The BYOD Policy is Becoming More Popular, But Does it Pose a Security Threat?

Modern offices tend to adopt a more relaxed work environment, one in which the walls of cubicles have come down in favor of open-concept floor plans and employees are encouraged to participate in a team-driven environment.  Of course, policies and procedures have not become so lax as to allow for a BYOB mentality.  As for BYOD, however, or “bring your own devices”, it’s a different story.

Instead of purchasing laptops, tablets, smartphones, and other work devices for employees that travel, work from home, or otherwise have to log in remotely outside business hours, many South Dakota companies are opting to save a dime and let employees utilize the devices they already own.  After all, nobody wants to carry two phones or laptops.

That said, this policy can have serious consequences for companies that don’t think it through and put strict policies and procedures in place.  What security risks will you face when you adopt a BYOD policy and how can you minimize risk factors?

Understand Consumer Privacy Laws

Before you decide on a BYOD approach to doing business, you need to be aware of the fact that it may not be entirely legal under consumer privacy laws.  It’s imperative that any sensitive consumer data you collect be securely used, stored, and eventually, disposed of.  You will have to be extra diligent to enforce these protocols when you allow employees to use their own devices for work purposes.

In addition, any business that operates internationally will have to contend with international laws, including the strict guidelines laid out in the GDPR, which protects the privacy rights of EU citizens.  You need to understand the laws you’re beholden to in order to fully comply and avoid risk and penalty.

Mandate Security Software and Updates

One of the biggest problems with letting employees use their own devices for work purposes is that you have little control over the security features they have in place or how often they perform needed security updates.  With company-owned devices, you can have almost total control over this process, but the same may not be true of employee-owned devices.

If you plan to adopt a BYOD policy, it’s imperative that you set conditions around the use of employee devices.  For example, any employee that wants to use a personal device to work remotely must agree to allow your IT specialist to install approved security software on the device and access it for updates as needed.  Further, they must submit to having company data wiped from their devices before they leave your employ.

Safe Behavior

In addition to taking control of device security, you’ll have to address the potential risks of employee behavior.  Within your own walls, you can protect data with firewalls, encryption, and more.  When employees access data remotely, they may do so on public Wi-Fi networks, for example, that leave them exposed and vulnerable.

You can’t exactly control this behavior, but you can mitigate risks by training employees to behave in a safe and secure fashion, and by outlining the potential consequences of failing to adequately protect sensitive data stored on their personal devices.

If your South Dakota business needs help planning for proper IT asset management and disposition, contact the experts at SEAM today at 605-274-7326 (SEAM) or online to learn more.