Re: Control

Access is not the problem. The problem is too much access.

For instance, you connect to your VLAN, and you want to access files. Now we have issues with viruses (if I break your phone you'll sue me, if you break my network I'll kill you), data protection, data retention, etc. etc.

But because you *DON'T* control those external devices there's no way to say that you're legally in charge of them (even if the users "agree", you're still failing in your duty as a data retainer, and CANNOT make the employee submit those devices to your whims without a lot more hassle - e.g. "we need to show a court that file you deleted from the network last week shortly after copying it to your phone"). You have no right to enter, seize or otherwise control a user device EVEN IF they did give you permission once. And it would be your fault if something goes wrong and gets out (because someone's phone is nicked, say, and sensitive pages are recovered from the browser history of an insecure browser that THE USER chose because you did not lock down what apps they can use) because your policy, despite forbidding the action, will be pretty much blamed because it allowed it to happen anyway.

Yes, there are workarounds but everything BYOD creates extra hassle in this area. You can VLAN everything off, open up only external access to verified users over secure connections with certified-clean devices, push everything through a centrally-controlled and logged web-based interface with zero permissions. But they can still run off with data that you, as a company, can be required to provide by law and/or not allow distribution of. And do so accidentally, automatically, and unrecoverably.