RSA Conference 2011: BYOC and Security

I presented a session on BYOC and Security at RSA Conference 2011 today. Judging from the turnout (the room was packed), there is a lot of interest in this topic right now as companies are struggling with how to deal with employee-owned devices. When I asked how many people worked at companies that have official BYO programs, only a few people raised their hands. But when I asked how many people use a personal device for work, almost everyone's hand shot up. Too many IT departments either try to restrict access from personal devices, in which case employees work around the restrictions so they can get their work done, or the IT departments put their blinders on and pretend the problem doesn't exist. They would be much better off to actually embrace BYO and make it easy for users to "do the right thing".

Companies stand to save a lot by adopting BYOC programs because they can get out of the business of owning and managing people's desktops and laptops. Support costs are actually lower with BYOC than with corporate-owned devices. Not only that, but BYO actually leads to happier and more productive users. One of our law firm customers had their employee satisfaction national ranking jump from 95th place to 16th place in one year, and the only change they made was to deploy MokaFive and allow their employees to choose Macs. Employees who participate in BYO programs also work longer hours, are more likely to work from home and in the evenings, and are less likely to lose or break their laptop.

Once companies realize their employees are already using their own devices anyway, and it is not that difficult to provide the corporate environment in a managed VM in a secure way while still letting employees and contractors use their own machines, they will start adopting official BYOC programs. Don't get me wrong - there are lot of challenges to setting up a successful BYOC program. But the organizations that embrace this change rather than resist or ignore it will be better off, with lower costs and happier, more productive employees.

Update: The slides for my RSA 2011 BYOC talk are now available online.