Bring Your Own Device (BYOD) – Solutions for End of Life

By By David Bernstein, AnythingIT Inc.

The Good, the Bad, and the Ugly

As the consumerization of IT continues to grow, Bring Your Own Device (or BYOD) is becoming an accepted business practice for both small businesses and enterprises. Patricia Titus, Chief Information Security Officer at Unisys, said, “We found that our employees wanted to use different products [than] what we were buying. It was a huge paradigm shift… They wanted to buy the devices they were most comfortable with.”

Worldwide tablet shipments are expected to reach 60 million this year and smartphone shipments to reach 478 million, market researcher IHSiSuppli estimates. With each new version release, Apple is making it easier for consumers to perform their jobs on their iPads. According to Consumer Intelligence Research Partners, 21 percent of the latest version iPad owners are using it for work, compared to the 13 percent of all iPad users. Business use of these devices has surpassed its use for social networking, email, and reading.

According to a global IT survey conducted by Citrix, 25 percent of enterprises and small to medium-sized businesses worldwide support the use of personal devices for business purposes.

This increasingly popular business trend presents a number of problems for IT managers. Of the US businesses surveyed, more than 67 percent of survey participants reported that they don’t have any policies, procedures or IT systems in place to manage the use of personal devices for business purposes. Less than half the firms are aware of all of the devices their staff is using for business purposes. Thirty-two percent of firms are most concerned over the security implications of allowing application and document downloads on personal devices. Adding to that, the fact that very few businesses offer an End-of-Life (EOL) solution for employees who are upgrading their devices and the security risks of mobile devices seem staggering.

While these numbers may seem disheartening to the BYOD enthusiast, 53 percent of businesses have seen productivity improvements of more than 10 percent since implementing the use of personal devices at work, with 16 percent reporting increases of more than 30 percent. Employees who are allowed to use their favorite smartphones and tablets for work are more satisfied and more productive. There’s also the cost savings of the device purchase, a mobile platform management, and the savings of the data plan.

Security

According to Cisco Systems’ annual Visual Networking Index Forecast released in June, by 2015, there will be almost 15 billion network-connected devices—including smartphones, notebooks, tablets and other smart machines—more than two for every person on the planet. By 2015, the average U.S. citizen will have seven connected devices. Employees don’t want to stop using their personal devices for work and businesses are going to have to figure out how to make it work. Personal devices pose numerous challenges in the work environment, including securing the data, ensuring the quality of the service, and data destruction at the equipment EOL. Vendors are looking for ways to make it easier for businesses to identify and authenticate employee devices trying to access the network, and to ensure the proper level of access is applied. A “first step,” Elizabeth Cholawsky, Citrix VP and general manager for IT services says, is to have them “self-report” to management so that their products can be checked, registered and potentially wiped clean if stolen or employment is terminated.

With GotoAssist and GotoManage, Citrix is just one of the vendors offering a remote access solution for IT Managers. Other companies, like Good, MaaS360, LANDesk, and Symantec also play a key role in allowing companies to remotely wipe data and restrict access should an employee lose their portable device or leave the company.

According to MaaS360, “corporate apps, documents, and other materials must be protected by IT if the employee decides to leave the organization, but personal email, apps, and photos should be untouched by corporate IT.

Not only will users appreciate the freedom of this approach, but so will IT, whose life will be infinitely easier as a result. With this approach, IT can selectively wipe corporate data when an employee leaves the company. Depending on the circumstances, if an employee loses the device, the entire device can be wiped. But only a true Mobile Device Management, (MDM) solution can give you the choice.”

This MDM technology offers security and control over devices currently in use. But what happens to the old technology when the employee upgrades? Companies with an MDM solution can remove all corporate content, including emails, VPN settings, Wi-Fi profiles, secure content and files, and enterprise applications while leaving personal information intact, but that is not the equivalent to a Department of Defense data wipe that reputable electronics recyclers would do with retired IT equipment. With the average smartphone being upgraded every 18 months in the US and iPads being bought at a feverish pace to replace laptops, corporations need to offer employees a more secure solution to get rid of their retired electronics than just remotely erasing the corporate data and letting the employee donate (or worse, throw away) their retired computers and smart phones.

Solutions

The first place to start is with education. Employees may not realize that hidden data on their computers, smart phones, and other home office equipment can be accessed if the equipment falls into the wrong hands.

In 2010, the FDIC (Federal Deposit Insurance Corporation) issued guidance on mitigating risks posed by information stored on fax machines, photocopiers and printers. The FDIC is concerned that when these devices are disposed of, there is a risk that confidential data may be compromised if the devices hard drives and flash memories are not destroyed, encrypted or erased.

Take Back Programs

According to the Electronics Takeback Coalition, 23 states have passed e-waste recycling laws which hold the manufacturers responsible, to varying degrees, for taking back and recycling their old products, although they vary greatly. The coalition states, “Some states have laws with collection goals or specific measures for requiring how convenient collection must be. But several states, including Texas, Virginia, Oklahoma, and Missouri, have passed laws which simply require the companies to offer a take back program, but which don’t establish any specific obligations.”

Some will take back their own brand with free shipping and recycle it for free while charging for alternate brands. Another manufacturer gives a small credit towards a new purchase, and another recycles your item for free, but the customer pays for the shipping, which can be significant for TVs and desktops.

Corporate Sponsored Recycling Events

Corporate sponsored electronic recycling events are a great way to provide employees with a convenient way of disposing of their old equipment, while mitigating risks associated with any data left on their hard drives and memory. Hosting a “green” event that benefits employees and the environment can also translate into positive press as well as an avenue for charitable donations.

Working with a certified R2 (Responsible Recycling), ISO, and e-Steward recycler, the corporate event organizer should choose a date and suitable location that can accommodate the appropriate size truck and vehicle traffic for the number of employees at the location. Convenient times might coincide with other employee events, after an IT refresh, Earth Day, or after the December holiday season.

The electronic recycler should also work with your marketing department to create an internal marketing piece that creates excitement about the recycling event, explains the environmental and security benefits of electronics recycling, as well as the ease of logistics for the employees. Depending on the size of an organization, corporate event organizers may want posters in employee entrances and lounge areas, mass emails from HR, and notices in a company newsletter.

A well planned event can generate local press through the Chamber of Commerce, press release distribution, and regional news coverage. The recycler should be able to give an estimated environmental savings based on the pounds of electronics that were collected. Employees recycling usable laptops and smart phones should also be able to specify that they want their equipment donated to a predetermined charity.

Costs

There are costs associated with corporate sponsored recycling events, although they are minimal compared with the environmental benefits and the Public Relations payoff. Typically, the sponsoring corporation will pay for the truck(s) rental, transportation to and from the recycler’s location and the event site, and an hourly fee for the labor.

Summary

BYOD is one way to get around a shrinking IT budget, although it requires a great deal of attention to security, both during the equipment use and at EOL. Through manufacturer take-back programs or corporate sponsored recycling events, organizations can offer employees a safe, economical, and convenient way to dispose of their retired equipment. It benefits the employee, the company they work for, and the environment.