Ensuring that BYOD endpoints are compliant can be difficult, because IT cannot configure them before shipping them to users. Administrators must apply specific policies to make up for this.
Endpoint usage policies must be updated as user behavior evolves, especially when organizations have to comply with compliance and data protection laws. BYOD endpoints raise particularly complex issues, because organizations must ensure that every endpoint complies with privacy and data security regulations, even though they do not own them.
Develop a BYOD policy and communicate it to users
As with any security initiative, laying the groundwork for a BYOD (Bring Your Own Device) policy gives it the best chance of success. Take the time to clearly set out the limits on using personal devices within the company. Corporate BYOD security policies should answer many common questions about the use of personal devices, for both end users and IT professionals. Here are some questions to consider:
- Who is allowed to access company data from personal devices?
- Under what conditions can personal devices connect to company networks?
- Does the organization require explicit approval for each BYOD instance?
- What security controls must be in place on BYOD endpoints?
Build BYOD policies around user needs (where possible)
Setting BYOD policies inside an IT silo tends to backfire in the end, especially as more and more workers sit outside the traditional endpoint network. Work to build alliances and partnerships with workers in the business units to lay a positive foundation for the BYOD initiative. Resist the idea of giving HR outsized power as employee representatives in creating and maintaining BYOD policies.
Instead, treat HR like any other business unit. The reason is that IT wants unfiltered, first-hand feedback on how BYOD policies affect productivity. Building relationships with end users will also improve feedback, because IT will know which policies work and which ones hinder productivity.