Let me start this post by saying that, as with all fad.. err, trends, I'm not totally against BYOD. I've just been in IT for long enough not to jump on the bandwagon of every damn "trend" that comes along, because they come along often.

 What is BYOD? Bring Your Own Device, or in other words, staff bringing their own smartphone, tablet, notebook, or similar devices to work. It's an idea that's gained quite some traction with marketers, journalists, and C-level execs. It's not so far different from the classic problem of a high-level exec buying a new shiny device - outside of the Standard Operating Environment - and insisting that IT make it work. It's just spreading that out to a much broader degree, following the innumerable "trends" of times past.

Server-based computing and thin clients never really set the world on fire. Server virtualisation didn't reduce complexity or server sprawl - in the sense that it's now all too easy to run up a new virtual server, and you now have a whole host of new considerations (and licensing) in play. And desktop virtualisation? Well, if you listen to some, BYOD will make them happen.

That's just a very narrow selection of trends, and you'll note for example that virtualisation is actually very successful - just not necessarily when measured against the original hype. I'm not saying BYOD won't happen - all "trends" have their adopters to lesser or greater extent. Virtualisation has been a great benefit to IT, overall, and no-one would seriously call it a failure.

You could say that I myself use BYOD right now, to a limited extent. My mobile device connects to my current employer's mail servers using ActiveSync. My notebook gets plugged into their network, and I do a lot of my work on it, rather than the machine they've provided. It has a better screen, for starters, and MS Project, which the provided machine doesn't have. But in fact I copy my work onto a USB key and save it to their network drives when finished; I don't connect to their servers at all, although do make use of their Internet connection. Using my own notebook and my own phone is just a convenience and a privilege, rather than a necessity.

There's plenty of companies that provide remote access to staff from home, using their own computers to connect to work - generally with some restriction to the level of access provided, of course. There are those who might say that BYOD is simply a logical next step, especially given the proliferation of personal iPhones, iPads, and the like. But just saying, promoting, or mandating something doesn't make it practical, realistic, or actually happen on a widescale level.. something many journalists, marketers, and C-levels perpetually fail to appreciate. I am a strong proponent of the simple fact that IT exists for the business, not vice versa, and that we are employed specifically to meet business needs.  But sometimes IT has to push back on fads. Sometimes we should hide the management magazines and periodicals. Sometimes we should do terrible things to marketers and journalists that promote complete and utter guff.

Is BYOD realistic? The IT manager in me gets all kind of alarm bells just thinking about it. It's an additional risk to consider, and one which can require a lot of mitigation to make that risk acceptable in any form.

A device outside the scope of business ownership and management is a risk. Who's responsible for ensuring that it's suited to the task, and won't impact productivity? Who ensures that it has appropriate antimalware that is up to date and correctly configured? Who ensures that data stored on it is backed up, that it's ultimately stored on corporate servers, and that it's ultimately removed from the device? When does a device failure become an IT problem? When does a broken or lost device become an insurance problem? Who mitigates unrestricted admin access to the client machine? Who ensures machines are updated for critical zero-day bugs? What are the licensing and support liabilities? Do you have an 802.1X / NAC / NAP deployment? Do you already have wireless, or is this an investment you'll need to make for the sake of a few iPads? Are you going to mandate staff buy their own devices (good luck), or are you going to have a dog's breakfast of owned and personal devices to keep track of (yes)?

These are just a few of the issues. There are answers to each of these - some not as pretty as others. For example, ownership is important, and an employer could perhaps be said have liability for lost or broken devices. Do you want to have that argument? Is tackling all these issues really sensible, in contrast to getting on with business as usual? It's easy to say that server-based computing could enjoy a resurgence with BYOD, or that desktop virtualisation will come into its own. For some companies, one or both of these will be true. Others will just go with straight out unrestricted access. There are always those who jump on the bandwagon, and in some cases, casualties.

I've always seen the value in employer-provided computers and mobile phones. Generally, risks can be far more easily covered in the SOE paradigm. I've seen a lot of different mobile phone ownership models from different employers - including reimbursement of business calls - and I don't think anything really tops employer-issued phones with good central reporting to avoid abuse, and using call caps where appropriate to minimise the cost. Perhaps a better answer to BYOD is expanding the device offering - let staff pick from a range of devices that suits their job, and keep it corporate-owned. You can then assure the business in supportability, productivity, and flexibility.

Some will always leap on the fad bandwagon before they think. It's always interesting to ask a CIO the rationale for their latest mandate, and I can say that it's easy to pick those who let magazines and marketers dictate their thinking, rather than the business and the realities of their IT environment. Sadly, there's all too many of those, and you may well get stuck with a poor decision that doesn't actually match business needs. It wouldn't be the first time, and it won't be the last. Unfortunately, it's the business that suffers in the end.

 

Posted in: [GeekThink], [IT Pros]

Popular tags: byod, fads, fallacies, herpderp, risk, management