Are you prepared for the BYOD (bring your own device) movement?

Transcription

1 Are you prepared for the BYOD (bring your own device) movement? IRIS Service Management Guide

2 Are you prepared for the BYOD (bring your own device) movement? The trend towards equipping field service teams with mobile technology is well established. Research by the Aberdeen Group in 2011 indicated that 63% of respondents field teams are equipped with a mobile device. This already high proportion is set to rise to 80% during Best-in-class organisations are using mobile technology to drive customer satisfaction, improve workforce utilisation and productivity, reduce time-toresolution, lower their costs and, in some cases, even prompt their service technicians to up-sell and cross-sell during site visits. Clearly, mobile technology has come of age in the field service industry. Here we tackle a different trend, that of employees using their own devices at work or, as it s come to be known, BYOD (bring your own device).

3 The rise and challenge of mass mobility Smartphones are already more popular than PCs. Many industry commentators have noted that 2011 was the year when global smartphone shipments topped those of PCs (including desktops, laptops, netbooks and tablets) for the first time. Gartner has predicted that companies are now facing mass mobility, with sales of smartphones set to reach 645 million units in Increasingly, employees will expect to bring their own smartphones and other devices to work and to be able to attach them to company networks. What impact will this have on your valuable corporate data assets? This isn t just a concern for businesses with an office-based workforce. The same Aberdeen Group research quoted earlier found that in well over a third (38%) of organisations employees were using their personal devices for service work. This whitepaper looks at the issues that can arise when companies allow their employees to use their own devices at work. It s important to note that some of the questions raised, particularly around data protection, can be a legal minefield. You would be advised to work closely with your IT team or IT service provider and to consult your legal advisers to develop the procedures and policies that are right for your business and your workforce, if you decide to allow your field service workforce to BYOD.

4 An unstoppable trend? There are two main reasons for the BYOD trend. First, with the growing consumerisation of IT, employees expect the mobile technology they use at work to have the same consumer-grade bells and whistles as the devices they use in their personal lives. Secondly, they want the convenience of carrying and managing a single device. There is also significant crossover nowadays between the personal and the private. Employees may text a colleague from their personal device, and take a call from a friend on their work device. It can be difficult to say no to the BYOD trend and, indeed, some employers welcome it: generally, it makes employees more accessible and may lower costs and administrative overheads if businesses can replace a corporate contract with a monthly subsidy to employees. However, there are risks attached to a laissez-faire strategy. Broadly speaking, these fall into two categories, which we will discuss individually: Functionality Is the employee s device fit for purpose? Security & privacy How safe is your data and how would you handle any threat to its integrity?

5 Functionality Is the employee s device fit for purpose? The device your employee uses must be able to cope with the tasks expected of it. In some cases, the device will need to be resilient enough to stand up to a hostile operating environment. For your part, your corporate IT infrastructure must be capable of supporting the transmission of data to and from multiple devices across multiple platforms. Do you have a policy for vetting non-company-issue devices? Before authorising a device for connection to corporate networks, you ll need to check whether the device is suitable for deployment in the workplace. Some of the factors to consider might include: Is the technology rugged enough? The latest consumer mobile devices are much more robust than previous generations, but can the device stand up to constant heavy wear and tear? Can it quickly and reliably display the information the user needs to do the job? Can it handle the customised forms you use to record information and applications, such as sending reports back to the office? Google Android has the advantage over Apple in this aspect, offering greater flexibility. Does the device meet your data collection requirements? Does it offer functionality such as barcode scanning, photo and signature capture? Can it also integrate with your back-office computer system? You will need to decide which services a device can connect to and the software requirements. Does it have a vehicle dock for on-the-road use? Does it comply with company health and safety standards? Does the employee s mobile device contract offer the fast replacement/repair that a business contract would? A half-way house If investigation shows that the employee s device is unlikely to cope with the rough and tumble of working life, perhaps there s room for compromise. Functionality such as capturing signatures and photos could be done via their work device, but you may be happy for employees to use their own device for , phone calls and text messaging.

6 Security & privacy How safe is your data and how would you handle any threat to its integrity? Under the Data Protection Act, businesses have a responsibility to safeguard any personal information they collect, whether on their customers or employees. One of the eight underlying principles of the legislation states that: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. (source: It becomes harder to fulfil this obligation if you are reliant on your employees for the security of their devices, and when personal and business data are stored side by side. Device theft and loss inevitably increase with portability: smartphones and tablets are more vulnerable than even their immediate predecessors of laptops and netbooks. Consider the following questions: How stringent are the passwords and encryption protecting your data from viruses, malware and intrusion? How often are employees required to change their password? If the employee leaves the company or goes on long-term leave, what happens to the company data on their device? What does their contract of employment say on the matter? When did you last update your contracts to reflect today s more pervasive use of mobile technology? Should the employee lose their device or have it stolen, what measures will you implement to protect your business from the impact of lost and compromised data? Note, too, that the device is exposed to casual access if it is left lying around in a public place, without the device itself being stolen. How would you identify that this has happened? If a device simply packs up, whose responsibility is it to replace it? What steps do you take to regularly upload company data from an employee s phone and back it up? In a recent survey by internet security company Symantec, 72% of firms believe that employees social networking behaviour could endanger their business security, as these sites can provide a tunnel into corporate networks. What are the heightened risks to your business from the merger of the personal and professional uses of mobile technology? You need to have an agreed, clear and comprehensive mobile security policy that addresses issues such as these, one that deals effectively with a multitude of devices with different approaches to security.

7 To wipe or not to wipe? Faced with data loss, theft or damage, the usual response in the case of company-issued mobile devices is to wipe all the data remotely from the device. This protects your intellectual property and prevents confidential customer and business data falling into the wrong hands. Indeed, as the legislation quoted earlier highlights, it is your duty to do this if there is confidential personal data to protect. However, there s a twist when the device is the personal property of the employee. For many people, their mobile device holds their life and they would be bereft without the data they have accumulated. Unilaterally wiping a device could involve destroying the employee s personal data, contacts, photographs, social media, apps... all of which are protected under the Data Protection Act. So, the employer is caught between the proverbial rock and a hard place: damned if they delete the data and damned if they don t! Check your company policy The possibility of a company finding itself the target of a complaint to the Information Commissioner s Office by a disgruntled employee on loss of privacy grounds can be mitigated. The company should have a formal, written policy, which it communicates clearly and regularly to its workforce, explaining that using their own device at work makes them vulnerable to having their data wiped if their device is compromised. Employers should also gain the employee s informed consent to having their device wiped. As mentioned earlier, your legal advisers should be able to advise you on the wording of your policy to ensure it is watertight in this area. Protecting your data Your systems should require stringent user authentication in order to access enterprise data on a mobile device. Your users should have access only to the information they are authorised to see and are prevented from unauthorised sharing of that information. Your IT team or IT service provider should also look into the possibilities of ring-fencing corporate data to safeguard it from unauthorised access and to isolate it, so that only company data needs to be wiped if the worst happens. You need to be able to respond instantly to security risks by remotely locking access to data on specific employee devices. You should retain the option to prevent access entirely if you are sure that an employee has abused your systems or if the mobile device is lost or stolen. You also need to create a working culture in which employees quickly come clean if they lose or damage a device, rather than trying to cover up the fact. They will be more willing to be open if they know that the company has planned for such an event and has tried and tested procedures in place than can be quickly activated to deal with the situation.

8 Summary Field service businesses should consider applying a two-fold approach to safeguarding their corporate data from the risks that inevitably arise from the BYOD trend. These approaches are complementary, not mutually exclusive: Focus on the people issues. It s about bringing your employees along with you, training and educating them about safe mobile use practices so that you promote an empowered workforce while maintaining organisational security. It s also about understanding your own and your employees obligations and rights around data protection. Investigate the technical measures you can take to safeguard your data and your networks. Data security should already be an inherent part of protecting your business. With increasing use of mobile devices and the new trend to BYOD, these measures must be further reinforced. This whitepaper has introduced some of the factors to consider before letting your field-based employees and indeed your office-based service management teams bring their own devices to work. If this movement has not already affected your workplace, you are in the enviable position of being able to take a proactive stance before the trend creeps up on you. About IRIS Field Service Solutions With over 30 years experience, IRIS Field Service is one of the UK s leading providers of integrated field service management solutions, used by service organisations and growing businesses to manage their operations, service engineers and maintenance technicians. From mobile data, call management and planned preventative maintenance, to scheduling, contract management and KPI reporting, IRIS Field Service gives instant access to real time information to optimise efficiencies, reduce time to invoice and gain unprecedented insight into the most, and least, profitable areas of your business. IRIS Field Service s integrated business critical service management solutions are used in a wide range of industry sectors including: HVAC, utilities, refrigeration, access & security, building & electrical, catering & vending, cleaning & laundry, lighting & signage, and medical & scientific. Find out more For further information, please contact the IRIS Field Service Solutions team: fieldservice@irisenterprise.co.uk IRIS Field Service is part of IRIS Accounting & Business Solutions, a division of CSH, one of the UK s largest private software houses providing award-winning solutions to growing UK businesses. IRIS Field Service Solutions is a trading name of Computer Software Group Ltd which is part of the CSH Group of companies. IRIS is a trademark of IRIS Software Group Limited and CSH is a trading name of Computer Software Holdings Limited. Computer Software Holdings Ltd All rights reserved.