IT Pro Panel: Why BYOD is (sort of) here to stay
CIOs explain why they aren’t going all-in on personal devices
If you're of a certain generation, you may remember the days when mobile devices were reserved mainly for top executives and high-rolling businessmen. Those days are long gone, of course, and smartphones are now ubiquitous within the workplace. However, for years – if not decades – debate has raged over whether it's better to give employees company-owned devices on which to conduct their business, or to simply let them use their own phones and laptops to do their work.
This conversation has been jump-started within many organisations by the arrival of COVID-19 and mass remote working. As demand for devices rapidly outstripped supply, employees were forced to fall back on using their own machines to get things done. But with lockdowns gradually easing and businesses planning for a future of hybrid work, are we heading for a world in which company-owned devices are a thing of the past?
The answer, according to members of the IT Pro Panel, is somewhat complicated. Conversations around BYOD policies often tend to centre on mobile devices, but the majority of our panellists reported that providing employees with work phones wasn't something that they found particularly necessary. Newcastle Building Society CIO Manila McLean, for example, is content with enabling users to access secure mail systems on their personal device.
"We're actually just working on our internal BYOD policy," says Ritam Gandhi, founder and CEO of Studio Graphene. "As a general rule of thumb, we insist on providing our own laptops, but not mobile phones. The simple reason is that we know everyone prefers to carry around only one mobile phone, and they use it for personal and work purposes."
The need for mobile devices can also be based on job roles, as Richmond Events director of IT Liam Quinn demonstrates. Prior to COVID, only the company's salespeople were given smartphones, as they were the only people who were expected to spend a large portion of their time outside of the office while the rest of the staff were equipped with desk-based landline phones.
The advent of home working drove the company to invest in a softphone solution powered by Microsoft Teams, and the company is planning to phase out desk phones as a result. Quinn also anticipates that new sales staff will probably not be given a company smartphone by default.
"There has definitely been a shift … away from a landline over the last 12 months, and only 50% of our colleagues want a phone when we upgrade to Teams calling next month," says Quinn. "The rest just want calls diverted to their mobile – regardless of whether it's a company one or not."
One of the principal reasons for giving staff corporate smartphones is to ensure the safety of company data, as employer-owned devices can be managed, secured and locked down in ways that personal phones can't. As EMEA CISO of LafargeHolcim, this is something that José María Labernia is acutely aware of, and he walks this line by offering employees a compromise.
"We've had BYOD in place for years, but with considerations," he says. "We only allow trusted and managed computers to connect to our network. This works by providing all employees with a corporate workstation and smartphone, but if for whatever reason an employee or a contractor wants to use their own computer or mobile phone, they are able to do so by secure means such as corporate MDM enrollment, desktop and app virtualisation, etc."
"Yes, developers sometimes complain, but security is our license to operate, and we can't accommodate all individual needs. All these services are linked to a fully integrated IAM system, so that whenever a user or a contractor leaves the organisation, all their remote access privileges get revoked."
Labernia's organisation allows workers to choose their device from a limited pool, with a range of smartphones and workstations on offer. While the provision of smartphones was somewhat unusual among our panellists, the decision to offer laptops to employees was much more universal. Unlike with phones, however, the crux of the matter was less about security or employee preference than about fundamental capabilities.
"We provide corporate devices, but there is a choice of kit typically linked to role," explains McLean. "Examples include a standard spec laptop for the majority of our colleague base, high-spec laptops for developers and engineers, Apple Macs for mobile developers and UX designers, and Surface Pro units for architects. This works well for our colleagues."
This is an understandable approach; the role someone's doing will likely have a strong influence on their preferences for their laptop. Line-of-business employees who need to access specific applications, for example, will need Windows-based machines but probably won't require them to be particularly powerful. Developers like those that make up Studio Graphene's staff, meanwhile, will need higher specifications, and may gravitate towards operating systems like Linux or macOS.
"We let everyone select their own device, within reason," Gandhi says. "For instance, with engineers, we understand they need more memory on their laptops, so we customise accordingly."
"In our case, we ended up with around 15 different workstation models," Labernia adds, "as the cost has a big impact depending on the country buying it across EMEA. So the 'standard' kind of model for users in country A does not need to be the same one as in country B or C."
As Gandhi notes, it can be difficult to convince people to move away from using their personal smartphone in favour of a company-owned one, but the same isn't always true of laptops. Many people may not even have a laptop of their own, making employer-provided models all the more necessary. There are some, however, who do, and will prefer to work on their own machine if given the choice.
"I think it's down to the business," Quinn offers. "We had very little push-back when we stopped imposing laptops on people that had better machines at home!"
"I agree with Liam," Gandhi says; "I think it varies between businesses and the type of device. For us, forcing employees to use company laptops is not a problem, but forcing them to use company mobiles or adhere to company policies on their personal phones (if they are using them for a work purpose) is challenging."
For almost all of our panellists, virtual desktop infrastructure has been the most efficient way to bridge the gap between work and personal devices – allowing users to access all the applications and compute performance they need in order to do their jobs, regardless of whether they're using their own devices or a corporate-owned machine.
"In COVID times, it was a bit of a challenge to keep everybody working remotely in lockdown mode," Labernia says. "Many users have workstations at the office and can't bring them home, so we extended our virtual desktop solution for around 6,000 users. And the best of it is that once lockdown was over, we were able to permanently delete circa 5,000 virtual desktops, providing full flexibility and saving a lot of cost."
Quinn's organisation, meanwhile, has been using Citrix-based VDI for almost twenty years, and is well-versed in the practice. This means that, even though his staff usually use HP thin-client devices rather than company laptops, they were still able to work from home unhindered.
"We're rolling out VDI and can see that it'll be a great solution for some archetypes of colleagues," adds McLean. "Others will remain on VPN; we feel a hybrid solution gives enhanced operational resilience as we're not overly reliant on one solution."
However, while the combination of VDI and personal devices has been particularly instrumental in helping organisations react to the pandemic, it seems that corporate devices still have a long future ahead of them. Our panellists agreed that the advantages offered by company-owned equipment – especially when it comes to laptops – are just too great to disregard.
"I guess on a general basis, employees prefer a work device," says Labernia. "And organisations too, as the support is easier to provide. For IT staff providing field services and support, it's a challenge if each user comes with different brands and very different problems to fix. BYOD should also be linked to FYOD – or Fix Your Own Device."
"I think company-owned equipment will always have a place (at least in the mid to long term) because security is going to grow in importance as a factor that needs consideration," Gandhi explains, "and secondly, providing a device ensures that an individual has the right equipment for their job - which is again growing in importance in a digitally-led economy."
To apply to join the IT Pro Panel, please click here to enter your details. Please note that we are not accepting applications from technology vendors at this time.
Consumer choice and the payment experience
A software provider's guide to getting, growing, and keeping customersDownload now
Prevent fraud and phishing attacks with DMARC
How to use domain-based message authentication, reporting, and conformance for email securityDownload now
Business in the new economy landscape
How we coped with 2020 and looking ahead to a brighter 2021Download now
How to increase cyber resilience within your organisation
Cyber resilience for dummiesDownload now