to manage stipends and reimbursements for you.

A self-service mobile management app allows employees to request reimbursements and stipends or report issues without going through a corporate help desk. Best-in-class platforms also include workflow automation capabilities that streamline approvals and minimize managerial intervention. If you want to keep offering mobility as a form of employee benefit, it’s important to have a solution in place that helps employees expense their devices or claim reimbursements for their mobility costs.

It only takes one misinformed employee to compromise your network. As a rule of thumb, you should assume that all of your employees have little to no knowledge regarding good security practices, particularly related to BYOD. While you may think your workforce is more tech-savvy than the average, according to a recent survey, only 37% of employees are able to correctly define “ransomware”. When it comes to protecting corporate data, it’s always better safe than sorry.

The first step to a successful BYOD policy is educating your employees about proper mobile safety, because the majority of BYOD-related security risks involve human error. Employees should be asked to pass a BYOD security course before being allowed to use their personal devices for work purposes. This course should educate employees on the most common security risks, such as using public WiFi networks when accessing corporate data. This is especially prevalent in airports, where business people typically log onto airport WiFi networks or plug into unprotected power outlets using a standard USB connection, unknowingly creating the opportunity for hackers to access critical corporate systems. Employees should also be educated on common malware risks, particularly related to phishing schemes. They are likely downloading information and answering emails on their personal devices on a daily basis, which can be incredibly dangerous if they inadvertently download a virus. That virus can quickly make its way into your company network and compromise your security architecture. The point is: your employees should not be trusted to use their personal devices for work purposes until they have demonstrated that they are knowledgeable about common security threats and know how to protect themselves against them.

Next, it is critically important to hold yearly training sessions to make sure employees are up-to-date on the most recent trends and developments. A one-and-done simply isn’t going to cut it. As new devices make their way into the workplace, and hackers become more sophisticated in their data theft, your employees must be prepared to protect both themselves and your organization.

Many are predicting that the future of BYOD is CYOD (choose your own device). Put simply, a CYOD policy enables your IT department to supply a set choice of devices for employees. This means workers use a company-owned device instead of their own, eliminating some of the security risks found in traditional BYOD. There are a couple of pros and cons associated with this approach, particularly as compared to the BYOD and corporate liable models. 

Let’s start with the benefits. CYOD emerged as a direct result of some of the challenges that organizations were facing with the BYOD model. Many were struggling with protecting corporate data and ensuring device security given the variety of devices entering the workforce each day. CYOD gives employers more control by requiring employees to choose from a limited selection of approved devices with pre-configured security controls. As compared to a corporate-owned model, CYOD still allows employees to enjoy some flexibility in choosing the device they are most comfortable with. 

Unfortunately, the CYOD model is far from perfect, and few organizations are successful in implementing it without the help of a mobility management partner. The first disadvantage of this model is employee dissatisfaction with the device options available to them. If the main goal of your enterprise mobility strategy is to maximize employee productivity, CYOD frankly isn’t going to be your best option, because your employees’ personal and professional lives likely won’t be fully integrated on one device. BYOD is always going to win in this category, hands down. Next, we have the costs. Under a CYOD model the devices are funded and fully managed by the organization, and the price tag might even be higher than under a corporate-liable model if you aren’t bulk-ordering devices from the same provider. Last, but certainly not least, CYOD shares many of the logistics challenges associated with a corporate model. Your IT department is still going to have to handle procuring, configuring, managing, and disposing of these assets, not to mention ensuring that your organization maintains full data visibility across departments and devices. Most IT teams struggle with the logistics of CYOD without the help of an experienced mobility management partner. 

As with most things in life (and enterprise mobility), there are both advantages and disadvantages associated with CYOD, and it’s up to your organization to determine whether it’s worth it. At the end of the day, it depends on what you value most.

Nobody can predict the future, but it’s always good to look ahead. 

First, we’re expecting employee privacy to become a greater priority for organizations as the BYOD market continues to grow. As we’ve mentioned, there is a fine line to walk between protecting corporate data and staying out of your employees’ private lives. Organizations will face increased scrutiny and even legal repercussions if they fail to respect this delicate boundary. You can stay ahead of this trend by investing in MAM software early on to enjoy the benefits of containerization, which we’ve mentioned above, but it seems like some of the world’s largest tech corporations are working to make your life easier.

Tech companies like Apple, Samsung, and Google have a vested interest in creating mobile devices that both the consumer and employer trust for work use. These and other companies are looking at ways to make the next generation of devices “enterprise” ready by introducing a dual-identity (aka dual-persona) smartphone that runs two distinct operating systems – one for personal use and one for work purposes. This approach ensures that your IT department has no visibility into or control over private data, taking some of the pressure off your organization when it comes to respecting privacy laws. 

Last, but certainly not least, enterprises can expect artificial intelligence to play a much larger role in their mobility ecosystem, thanks in part to benefits such as increased efficiency and productivity. According to the CEO of technology consultancy firm J. Gold Associates, “much of this early AI will be geared towards camera and video enhancements, but I also expect a significant amount of effort to go into making the phones easier to use through AI. It will help with security, too.” Remember when we said partnering with the right mobility partner is going to be critical? This is exactly what we were talking about. You want to make sure you’re working with a provider that’s already preparing for these features and functionalities.

Now that you understand the different elements of bring-your-own-device, it’s time to either decide if this model is right for you or evaluate the way you’re currently managing your mobility ecosystem:

• Have you considered all ownership models, including corporate-owned and CYOD, and come to a conclusion that best represents your organization’s values and priorities?
• Is your organization prepared to handle the security challenges associated with BYOD? Or, if you’ve already transitioned, is your team doing a good job of securing corporate networks?
• How is your organization managing or planning to manage stipends and reimbursements? Will you be managing this process internally or trusting a mobility partner? 
• Are you working with a mobility partner that understands your current needs and is equipped to grow with you?

Request a consultation with the Sakon team to better understand your mobile device management needs and discuss areas of optimization.