BYOD: Flexibility Without Losing Control

Bring your own device (BYOD) is the concept of employees using their personally owned devices for work purposes.  With BYOD, an organisation has ownership of the corporate data and resources that may be accessed or stored on a device, but the device itself is the user’s property.  As devices and platforms have become more capable of being used in a work context, the concept has matured so that it can give end-users the ability to use the IT they feel comfortable with.  It can reduce overheads for the organisation and enable flexible and remote working, either routinely or as part of a business continuity plan to keep the organisation running when employees are unable to access their usual work location.

However, in our experience, the effectiveness of BYOD depends upon how thoroughly the device can be managed and how well considerations of usability have been balanced with security and legislative requirements.

There are three main approaches to providing or permitting devices for work.  The right choice depends on the size of the organisation, its technological capabilities, the sensitivity of the information it processes and the degree of control it needs to retain.

1. Employees use company-issued devices

This is where all company work is conducted on equipment wholly owned by your organisation and the use of personal devices is prohibited.  This is generally the most secure option, but it is also the most expensive as you would need to issue laptops and mobile phones to all employees.

We always advise organisations taking this option to ensure that devices can be supported and updated remotely, that controls are in place to prevent data from being exfiltrated, such as data loss prevention technology, and that access to those company devices is properly secured.

2. Allowing the use of personal devices to access company software

This is a more cost-effective option, but comes with some security risks, including the risk of access by unauthorised individuals to corporate data and systems via a user-owned device.  For this option, we strongly advise that you secure remote access through measures such as multi-factor authentication (MFA) and separate the owner’s data and your organisation’s data.  You will also need to be aware that the organisation’s security posture may be compromised if device owners do not update security software or patch their operating systems.

3. Allowing the use of personal devices

This approach, in which employees may store or process corporate information directly on personal devices, presents the greatest security risks.  In our experience, it is only really viable for small organisations with an immediate need to work remotely and no other remote working capability.  It increases the likelihood of software being out of date, while information on the device may not be encrypted if it is lost or stolen and may be copied to external hard drives or personal cloud storage.  Personal devices may also be used by family members, and their owners may use communication or storage services that are invisible to the organisation.

Whichever device provision option you choose, we strongly advise that you put clear policies and training in place so employees understand what they can and cannot do, and the consequences of non-compliance.  These policies must set out procedures for responding to data breaches, guidance on keeping personal devices secure and up to date, and rules on the use of external storage.

‍

There are a number of risks that arise from using BYOD, which can be split into key areas.

First of all, there are data protection risks.

Your organisation remains the controller of personal data and is accountable for GDPR compliance.  This presents risks, including personal data being stored on insecure devices, risks from the loss or theft of devices containing personal information and unauthorised access to personal data by family members or other users of the device.  Meanwhile, when helping organisations respond to data subject rights requests, we have frequently seen BYOD create extremely significant challenges locating or retrieving personal data to answer such requests, particularly data subject access requests (DSARs).  BYOD can also make it difficult to ensure that personal data is deleted under the storage limitation principle.  There might even be unauthorised international transfers of personal data if the employee uses personal cloud backup services.

Any of the above could lead to regulatory enforcement action, monetary penalties, compensation claims by data subjects, litigation by affected corporate clients and the associated reputational damage and loss of customer trust.  Employees who use personal devices outside approved procedures may inadvertently breach organisational policies or data protection requirements, potentially leading to costly, disruptive and time-consuming disciplinary action.

There are also information security risks.

Security risks we frequently see as a result of BYOD include the use of outdated operating systems and unpatched software which can lead to data breaches and phishing or ransomware attacks.  Without the ability to control access, devices used may only be protected by PIN numbers, weak passwords or no security measures at all.  Other risks include the uncontrolled use of personal or public wi-fi and the installation of unapproved applications or malware through websites or phishing attacks.  You will also likely be limited in your ability to monitor security events and carry out investigations.

On a more practical level, organisations that rely on BYOD often find it difficult to ensure that personally owned devices and their owners comply with company policies and procedures. They may also need to provide increased IT support across a wide range of device types and operating systems.

But the risks do not entirely fall on the organisation. There may also be risks to employees.

Initially, there is the issue of whether an employer can require an employee to use their own devices at all.  In practice, this means that any participation in a BYOD programme is typically optional rather than a condition of employment.  Employees may have concerns regarding monitoring of their personal devices and activity, inspection of their personal devices during investigations and their employer accessing personal information stored on the device.

If a device is lost, compromised or remotely wiped to safeguard corporate data, employees may lose personal photographs, messages, contacts or files.

‍

We advise organisations to evaluate both the benefits and risks of BYOD before implementation.  Remember, a BYOD arrangement should never rely solely on employee goodwill.  And importantly, appropriate technical and organisational measures are required under the UK GDPR.

Organisational measures

Organisational and technical measures should be planned together rather than treated as separate workstreams.  We recommend that clients begin with a data protection impact assessment (DPIA).  Depending on the personal data processing in question, a DPIA may be mandatory under Article 35 of the UK GDPR.  Even when it is not mandatory, we find it a valuable way to formalise the risk assessment, record key decisions and identify controls relating to personal data.

Required compliance documents and policies

Usually, organisations have a series of policy documents to meet the requirements of data protection legislation and information security.  These policies are likely to include an Information Security Policy, Acceptable Use Policy, Remote Working Policy, Access Control Policy, Data Classification Policy and an Incident Response Policy.

In our experience, organisations often underestimate the policy and governance implications of switching to a BYOD model.  If you move to a BYOD approach, the policies listed above will need to be amended to reflect the new arrangements.  You will also require a BYOD Policy and BYOD User Agreement that specify the rules , set out confidentiality obligations, explain how devices will be enrolled and provide written acknowledgement of the monitoring arrangements.  You will also need to consider how enforceable these polices are in practice and what can realistically be done if a breach occurs.

It is likely that you will have information security and data protection training and awareness already in place, but this must be amended to clearly state the requirements and rules for BYOD, explain employee responsibilities and acceptable use requirements.

The BYOD regime may require all BYOD devices to be formally registered, and an inventory of authorised devices will need to be maintained, with simple reporting procedures for lost, stolen or compromised devices.

Technical measures

A range of technical measures will be needed to support BYOD and maintain an appropriate level of control over access, data and devices.  Depending on your organisation’s risks and chosen model, these may include:

• A means to monitor access to corporate resources
• Mobile device management (MDM) to enrol devices in a managed security platform which can enforce security settings automatically and monitor compliance with minimum standards.
• The segregation of data to separate corporate and personal data using secure containers or work profiles.
• Prevent copying of business data into personal applications or storage.
• Role-based access controls including strong passwords or passcodes, MFA and automatic screen locking.
• Encryption, where possible, of data both at rest and in transit and encrypted communications between devices and corporate systems.
• A requirement for users to patch operating systems and ensure timely installation of security updates.
• Data loss prevention (DLP) measures to restrict downloading, forwarding and printing of sensitive data and to block transfers to unauthorised storage locations.
• Monitoring and incident management procedures to monitor access to corporate resources.

We are seeing increasing availability and reliability of software that is used to support a BYOD approach by separating corporate and personal information, controlling data movement and supporting remote wipe capabilities. This software includes:

• MDM such as Microsoft Intune, VMware Workspace ONE and Cisco Meraki Systems Manager.
• Mobile application management (MAM), such as Microsoft Intune App Protection Policies, to manage corporate applications without controlling the entire device
• Mobile threat defence (MTD) such as Microsoft Defender for Endpoint and Lookout Mobile Security.
• DLP such as Microsoft Purview DLP, Symantec DLP and Forcepoint DLP.

We usually find that employee’s departure is one of the highest-risk points in the BYOD lifecycle.  Unless access and data are managed promptly, personal and corporate information may remain on the employee’s device after they leave, outside the organisation’s effective control and at risk of inappropriate disclosure.

If adopting a BYOD approach, you will need to develop and implement a procedure for leavers which, where technically possible, selectively wipes only corporate information while preserving the employee's personal data.  Other security controls should include:

• Immediately disabling accounts and access credentials
• Removing access to email and collaboration platforms
• Revoking authentication tokens and certificates
• Remotely removing corporate applications and data
• Verifying deletion of locally stored business information
• Recovering any encryption keys or credentials
• Removing devices from MDM and monitoring platforms
• Reviewing audit logs for unusual activity before departure
• Confirm continuing confidentiality obligations.

BYOD can offer significant operational benefits, particularly in flexible working environments, but it also introduces material data protection and information security risks.  In our consultancy and auditing work, we often identify that problems develop gradually when organisations neither prohibit nor formally manage the use of personal devices.  The result can be  uncontrolled processing of business and personal data.  A successful BYOD approach therefore needs to be deliberately planned around the organisation’s operational needs, risk profile and ability to maintain effective oversight.

A well-designed BYOD framework can enable cost-effective and flexible working while maintaining compliance, protecting personal and corporate data and reducing cyber security risks for both the organisation and its employees.  It can also be used to support robust business continuity measures.

We always advise organisations that, under the UK GDPR, accountability for personal data remains with the organisation regardless of device ownership.  Effective BYOD programmes therefore require clear governance, risk assessments, documented policies, employee agreements, technical controls, device management software and robust leavers procedures.