Enabling users to bring their own devices into the workplace BYOD presents an opportunity to use modern consumer technology to work and study more effectively and more safely. This workshop explored ways to move from current practice to a positive adoption of BYOD.

2. From mobile devices to BYOD
Andrew Cormack,Chief regulatory adviser
@Janet_LegReg

3. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 3
We like mobile computing

4. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 4
We like mobile computing
» Research and education aren’t
just office hours

5. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 5
We like mobile computing
» Research and education aren’t
just office hours
» Work wherever/whenever
inspiration strikes

6. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 6
We like mobile computing
» Research and education aren’t
just office hours
» Work wherever/whenever
inspiration strikes
» Increased productivity

7. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 7
We like mobile computing
» Research and education aren’t
just office hours
» Work wherever/whenever
inspiration strikes
» Increased productivity
» Happier users

8. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 8
We like mobile computing
» Research and education aren’t
just office hours
» Work wherever/whenever
inspiration strikes
» Increased productivity
» Happier users
» Could your organisation cope
without it?

9. Policies
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 9
How we secure it
» De jure: the things we write down

10. Policies
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 10
How we secure it
» De jure: the things we write down
» De facto: the things we do
› This sets policy: “email on any device”

11. So how do we secure mobile computing?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 11
AccessServer Device User

12. So how do we secure mobile computing?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 12
IMAP or
web or
VTTY or
none
AccessServer Device User

13. So how do we secure mobile computing?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 13
authentication
encryption
IMAP or
web or
VTTY or
none
AccessServer Device User

14. So how do we secure mobile computing?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 14
authentication
encryption
profiles
management
IMAP or
web or
VTTY or
none
AccessServer Device User

15. So how do we secure mobile computing?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 15
authentication
encryption
policies
guidance
support
profiles
management
IMAP or
web or
VTTY or
none
AccessServer Device User

16. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 16
What do you do?
Discuss around table for 10 mins
Fill in the columns

17. What’s the difference with BYOD?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 17
authentication
encryption
policies
guidance
support
profiles
management
IMAP or
web or
VTTY or
none
AccessServer Device User

18. What’s the difference with BYOD?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 18
authentication
encryption
policies
guidance
support
profiles
management
IMAP or
web or
VTTY or
none
AccessServer Device User
 

19. What’s the difference with BYOD?
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 19
authentication
encryption
policies
guidance
support
profiles
management
IMAP or
web or
VTTY or
none
AccessServer Device User
 

20. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 20
What controls do you enforce on mobile devices?

21. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 21
» Passphrase, patches, anti-virus, firewall
» Encryption, remote wipe
» Safe downloading, account/directory
separation
» Thinking about where you are
What we’d like…

22. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 22
» Passphrase, patches, anti-virus, firewall
» Encryption, remote wipe
» Safe downloading, account/directory
separation
» Thinking about where you are
Feels like basic good practice…
What we’d like…

23. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 23
» Passphrase, patches, anti-virus, firewall
» Encryption, remote wipe
» Safe downloading, account/directory
separation
» Thinking about where you are
Feels like basic good practice…
Actually, it’s the ICO’s recommendations
for BYOD!
» Warns against MDM/tracking of
non-owned devices
What we’d like…

24. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 24
How to be safe without device management?
Already rely on users for some controls

25. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 25
How to be safe without device management?
Already rely on users for some controls
» Their behaviour may already be
biggest risk

26. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 26
How to be safe without device management?
Already rely on users for some controls
» Their behaviour may already be
biggest risk
» Especially if they have admin rights!

27. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 27
How to be safe without device management?
Already rely on users for some controls
Possibly move some controls to
server-side
» But tightening de facto policies on
existing services is a hard sell

28. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 28
How to be safe without device management?
Already rely on users for some controls
Possibly move some controls to
server-side
» But tightening de facto policies on
existing services is a hard sell
Or, encourage users to implement them

29. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 29
How to be safe without device management?
Already rely on users for some controls
Possibly move some controls to
server-side
» But tightening de facto policies on
existing services is a hard sell
Or, encourage users to implement them
» What do you lose with corporate
mobile?

30. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 30
How to be safe without device management?
Already rely on users for some controls
Possibly move some controls to
server-side
» But tightening de facto policies on
existing services is a hard sell
Or, encourage users to implement them
» What do you lose with corporate
mobile?
» What do you lose with BYOD?

31. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 31
Self-interest

32. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 32
Self-interest
81% employees don’t care about mobile security

33. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 33
Self-interest
81% employees don’t care about mobile security
Surely more care about their own devices?

34. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 34
Self-interest
81% employees don’t care about mobile security
Surely more care about their own devices?
Their BYOD security interests are same as ours

35. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 35
Self-interest
81% employees don’t care about mobile security
Surely more care about their own devices?
Their BYOD security interests are same as ours
» If they know why/how to do the right thing

36. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 36
Self-interest
81% employees don’t care about mobile security
Surely more care about their own devices?
Their BYOD security interests are same as ours
» If they know why/how to do the right thing
» Might BYOD even be more secure?

37. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 37
How might we help?
Discuss around tables for 10 mins:
» How to motivate
» How to support
And report back good ideas…

38. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 38
Good questions...
“What should I do if I lose it?”
“What should I do when I pass it on?”

39. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 39
Good questions...
“What should I do if I lose it?”
“What should I do when I pass it on?”
“How should I back up my device?”

40. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 40
Good questions...
“What should I do if I lose it?”
“What should I do when I pass it on?”
“How should I back up my device?”
“How do I share files with others?”
“How do I get new apps?”
…

41. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 41
BYOD plan

42. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 42
BYOD plan
1. Review existing measures for
mobile devices
› Already accepted risk: don’t demand
more of BYOD
› If risk now unacceptable, change mobile

43. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 43
BYOD plan
1. Review existing measures for
mobile devices
› Already accepted risk: don’t demand
more of BYOD
› If risk now unacceptable, change mobile
2. Prepare to support device owners

44. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 44
BYOD plan
1. Review existing measures for
mobile devices
› Already accepted risk: don’t demand
more of BYOD
› If risk now unacceptable, change mobile
2. Prepare to support device owners
3. Motivate device owners
› Should improve mobile security too

45. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 45
BYOD future
Design systems to be BYO-by-Default?

46. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 46
BYOD future
Design systems to be BYO-by-Default?
» Presume it is the norm
» Identify / configure systems and data
that aren’t suitable for it

47. 09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 47
BYOD future
Design systems to be BYO-by-Default?
» Presume it is the norm
» Identify / configure systems and data
that aren’t suitable for it
BYOD will happen anyway
Much better to design for it than ignore it

48. Questions?
Or, come and discuss this afternoon…

49. BT paper
» btplc.com/News/Articles/ShowArticle.cfm?ArticleID=F5E90F45-
966A-4872-8CF6-C2C32F608541
ICO on BYOD
» ico.org.uk/for_organisations/data_protection/topic_guides/online/byod
CESG
» gov.uk/government/collections/bring-your-own-device-guidance
Me
» community.ja.net/blogs/regulatory-developments/article/mobile-
device-policy-byod
» community.ja.net/blogs/regulatory-developments/tags/BYOD
References
09/03/2015 Jisc Digital Festival, 9-10 March 2015, ICC Birmingham 49