Thinking beyond data security: a comparison of the main mobile strategies

Transcription

1 Thinking beyond data security: a comparison of the main mobile strategies

2 Contents Introduction 3 Mobility in the workplace: the key strategies 4 Comparing BYOD, COPE and COBO 5 Productivity 6 Cost 7 Billing 8 Privacy 9 Maintenance + support 10 How smartnumbers can help 11 About Resilient 12 Thinking beyond data security: a comparison of the main mobile strategies 2

3 Introduction There s no denying that mobile devices have become ingrained in every aspect of our lives. Employees, particularly those of the younger generation, are emotionally attached to their devices and apps, and expect the same technology experience at work that they get everywhere else. As younger generations flood the workplace, having the right mobile policy in place is now a key consideration for businesses looking to attract and retain the talent they need. The Government s 2013 Future of Work study reported that 92% of millennials identify flexible working as a top priority when choosing a job. For this reason, defaulting to the old policy of buying and handing out devices to staff, or simply turning a blind eye to mobile usage, may not be good enough anymore. It s time for organisations that have not done so already to navigate the alphabet soup of mobile strategy acronyms and start exploring options such as COBO, BYOD, CYOD and COPE. But while some businesses have their mobile strategies worked out, many are still trying to get their heads around which approach to enabling mobility in the workplace is best for them. It s a decision that is critical to get right. However, it s often complicated by the overwhelming glut of advice available, and a focus on data security that tends to ignore many of the other issues to consider. In this ebook we outline the different aspects to think about for the most popular mobile strategies in the form of a simple comparison table, so you can assess the benefits and risks of each. Thinking beyond data security: a comparison of the main mobile strategies 3

4 Mobility in the workplace: the key strategies Here, we define the four main mobile strategies in use today. Although it s often framed as a question of one or the other, for larger organisations there is unlikely to be a one size fits all policy for all employees. It s common for them to have a combination of strategies in place to cover different scenarios, based on the mobility needs of different roles, business units, risk and compliance profiles and various other factors. COBO COBO (Corporate Owned Business Only) is the traditional approach to mobility in the workplace. Devices are supplied and managed by organisations, and restricted to workrelated activities. Highly regulated or secure environments often still opt for COBO for many of their employees, as it is seen as the most pragmatic choice for those that need to keep the tightest rein on corporate data and protect intellectual property. BYOD The trend for BYOD (Bring Your Own Device), or allowng employee-owned devices for business use, has grown at a rapid pace over the past few years. IT analyst Gartner predicts that 85% of all companies globally will provide some sort of BYOD programme by While companies previously had to pay for hardware, software and service contracts, BYOD shifts those burdens onto employees, while giving them the freedom to work productively from the device they choose. Security is often seen as the biggest inhibitor, but even highly regulated industries like healthcare and financial services are coming round to the benefits of BYOD. This is thanks to the rise of software such as Enterprise Mobile Management (EMM) that works to secure data regardless of device ownership. Thinking beyond data security: a comparison of the main mobile strategies 4

5 However, an often-ignored aspect of BYOD is the phone number. In this regard, BYOD can be divided into two types: employees having one phone with a single number that they use for both personal and business; and those that have a separate number for business use on their personal device. There are some distinct differences between these two types of BYOD, as we will explain in this ebook. CYOD A variation of BYOD is CYOD (Choose Your Own Device) whereby staff are allowed to pick from a limited list of company-sanctioned devices, which the company has approved for security, reliability and durability, as well as any corporate discounts available. COPE Those looking for a middle ground between allowing employees complete freedom and restricting them to a corporate-owned business-only device programme might settle for COPE (Corporate Owned Personally Enabled). COPE programmes allow staff the use of a device chosen and paid for by the company, which the company retains ownership of. With COPE, devices can be pre-configured by the organisation for the needs of the individual based on role and responsibilities, but the employee can personalise the device and content and use it as they see fit, as it s not locked down for business use only. Thinking beyond data security: a comparison of the main mobile strategies 5

6 Comparing BYOD, COPE and COBO While the question of how to keep data secure is one important aspect to consider in a workplace mobile strategy, it s largely been answered over the last few years as advancements in mobile security software have occurred at a rapid pace. Extensive guidelines for employers have been issued by the UK s Information Commissioner s Office (ICO) and issues such as malware prevention, authentication and app control are by now well known and discussed. However there are a range of other considerations that must be taken into account when it comes to letting staff work productively from mobile devices. For example, how will you protect the privacy of their personal communications under stricter new data privacy laws? Will you be able to accurately bill for business calls only? And what aspects of a mobile device and plan should your company be paying for? These tables compare and contrast the main mobile strategies on a number of these issues, looking at COBO, BYOD with the use of one number, BYOD with number separation, CYOD and COPE. Productivity + staff satisfaction BYOD /CYOD (2 numbers, 1 phone) BYOD /CYOD (1 number, 1 phone) COPE COBO Having a separate business number on a personal device means staff can easily see when someone is calling them about work, and react accordingly. This means they are able to switch off from work outside of work hours and have greater control over when and how they do business. Staff have the freedom to utilise the device, apps and services they work best with, and can completely personalise their mobile experience to meet their needs. Using the device they know - and use all the time anyway - encourages them to work flexibly, boosting productivity. However, they may find it difficult to achieve a good work-life balance when using the same device for work and personal communications. Clients and customers may call them out of hours or whilst on holiday, or they could get unsolicited calls. Devices can be pre-configured by the business with all the best, corporate-grade apps for employee productivity, chosen by IT. But employees still have some choice and autonomy as they can customise the device once they have it, and can keep it for their personal use. They may find the choice of devices given to them by the company restrictive, however, and decide to use their own phone anyway. This means they are likely to have to carry around two devices, which can be seen as an annoyance. With a phone solely for business use, companies provide the devices, apps and tools most suited to the job and can reduce distractions. However, for those used to having their own phone to do what they like with, a corporate mobile device may be seen as too restrictive to employees, leaving them unsatisfied and less productive. They may simply revert to using their own personal device, forcing them to carry two phones. Thinking beyond data security: a comparison of the main mobile strategies 6

7 Comparing BYOD, COPE and COBO Cost BYOD /CYOD (2 numbers, 1 phone) (1 number, 1 phone) COPE COBO With a separate number for business communications on an employee-owned device, there is automatic separation of billing. Because they have complete choice of carriers and mobile plans for their business number, businesses can take advantage of cheaper corporate rates for data and wireless services, or optimise a plan according to a certain role. With accurate split billing they do not end up paying out more than is necessary in reimbursements. One of the major advantages of BYOD is that there is no upfront cost for the employer, as the employee pays for their own device. There s also no need for the company to invest in new devices to keep the corporate mobile estate updated. However, employers should beware of hidden costs. For the IT department, supporting a huge range of devices from an app-security perspective can mean investing in expensive software. Users may expect to receive support for devices they use for work, even if they are not company owned. And without any way to separate business and personal communications on one device, companies must carry out reimbursement schemes to bill for business calls. This could see them losing out on discounted corporate rates for data and wireless services, for which consumers typically pay a much higher price. The main challenge for those providing a single corporate device for both business and personal use is how to separate usage for tax purposes. Businesses can claim the cost of a mobile phone provision as a tax deductible expense when calculating corporation tax, but only on amounts specifically related to business use. As well as the up-front cost of the device, employers are lumbered with continued support and maintenance, software licensing fees and upgrading the corporate data plans. However, they may be able to take advantage of special deals for businesses and buy in bulk, as well as catering their business data plans to users unique requirements. A field salesperson, for example, may use a lot more minutes or data than someone who is office-based, and a corporate-designed mobile plan can reflect this. Thinking beyond data security: a comparison of the main mobile strategies 7

8 Comparing BYOD, COPE and COBO Billing (2 numbers, 1 phone) (1 number, 1 phone) COPE COBO With two separate numbers for personal and business calls, it is simple to bill for only business calls, and there is no guesswork involved. This removes the need to process expense forms each month, saving on time and admin burden. Where staff have one number for both personal and business calls, Employers or staff have to estimate how much they spend on business calls and texts. Companies are legally obligated to accurately report mobile phone expenses to HM Revenue and Customs (HMRC) for tax reasons. If you are unable to do so, you could face substancial fines for VAT accounting errors, or miss out on being able to claim back any VAT. Some organisations give a stipend or fixed sum towards business calls, but this can lead to disputes if staff think they ve been unfairly estimated. Organisations might over-estimate how much this stipend should be, costing them more money than necessary. Organisations can easily and automatically bill for any business calls made on a company-device, when it is restricted to business calls only. However, it may be difficult to monitor usage, and there is the potential for abusestaff could be using their business phone for personal calls and then billing them to the company. Thinking beyond data security: a comparison of the main mobile strategies 8

9 Comparing BYOD, COPE and COBO Privacy (2 numbers, 1 phone) (1 number, 1 phone) COPE COBO The use of Enterprise Mobility Management (EMM) to ensure the security of company data is common in BYOD. But solutions that include activity monitoring, tracking or remote lock and wipe raise some questions over privacy rights. Companies must ensure they have full consent to install and manage any software on user s a device, and communicate clearly defined policies. Having a separate number for business communications is a privacy boon, as it ensures employees cannot have their personal communications listened in to or recorded. This ensures companies are complying with privacy law and gives staff the peace of mind that their right to privacy is respected. When an employee uses their personal device for work without any separation of business and personal use, this is a risk from a privacy perspective. If your organisation records mobile calls for compliance or marketing purposes, for example, how do you ensure you don t log personal communications as well? When a corporate device is used for both work and personal use, this throws up quite a few issues around data privacy. For example, it is illegal to wipe personal data remotely from a stolen or lost device, such as family photos and contacts. Also, employers are in breach of privacy law if they listen in to or record private communications on a user s phone while working out expenses, managing apps, carrying out support or undertaking the routine recording of calls and texts for compliance and marketing purposes. In this case, employers will need to find a way to separate business communications from personal ones. Since devices are used for business only, this reduces much of the risk of privacy invasion for employees in theory. However, as the boundary between work and home is increasingly blurred, it s important to give staff very clear policies on what they are and aren t allowed to do with their devices, and what data IT will be privy to. It may not always be possible to ensure staff stick to these policies and lock them down for business use only. Thinking beyond data security: a comparison of the main mobile strategies 9

10 Comparing BYOD, COPE and COBO Maintenance + support (2 numbers, 1 phone) (1 number, 1 phone) COPE COBO Where devices are not corporate owned, responsibility for supporting them can be left to the user, including any upgrades and repairs. But there may be a hidden support burden for IT, as they must make sure any company apps and MDM services work on every device and every operating system in use. For this reason, IT managers may choose to limit the range of operating systems or devices allowed (CYOD). A good policy must explicitly define who is responsible for what support and maintenance tasks, as users may still expect a device to be supported if it s used for work activities. Handing out corporate devices ensures the uniformity of devices and operating systems, making support simpler from an IT perspective. However, employers have the time-consuming burden of managing and supporting handsets, software updates, apps, security and just about everything else on the device. Where staff do not get a choice of device, there may be a learning curve as they may have to learn how to use unfamiliar devices, which means more time spent supporting them. Staff are also less likely to take care of a device that isn t theirs, and as a consequence are more likely to lose or break it, particularly if they carry a personal one too. Thinking beyond data security: a comparison of the main mobile strategies 10

11 How smartnumbers can help With smartnumbers from Resilient, organisations provide staff with a distinct business number on any device. Giving employees a smartnumber on their phone makes managing BYOD or COPE programmes easy, as it separates business and personal communications on one handset - no need to carry two phones. Calls and texts are automatically billed to the company, eliminating time-consuming reimbursement claims and removing guesswork when it comes to mobile allowances. Personal communications are kept entirely private in compliance with privacy law, and staff have the freedom to use one device both in and out of work. They can even delegate a call to a colleague or automatically send to voic when they are unavailable or on holiday. smartnumbers are handy for businesses that have a lot of temporary staff that may change roles often, as business numbers can be kept by the business and given to new staff as they come on board no need for customers or partners to store a new one. It is a simple cloud-based solution to the problem of separating business and personal communications that works with any network carrier and requires no extra SIM. Thinking beyond data security: a comparison of the main mobile strategies 11

12 About Resilient This ebook was created by Resilient, the company behind smartnumbers, a range of communications services that deliver mobility, continuity and compliance to public and private sector organisations. Smartnumbers are trusted by 7 of the top 10 Global investment banks, 50% of the UK s blue light services, and over 40,000 Ministry of Defence personnel. The services are available directly from Resilient and also from BT. This ebook is not intended to be a source of legal advice, and should not be relied on as such. Phone or visit trusted communications mobility continuity compliance