While bringing your own device to work might be convenient, many enterprises look set to crack down on the practice, new research shows.

In a survey conducted by Kinly, more than half (52%) of enterprises said they are mulling a ban on personal devices at the office, with laptops, tablets, and webcams all set for the chopping block.

A key factor behind this crackdown is the rise of ‘Shadow AV’, according to Kinly, which is causing serious security concerns. Shadow AV refers to the use of unauthorized audio-visual equipment and personal tech in the workplace.

Much like the problem of ‘Shadow AI’ - the use of unauthorized AI tools at work - security pros have grown concerned about the prospect of personal tech slipping into the workplace unnoticed.

This is creating serious security ‘blind spots’, the study warned, that leave the organization and individual at risk.

Bring your own device (BYOD) policies have been around for a while, but the shift to hybrid working patterns in recent years means the practice has become untenable from a security perspective, according to Kinly.

More than half (57%) of respondents said it’s becoming harder than ever to secure devices used outside the office and on home networks, for example.

Similarly, over three-quarters (77%) of respondents said that while their in-office equipment is protected with strong encryption and security protocols, that drops to around 66% for remote or personal setups.

As a result, 30% of organizations said securing personal devices and home-based AV equipment is now a top priority for 2025 and beyond.

What are the risks of BYOD?

BYOD policies aren’t inherently dangerous, however, they do carry added risks, Kinly warned. Using devices at the office and at home could expose users - and the business - to serious cybersecurity threats.

Threat actors frequently view personal devices such as these as an ‘in’ when targeting potential victims.

Additionally, as these devices are used in both personal and professional settings, the use lines become blurred when it comes to data protection and compliance. Kinly warned this could leave businesses vulnerable to potential GDPR violations and breaches under regulations such as NIS2.

Don Gibson, Chief Information Security Officer (CISO) at Kinly, warned the use of unsecured devices are the “digital equivalent of leaving your front door wide open and hoping no one walks in”.

“They’re unmanaged, unmonitored, and opening up serious threats - from ransomware attacks to regulatory fines,” he added. “If you’re not treating all devices as part of your security perimeter, you’ve already lost control.”

Despite the growing risks faced by enterprises, Kinly warned many are failing to treat AV as part of their core security posture. If they wish to continue with BYOD policies, robust guardrails must be put in place.

“If businesses must allow personal devices on the network, the priorities should be visibility and control,” Gibson explained.

“That means enforcing role-based access, mandating encrypted collaboration tools, and providing regular employee training.”

Similarly, Gibson noted IT teams must play a key role in securely onboarding personal devices and enforce clear compliance requirements and user accountability standards before granting access to corporate systems.

“Striking the right balance means evaluating risk against reward, because what works for one company, team or region won’t necessarily suit another,” he added.

MORE FROM ITPRO

• Shadow AI is creeping its way into software development
• Why 'shadow SaaS' is becoming a major blind spot for enterprise security teams
• CISOs 'don't understand the risks of shadow IT'

Data security is a top priority across industries. For the education sector in particular, this touches on both the need to protect devices as well as sensitive information and user privacy (student, staff, and family personal information).

With the current landscape in which schools are operating, where they are enabling learning in-person, virtually, and through personal devices, what are the top cybersecurity risks impacting this sector? More importantly, what strategies can decision-makers adopt to deliver secure learning across platforms?

This eBook discusses ransomware, the greatest vulnerability in the education sector - as well as other key threats - along with policies and best practices that are helping educational institutions remain secure in the classroom and online.

Provided by

Bring Your Own Device (BYOD) took on a whole new meaning at the start of the pandemic. Businesses weren’t set up for the sudden move to work from home, and many adopted quick-fix strategies to avoid disruption as COVID-19 took hold.

This rapid shift, however, widened the attack surface. As we settle into 2022, BYOD strategies are further complicated by hybrid work, with employees rotating between their home and the office. The National Cyber Security Centre (NCSC) issued a warning late last year, providing updated guidance on helping UK businesses manage a “potentially difficult IT set up”, suggesting the “just make it work” mentality is over.

The NCSC outlined steps to help companies stabilise BYOD adoption, including sharpening management and deployment methods to ensure BYOD is effective and secure. “You cannot do all your organisation's functions securely with just BYOD, no matter how well your solution is configured,” the NCSC’s senior platforms researcher Luna R wrote in a blog. As we shift into a new era of work, in which working from home is dominant, BYOD strategies must be overhauled to ensure firms remain secure and efficient.

Why BYOD quick fixes don’t work

BYOD cuts IT equipment costs by allowing employees to use their own devices for work. When people were working solely in the office, many businesses managed BYOD with hardware policies and mobile device management (MDM) tools.

The "quick fix" BYOD strategies firms were forced to adopt in 2020, however, were never fit for purpose. When COVID-19 hit alongside home working, it left vast numbers of employees using their own smartphones and laptops without security controls inherent on work-issued devices. The risks are various, including reputational fallout and fines if employees unwittingly expose company data.

A substantial number of companies have failed to re-evaluate their risk profiles since implementing “quick fix” strategies at the start of the pandemic, says Robert Rutherford, CEO at IT consultancy QuoStar. “Nor have they evaluated the technical and policy-based controls required. This is a significant concern that organisations should address urgently.”

The “quick fix” approach to BYOD has often failed to take into account the need to adjust tools, processes, security controls and employee training, says Lorenzo Grillo, managing director of cyber risk services at business management consultant Alvarez and Marsal.

As a result, an employee’s tablet or smartphone could be used in ways that would not be acceptable if it was owned by an organisation. Employees could be late to apply security patches, or, in some cases, not keep devices up-to-date at all. “A device could be taken to unsuitable locations, shared with family and friends, or employees could add unauthorised apps or data,” Grillo warns.

If attackers are able to take over an employee device, the results can be devastating, he adds. “If a personal device is infected with malware, attackers can read the user’s keyboard input, including usernames and passwords. This is how malicious hackers gain access to sensitive company data.”

Many "quick fix" strategies have failed because they prioritised access over security, says John Shier, senior security officer at security firm Sophos. He cites, as an example, the overreliance on remote access services such as Remote Desktop. “This presented attackers with a new set of targets that hadn't existed before the pandemic.”

A common mistake made by businesses is the misconfiguration of remote access technologies, which leaves them more open to attack, adds Martin Riley, director of managed services at Bridewell Consulting. “Cyber criminals are evolving and adapting their techniques to exploit the growing reliance on mobile devices and remote working.”

Which BYOD strategy is right for you?

Hybrid working BYOD requires a combination of updated strategies and tools. Many experts recommend adopting a zero trust model – where no person or device is trusted – to manage BYOD. Yet, as Luna R points out in her blog, there are many misconceptions in this area.

Indeed, many of the technical controls for BYOD are similar to those used in zero trust architecture, but there are important differences – and the concept doesn’t work for everyone, Luna R writes.

When used optimally, however, experts say zero trust is a good starting point for BYOD in a hybrid working environment. Zero trust means separating users and devices as much as possible from corporate assets such as data, applications, infrastructure and networks and following an “identify, authenticate, authorise and audit” model, says Riley.

As part of this, visibility is key to managing hybrid working BYOD. Roel Decneut, CMO at IT asset management company Lansweeper describes how organisations can gain visibility into devices and software. He cites the example of the University of Derby, which implemented a BYOD strategy to allow remote learning and new working strategies for its students and staff.

The university started by setting up and auditing existing technologies and processes. Using IT asset management software alongside robust policies and procedures, the university now keeps track of an extended network of remote devices in staff and students’ homes.

Mobile threat defence (MTD) systems, which build on MDM to prevent, detect and remediate attacks, also help improve visibility and manage BYOD. When properly configured and integrated, these enhance existing zero trust controls by outlining your mobile device risk, according to Shridhar Mittal, CEO at mobile security firm Zimperium. MTD can be integrated with extended detection and response (XDR) solutions to cover emails and networks. “This allows you to apply a holistic approach to cyber security, protecting all devices,” says Mittal.

Crafting your BYOD policy for hybrid working

There’s no one-size-fits-all approach, but firms can start by examining the NCSC’s guidance. Going forward, Grillo recommends a BYOD policy outlining which employees are permitted to use personal devices for business and accessing the corporate network.

Firms need to make clear any restrictions on the type of personal devices – for example, specific models and operating systems – that can be used for corporate business, he says. In addition, businesses should decide which apps and collaboration tools are available to employees to use on personal devices and detail any corporate network access restrictions such as virtual private networks (VPNs).

Other considerations for BYOD strategies include bringing in a formal IT security governance framework, such as ISO 27001 or IASME, Rutherford advises.

As hybrid working continues, BYOD increases flexibility and efficiency, but this should not be at the expense of security. The challenge is getting the balance right, says Riley. “Putting too many restrictions on mobile devices could result in a dip in productivity and user experience. If things are too lax, however, you could be subjected to unnecessary risk.”

If you're of a certain generation, you may remember the days when mobile devices were reserved mainly for top executives and high-rolling businessmen. Those days are long gone, of course, and smartphones are now ubiquitous within the workplace. However, for years – if not decades – debate has raged over whether it's better to give employees company-owned devices on which to conduct their business, or to simply let them use their own phones and laptops to do their work.

This conversation has been jump-started within many organisations by the arrival of COVID-19 and mass remote working. As demand for devices rapidly outstripped supply, employees were forced to fall back on using their own machines to get things done. But with lockdowns gradually easing and businesses planning for a future of hybrid work, are we heading for a world in which company-owned devices are a thing of the past?

The answer, according to members of the IT Pro Panel, is somewhat complicated. Conversations around BYOD policies often tend to centre on mobile devices, but the majority of our panellists reported that providing employees with work phones wasn't something that they found particularly necessary. Newcastle Building Society CIO Manila McLean, for example, is content with enabling users to access secure mail systems on their personal device.

"We're actually just working on our internal BYOD policy," says Ritam Gandhi, founder and CEO of Studio Graphene. "As a general rule of thumb, we insist on providing our own laptops, but not mobile phones. The simple reason is that we know everyone prefers to carry around only one mobile phone, and they use it for personal and work purposes."

The need for mobile devices can also be based on job roles, as Richmond Events director of IT Liam Quinn demonstrates. Prior to COVID, only the company's salespeople were given smartphones, as they were the only people who were expected to spend a large portion of their time outside of the office while the rest of the staff were equipped with desk-based landline phones.

The advent of home working drove the company to invest in a softphone solution powered by Microsoft Teams, and the company is planning to phase out desk phones as a result. Quinn also anticipates that new sales staff will probably not be given a company smartphone by default.

"There has definitely been a shift … away from a landline over the last 12 months, and only 50% of our colleagues want a phone when we upgrade to Teams calling next month," says Quinn. "The rest just want calls diverted to their mobile – regardless of whether it's a company one or not."

One of the principal reasons for giving staff corporate smartphones is to ensure the safety of company data, as employer-owned devices can be managed, secured and locked down in ways that personal phones can't. As EMEA CISO of LafargeHolcim, this is something that José María Labernia is acutely aware of, and he walks this line by offering employees a compromise.

"We've had BYOD in place for years, but with considerations," he says. "We only allow trusted and managed computers to connect to our network. This works by providing all employees with a corporate workstation and smartphone, but if for whatever reason an employee or a contractor wants to use their own computer or mobile phone, they are able to do so by secure means such as corporate MDM enrollment, desktop and app virtualisation, etc."

"Yes, developers sometimes complain, but security is our license to operate, and we can't accommodate all individual needs. All these services are linked to a fully integrated IAM system, so that whenever a user or a contractor leaves the organisation, all their remote access privileges get revoked."

Labernia's organisation allows workers to choose their device from a limited pool, with a range of smartphones and workstations on offer. While the provision of smartphones was somewhat unusual among our panellists, the decision to offer laptops to employees was much more universal. Unlike with phones, however, the crux of the matter was less about security or employee preference than about fundamental capabilities.

"We provide corporate devices, but there is a choice of kit typically linked to role," explains McLean. "Examples include a standard spec laptop for the majority of our colleague base, high-spec laptops for developers and engineers, Apple Macs for mobile developers and UX designers, and Surface Pro units for architects. This works well for our colleagues."

This is an understandable approach; the role someone's doing will likely have a strong influence on their preferences for their laptop. Line-of-business employees who need to access specific applications, for example, will need Windows-based machines but probably won't require them to be particularly powerful. Developers like those that make up Studio Graphene's staff, meanwhile, will need higher specifications, and may gravitate towards operating systems like Linux or macOS.

"We let everyone select their own device, within reason," Gandhi says. "For instance, with engineers, we understand they need more memory on their laptops, so we customise accordingly."

"In our case, we ended up with around 15 different workstation models," Labernia adds, "as the cost has a big impact depending on the country buying it across EMEA. So the 'standard' kind of model for users in country A does not need to be the same one as in country B or C."

As Gandhi notes, it can be difficult to convince people to move away from using their personal smartphone in favour of a company-owned one, but the same isn't always true of laptops. Many people may not even have a laptop of their own, making employer-provided models all the more necessary. There are some, however, who do, and will prefer to work on their own machine if given the choice.

"I think it's down to the business," Quinn offers. "We had very little push-back when we stopped imposing laptops on people that had better machines at home!"

"I agree with Liam," Gandhi says; "I think it varies between businesses and the type of device. For us, forcing employees to use company laptops is not a problem, but forcing them to use company mobiles or adhere to company policies on their personal phones (if they are using them for a work purpose) is challenging."

For almost all of our panellists, virtual desktop infrastructure has been the most efficient way to bridge the gap between work and personal devices – allowing users to access all the applications and compute performance they need in order to do their jobs, regardless of whether they're using their own devices or a corporate-owned machine.

"In COVID times, it was a bit of a challenge to keep everybody working remotely in lockdown mode," Labernia says. "Many users have workstations at the office and can't bring them home, so we extended our virtual desktop solution for around 6,000 users. And the best of it is that once lockdown was over, we were able to permanently delete circa 5,000 virtual desktops, providing full flexibility and saving a lot of cost."

Quinn's organisation, meanwhile, has been using Citrix-based VDI for almost twenty years, and is well-versed in the practice. This means that, even though his staff usually use HP thin-client devices rather than company laptops, they were still able to work from home unhindered.

"We're rolling out VDI and can see that it'll be a great solution for some archetypes of colleagues," adds McLean. "Others will remain on VPN; we feel a hybrid solution gives enhanced operational resilience as we're not overly reliant on one solution."

However, while the combination of VDI and personal devices has been particularly instrumental in helping organisations react to the pandemic, it seems that corporate devices still have a long future ahead of them. Our panellists agreed that the advantages offered by company-owned equipment – especially when it comes to laptops – are just too great to disregard.

"I guess on a general basis, employees prefer a work device," says Labernia. "And organisations too, as the support is easier to provide. For IT staff providing field services and support, it's a challenge if each user comes with different brands and very different problems to fix. BYOD should also be linked to FYOD – or Fix Your Own Device."

"I think company-owned equipment will always have a place (at least in the mid to long term) because security is going to grow in importance as a factor that needs consideration," Gandhi explains, "and secondly, providing a device ensures that an individual has the right equipment for their job - which is again growing in importance in a digitally-led economy."

To apply to join the IT Pro Panel, please click here to enter your details. Please note that we are not accepting applications from technology vendors at this time.

More and more employees now use their own personal devices for work, and 2020 saw a particular spike in this behaviour. But what many people don't know is that your employer is legally entitled to monitor your activity on any device that you use to do your job.

This raises a number of thorny issues, such as where the line is between security and surveillance, and whether it's a violation of employee's privacy to keep tabs on what they're doing with their phone or PC. In this week's episode, we speak to Kevin Curran, senior IEEE member and professor of cybersecurity at Ulster University, to get his take on these issues, as well as just how much safety this approach offers.

Footnotes

• How to improve Zoom video chat privacy and security
• Android spyware disguised as 'system update' app discovered
• Achieving BYOD confidence
• What is the 'personalisation of IT'?
• Managing employee security risks during lockdown
• What are employers' responsibilities when we use personal tech to work from home?
• 10 learnings to consider when it comes to enterprise mobility
• 90% of second-hand storage contains personal and business data
• Mark Zuckerberg isn't paranoid - he's sensible about security
• Security professionals need to become wellness experts
• Half of UK businesses had no security policies in place in 2020
• Top security tips for employees working from home
• xkcd: Security

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

As we’ve been working from home for the better part of a year now, you might expect employers to be fully on top of their responsibilities when supporting people who use their personal tech for work activities. This isn’t always the case, however, so it’s worth familiarising yourself with the responsibilities employers should take when we use personal tech while working from home.

Are we really still using personal tech for work?

If there’s any doubt that we are still using personal tech for work, some sobering research from digital identity management firm SailPoint found that 25% of people in the UK use their own computers for work, while 11% have borrowed computers from family members or their partner.

Reversing the picture, 34% of remote workers in the UK said they use their work devices for personal uses with 64% of these checking personal emails and 60% admitting to doing online shopping. There are security implications, too: 42% of UK employees say their company has not put any additional cybersecurity measures in place in the last twelve months, while 24% said they have shared work passwords with a partner or family member.

This reveals that the blurring of what constitutes work and personal equipment and how this tech is used is still very much alive and kicking. It could create significant headaches for employers.

Getting serious about responsibilities

It’s important for employers to take their responsibilities around all of this seriously. Felipe Polo, a digital-focussed entrepreneur, non-executive director and investor, who helps organisations align their tech, teams and business strategy tells IT Pro: “[You should] make sure your employees have everything they need. Regulations may differ depending on the territory your employees work in, but at the very minimum, provide them with good laptops, good monitors and a good VPN in case they need to work with internal networks.”

Employers have some very clear legal responsibilities around all this. Take data security such as that required around GDPR for example, where there are legal requirements around managing personal information. Employers can expense their responsibilities around such areas. Christian Brundell, associate in the regulatory team at law firm Walker Morris explains: “To the extent an organisation incurs costs in connection with data security, those costs will be part and parcel of the business operating expenses and will generally be viewed by regulators as a burden that coexists in tandem with the benefit derived from the commercial activity. Accordingly, the employer will generally be expected to address any costs that arise in this respect.”

In practice this would mean employee support is likely to involve the provision of a secure access portal to employees (typically through use of a VPN), but wouldn’t amount to an obligation to contribute to employee home connectivity costs. Employers might offer to provide discretionary financial support, however.

Device security

When it comes to using personal tech for work, device security is more important than ever. How can a firm be sure that the data on a home worker’s device is truly secure? Tom Venables, practice director for application and cyber security, at risk management consultancy Turnkey Consulting, explains that “from a data protection point of view, employing organisations have to ensure that they’re doing everything in their power to protect sensitive information such as client, customer, and employee data”.

He adds: “Once data in on an uncontrolled device then many controls no longer apply and the chain of ownership is lost, with this risk increasing if the device is shared amongst other people within a household.”

For Venables, one of the responsibilities firms should take to ensure that devices remain secure is providing training on best practice and cybersecurity, and doing this regularly. Polo concurs, saying employers need to ensure robust security measures are in place – for example, by enforcing password rotation, encrypting hard drives, automatic laptop locking after a brief period of inactivity, using encrypted password managers and two-factor authentication, and creating access roles.

Going the extra mile

Getting things right in this respect isn’t only about securing tech and ensuring that workers are up to speed with best practice. It’s also about providing ‘softer’ support, which is arguably just as important as people using personal tech for work purposes, as employees deal with competing pressures around work/life balance, adjust to working in a home environment and maybe also try to manage home schooling.

The average workers is not a tech supremo, and as Brundell points out: “Since the majority of employees will not be best placed to assess the technical security capacity of an individual tool … or to appreciate its interaction with other business systems in play, the employer will generally want to ensure that only authorised technologies are used.”

Polo has some more advice, suggesting employers should “keep your door open in case any of your employees need some extra help … [and] try to facilitate any sort of financial aid if you are in a position to do so”.

This level of flexibility seems highly appropriate at the current time. If firms are going to support workers who use personal tech for work purposes, then focusing on both the ‘hard’ areas of legal requirements and secure access and the ‘softer’ areas of providing additional support – including financial help with broadband connections and equipment – seems to strike the right note.

As the pandemic deepened and businesses rapidly shifted their workforces to remote working, bring your own device (BYOD) suddenly took on a whole new meaning. Out of the sight of IT overseers, employees used their own digital devices and hosted services to those provided by their employers – blending these together to form a new form of consumer IT.

Research from DSA Connect, an IT asset disposal company that specialises in the permanent deletion and destruction of electronic data, found that 19% of workers have more electronic devices through work than they did before the COVID crisis started. While some have been provided with this additional equipment by their employer, the majority are using their own computers, smartphones and other devices.

The overriding concern when the consumerisation of IT is allowed to proliferate unchecked is security. Indeed, in its report ‘Securing the Future of Hybrid Working’, email security firm Tessian revealed 85% of IT leaders feel under more pressure to secure permanent remote working structures, as remote mass working becomes the norm. Just considering phishing attacks, 78% of remote workers who worked on their personal devices during the lockdown period between March and July 2020 said they received phishing emails, either in their work or personal inboxes.

Speaking to IT Pro, Yasar Butt, director in Deloitte's consulting practice and leader of Deloitte Digital's Workplace offering, explains: “The gap between consumer and business technology is rapidly shrinking. Employees expect the business technologies they use to be as simple as the devices they use in their day-to-day lives. We are seeing that for a number of employees devices are becoming just the access method and the processing, data, and applications are held largely in cloud or 'Edge' based systems. One thing is clear – we're beyond the one-size-fits-all era.”

The personalisation and consumerisation of IT have been in developed for decades. Businesses have fought to remain in control as a tsunami of digital devices invaded their carefully crafted safe networks. The push from workforces forced to use different – and often inferior – systems and services to the ones they use in their personal lives, has simply come to a head thanks to the pandemic.

Geraint Williams, Group CISO of GRC International Group, recently commented: “There are huge consequences for not training staff on how to implement information security at home, and this should have been a priority for all organisations when a mass move to home working became evident. Click rates for phishing attacks sit at roughly 3%, and even the most digitally adept employees can fall prey to emails impersonating clients, suppliers or industry subscription services.”

When gadgets become business tools

For many business leaders and their IT service providers, the consumerisation of IT itself isn’t the primary concern, but that it’s happening too fast. The levels of security that many workers adhere to can be shockingly low, with the same passwords being used for work and personal services, for example. While this would be a problem even under ideal conditions, it’s harder to teach and enforce better security practices when working from home.

Tools are already beginning to appear that offer a solution to what can often be seen by business owners as runaway consumerisation of their IT, however. Hysolate has developed Isolated Workspace, which deploys locally on corporate-managed and personal endpoints. The practical application is that the product provides strong, VM-based OS isolation and is fully managed from the cloud, making it a clear manifestation of the need to secure remote workers devices, as their homes are now the IT perimeter of the businesses they work for.

Sectigo CEO, Bill Holtz recently said: “As C-Level executives continue to embrace the increased productivity of a distributed workforce, they need to consider new approaches to security that rely upon automation and secure digital identities.

“The reality is that the enterprise currently uses a mix of authentication tools that frequently includes outdated or weak methods. This research indicates that with many employees remaining at home for the foreseeable future or even permanently, refining how we grant and manage digital access is more important than ever.”

Alan Warr, chair of the consultancy specialist group at BCS, the chartered institute for IT, points to help desks and the strain they could be put under as the personalisation of IT continues: “It isn’t practical for the service desk to manage any type or brand of personal devices to the same extent that they can manage standard-issue corporate devices, though they will usually do what they can. Key is the management of user expectations. In the end it requires a close alignment of the business and IT on what is appropriate for the firm to support in BYOD. The aim should be to meet expectations that people can use their own devices but not have the benefits overwhelmed by security and support costs.”

Blended IT

Salesforce’s acquisition of Slack speaks volumes about how services that were once clearly segregated between business and personal, are now becoming close bedfellows or morphing into new platforms that offer the best of both worlds – something workers are adamant will be a critical component of their remote working lives.

Even before the pandemic, the adoption of Slack into businesses often started as a classic consumerisation story, with small groups of workers turning to the free tier of the service. As adoption spread among different teams, employers would ultimately find themselves paying for more full-featured versions for the entire organisation, preventing software silos and returning an amount of control to the central IT team.

How Salesforce intends to use Slack remains to be seen, but are we on the cusp of another shift towards more prosumer tech? Salesforce is the hub of an ecosystem and also forges multiple partnerships to expand and extend its core services. Bringing in services that can be highly personalised, like Slack, is a clear reaction to how businesses and their workforces want to work and the tools they favour.

Warr observes: “It seems to me there is a two-way street here. Consumer digital tools, for example Facebook and WhatsApp, have found uses in business from their consumer origins. And technologies such as mixed reality and gaming are finding sophisticated uses in business, again from largely consumer origins.

“I see the continuation of this rich infusion of consumer tech into business and government and the reverse infusion of technologies developed for big government and big business being repurposed for SMBs, communities and individual consumers, as an ongoing and mostly positive dynamic.”

Butt adds: “Security, privacy and compliance are on the agenda of pretty much any CXO these days. Consumer technologies can bring a number of challenges including data security controls, and the protection of business IP. How best to manage and support these devices, if indeed at all, is a question that many businesses are grappling with.

“One day the distinction between consumer and business technology will disappear, but it’s unlikely to be any time soon. Currently, what is changing rapidly is the pace at which new consumer technologies, from digital assistants to XR devices, are making their way into business. In turn, this is raising employee expectations for the digital tools they use in their roles.”

The line between digital devices and services used for work or personal interests has been eroding for several years and COVID has accelerated this trend. The consumerisation of IT and the drive to use personal devices in a work environment is now complete. Your business is currently operating in a post-BOYD landscape that will continue to change rapidly, as your business evolves to meet the new normal of work – and the IT systems that support this – will become.

WhatsApp has announced that it will delay the rollout of new privacy terms which were supposed to come into effect next month.

The update, which was presented to users on a ‘take it or leave it’ basis, was designed to allow businesses to manage WhatsApp chats using new Facebook integrations. Users, therefore, were asked to share certain aspects of their data with WhatsApp’s parent company Facebook if they still wished to continue using the platform.

However, the plans were met by a backlash sufficient enough to make WhatsApp delay the implementation of the update by over three months, with the rollout pushed back from 8 February to 15 May.

“We’re now moving back the date on which people will be asked to review and accept the terms,” the company announced on its blog, before adding that “no one will have their account suspended or deleted on February 8”.

“We're also going to do a lot more to clear up the misinformation around how privacy and security works on WhatsApp. We’ll then go to people gradually to review the policy at their own pace before new business options are available on May 15,” it said.

WhatsApp’s decision to forcefully implement its updated terms and conditions resulted in a number of users fleeing the service, with many choosing to seek privacy solace in the arms of the messaging platform’s competitors.

This caused temporary infrastructure issues for encrypted messaging service Signal, which on Friday saw its servers overwhelmed due to the sudden rush of new users.

“We have been adding new servers and extra capacity at a record pace every single day this week nonstop, but today exceeded even our most optimistic projections. Millions upon millions of new users are sending a message that privacy matters. We appreciate your patience,” the company announced via Twitter.

While the change to WhatsApp’s terms and conditions won't affect those in the UK or Europe specifically, a pop-up notification still appeared on the app for everyone – bringing fears over the security and privacy of bring your own device (BYOD) policies again to the fore.

Rowan Troy, cyber security consultant at managed IT provider Littlefish, advised organisations to “exercise caution” when allowing the use of consumer communication tools such as WhatsApp.

“The new data-sharing agreement between WhatsApp and Facebook might increase the risk of personal data being shared that contradicts company policy or compliance legislation relevant to the organisation,” he said.

There’s always a subtle hint of nostalgia when working on a ThinkPad. The laptop hasn’t changed much since the release of its very first model in 1992 and is as much of a nineties staple as AOL or the Spice Girls, down to that iconic little red dot in the middle of the keyboard which is supposed to be useful but really isn’t (more on that later).

When buying a ThinkPad, users have come to expect a certain level of dependability from the device, regardless of whether it’s a ThinkPad X1 Carbon or a ThinkPad X390. Described as a “powerful, entry-level laptop”, the L14 is aimed at professionals looking for a standard, no-fuss device that doesn’t sacrifice its performance.

However, can it truly live up to the ThinkPad’s iconic status?

Lenovo ThinkPad L14 review: Design

Although ThinkPads might still be associated with the unappealing boxiness of nineties hardware, the L14 definitely exceeds expectations and shows that appearances can be misleading.

While most modern laptops seek to charm users with their sleek, aluminium looks, the ThinkPads are still made out of the classic fibre-reinforced plastic which has that reassuring feel to it. It may not be pretty, but it’s sturdy and makes it difficult for the device to slip out of your hand when carrying it around.

On the other hand, it definitely isn’t the lightest device out there - at 1.65kg, it’s around 400g heavier than most modern laptops. Its weight might make it tiresome to carry around all day and the ThinkPad’s signature chunky design might make it difficult to fit into a small bag. However, a tote bag might suffice if it’s just for a short walk to the local cafe. After all, it doesn’t seem like we’ll be commuting anywhere further until 2021.

Lenovo ThinkPad L14 review: Display

At first glance, the 14in 1080p IPS display seems perfectly acceptable. In fact, it gave the impression of a reasonably bright screen capable of producing vivid colours. However, further inspection and a few tests revealed that colour fidelity is far from ideal. The L14’s screen covered just 59.5% of the sRGB colour gamut, while the maximum brightness is only 243.5 cd/m2. That’s a poor technical showing, and we’d be concerned about using the laptop in bright conditions, or for anything requiring colour accuracy.

Nevertheless, it does have its assets. The anti-glare coating helps alleviate some of the brightness issues and is also available with a touchscreen. Despite the poor colour accuracy, we wouldn’t write this screen off completely. It’s not best-suited for users who spend a lot of time mixing colours in Photoshop or InDesign, but it’s pleasant enough for simple office tasks.

Lenovo ThinkPad L14 review: Keyboard and touchpad

The ThinkPad range has been using what is essentially the same keyboard for most of its history, and in comparison to other laptop keyboards of the 21st century, the L14’s backlit keys (with two levels of brightness) may seem quite chunky and ungraceful. However, there’s a reason the ThinkPad keyboard has remained unchanged for all that time; it’s not only comfortable to type on, but also among the sturdiest laptop keyboards around.

We can’t discuss the ThinkPad’s keyboard without mentioning the elephant in the room; disguised as a little red dot, the classic Trackpoint nubbin is arguably one of the most controversial elements of modern laptop design. As Lenovo’s chief design officer David Hill once famously said: “Some people get it and some people don’t; some people acquire the taste. It’s hard to explain, but I still think there’s a use for it.” The L14’s Trackpoint might have been reworked to be less sensitive and more precise, but that doesn’t mean that there’s much need for it apart from its visual appeal.

It’s safe to say that the ClickPad - another distinctive hallmark of the range - was not our favourite part of the laptop. It often got out of hand and fought hard to establish a life of its own. Finding the right angle on the trackpad to click on something was especially challenging, making the working process a rather stressful experience. It almost seemed as if Lenovo specifically intended users to only use the mouse buttons above the trackpad rather than the somewhat temperamental buttons built into the trackpad itself and, although it can be done, it takes time to get used to.

Lenovo ThinkPad L14 review: Ports and features

Users seeking extra security will be impressed with the options offered by this laptop, with biometric login supported by both a fingerprint scanner or facial recognition. We chose the former and it was largely unproblematic. It might have denied us access on a few occasions but it was still way more efficient than the iPhone’s TouchID. However, users should bear in mind that the feature is available in only two out of the five possible L14 configurations.

The L14 laptop also comes with an integrated suite of Lenovo’s ThinkShield security solutions, unveiled by the company two years ago, and a ThinkShutter privacy cover for the webcam.

The L14 comes with a perfectly acceptable number of ports: two USB 3.1 Gen 1, one HDMI 1.4, an RJ45, and a USB-C for its 65W charger. There’s also a MicroSD card reader, while users are able to choose whether the device includes a SIM tray.

One potential drawback is that the L14 only has one 3.5mm jack port which is intended for microphones and headphones alike. However, this is perfectly fine for an entry-level laptop and it didn’t prove to be troublesome at all.

Lenovo ThinkPad L14 review: Battery

The L14’s battery definitely has a lot of potential. Lenovo claims that the L14 has a battery life of 12 hours and, as we put it to the test, the statement proved to be (almost) factual. The ThinkPad’s battery managed to survive 11hrs 18mins in our battery testing, which is quite impressive. In practise, however, we found that the real-world battery life isn’t anything like as good as this.

On a busy day with reasonably intense use - with an average 15 tabs open in Google Chrome - the battery only lasts around five hours. Chances are slim that it will last you a full workday, so you’ll want to make sure you carry a charger. On the other hand, once you connect the L14 to a power outlet, it’s capable of charging up to 80% in just one hour, so all is not lost. Nevertheless, we felt quite underwhelmed by this disappointing battery life.

Lenovo ThinkPad L14 review: Specs and performance

The Lenovo ThinkPad L14 uses Intel’s Core i5-10210U CPU and 8GB DDR4 3200MHz RAM. Although it’s not the most powerful option out there, it performs well enough for simple office tasks but could become overwhelmed when under an increased strain with numerous programmes running at once.

In our benchmark tests, the L14 scored an 87 in image editing, 115 in video editing, and a 28 in multitasking, which reflected our initial impressions. Its overall score was 67 - not the strongest, but certainly adequate for most users. It’s outpaced by most of the competition, such as the LG Gram 14 and its overall score of 73, but at this price, it’s hard to complain. Basically, it’s just enough muscle to get you through the day, if you manage to stay away from anything too demanding.

Lenovo ThinkPad L14 review: Verdict

The Lenovo ThinkPad L14 doesn’t have a lot of negative qualities but the severity of them, such as its heavy weight or poor colour fidelity, might be considered a dealbreaker to some. Moreover, we believe that in this price bracket, Lenovo could have done better with the L14’s battery.

On the upside, the charging time is remarkably fast and the keyboard is very comfortable to work on. Fans of a good worktime playlist will definitely appreciate the Dolby Audio speakers, while those who tend to get a bit paranoid about webcams will welcome the added ThinkShutter privacy cover. The time has come to rip off that tacky bandaid - it never looked professional anyway.

Overall, if you’re looking for without demanding too much, the L14 might be just for you.

Lenovo ThinkPad L14 specifications

There used to be a lot of talk of how businesses suffered through consumer tech coming into the workplace. Bring your own device (BYOD) was a headache for the IT team, which needed to balance the need to protect the corporate environment and sensitive data, with the fact they were dealing with a personal device.

While these issues still exist and can cause friction, there is now broad agreement that organisations have benefited greatly from the introduction of more consumer-friendly IT in the workplace. Many apps have specific versions for business use, designed to be integrated into corporate tech systems while maintaining their friendly user interfaces. This has been good for business in many ways.

What workers want

Workplaces don’t exist in a vacuum. In our personal lives, we might use all manner of different tools and services to keep in touch with friends and family, to keep on top of our finances, or to stay abreast of the latest news – especially at the moment. When we go to work, some of the tools we use perform similar functions, though in a different setting. It’s hardly surprising that people want to use their favourite, easiest to get on with, most effective tools across both environments.

Study after study confirms this. Research from MSP Maintel has shown the mismatch between what workers want and what they get at work – 24% of employees would like Snapchat to be approved by their employer, for example, while 19% say the same of Twitter. Facebook Messenger comes in a little lower, at 17%, with FaceTime sitting at 17% as well. Yet social platforms like these are often blocked in the workplace. Maintel found Instagram is not approved in 41% of organisations, Facebook Messenger in 34%, and Snapchat in 38%.

The result, says Rufus Grig, CTO of Maintel, is that workers bring their own tech into the workplace. Rather than continuing to fight against these trends, businesses should embrace them, he tells IT Pro. “If managed effectively businesses can benefit from this. They can leverage the ease of use of consumer technology, they can improve efficiency by allowing staff to use tech they’re already familiar with and they can potentially become more agile as a business.”

Efficiency and engagement

Increasing agility and efficiency doesn’t just exist for the kinds of generic tasks that most organisations have to accomplish, like communications. Angela Ashenden, Principal Analyst of Workplace Transformation at CCS Insight, gives the example of “the growing use of multipurpose tablets and smartphones, where historically you would have needed specialist devices or would have relied on paper, [such as] in healthcare. Not only can the smartphone be used for multiple use cases rather than just one, but employees typically need little to no training to use them.”

For Alex Guillen Estudillo, Technology Strategist at Insight UK, examining the benefits is just one side of the coin. “Quantifying the benefits of the consumerisation of IT is as simple as understanding the costs of failing to adapt,” he tells IT Pro. “Our recent research shows UK office workers waste 1.8 billion working hours each year thanks to technology that doesn’t support them.”

There is also the less quantifiable but equally important benefit of employee engagement to consider. When people can use tech and software they enjoy using and find easy to get along with, they are more engaged in their work, and more positively disposed towards their employer. Nobody likes to fight their software tools or work with outdated hardware. In Insight UK’s research, a third of employees said not being equipped with the right technology makes remote and flexible working difficult and stressful, and a huge 80% of office workers had felt at some point they don’t have the technology they need to do their jobs properly, putting them at a disadvantage.

Organisations realise this. As Ashenden puts it: “IT organisations are now thinking about how they can better enable employees through technology, rather than forcing employees to change their workflows to meet the needs of an application. This is very much driven by employee demands for app experiences that are more like the tools they use as consumers.”

What’s stopping you?

And yet organisations don’t always want to embrace what tech can offer. Being held back by security fears is just one reason. There is also the issue of the lack of audit trailing and accountability if multiple tools are used, for example for client communications. Maintel’s Grig says: “Many staff members already use, or want to use, the likes of WhatsApp, Facebook Messenger and Snapchat in work. This has the potential to lead to communications chaos in the workplace – with chats spread across multiple platforms, as well as the creation of potential security risks.”

The nature of contracts can also be an issue. Grig continues: “Many businesses are tied into long-term contracts for enterprise applications and there has been less of a focus on innovation by vendors – leading to a slower adoption of new technologies.”

Yet, with so many benefits clearly demonstrated, the imperative seems to be to adopt the technologies that workers want to use. As Guillen Estudillo puts it: “Organisations must be aware that trying to put off the move away from legacy technology is likely to result in mounting costs and increasing complexity. Quite simply, modern employees expect technology to work in a certain way and will be frustrated when technology at work doesn’t meet expectations.

Over the course of the past 10 years, the use and ownership of a smartphone used for work has moved from being the prerogative of senior management to an everyday occurrence. And while some organisations still provide these devices to workers, Bring Your Own Device (BYOD) has moved from being a novelty to a mainstay of IT planning across companies of all sizes.

In a 2013 report, Deloitte said: “Adoption of BYOD has been enabled by recent advances in consumer electronics. Improvements in device technology have traditionally filtered down from enterprise to consumer devices in the same way as innovations in motor racing have trickled down to consumer vehicles. This trend has been in reverse for some years and many consumer devices now equal or surpass the capabilities of enterprise devices.”

Since then, this trend has continued to grow, particularly when it comes to smartphones. In a 2019 report, Mordor intelligence said the global BYOD market was worth $186.09 billion in 2019 and is expected to reach $430.45 billion by 2025, driven by the more widespread availability of 4G and the growth in the number of SMBs founded over the next 5 years.

Using consumer technology at work may already be familiar across many businesses, but IT managers must pay close attention to how these devices are used, as they can quickly become compromised. The risk perimeter created by a BYOD environment can become vague and confusing to defend without clear user policies in place. As workers change their devices on average every two years, it’s critical to have a BYOD policy that is flexible.

Two other acronyms have also joined BYOD: CYOD (Choose Your Own Device) and COPE (Corporate-Owned, Personally Enabled). CYOD has become popular, as businesses can choose the devices their workers use and, stay in control of aspects of these technologies, notably their security. Bulk buying and streamlined procurement make CYOD increasingly popular yet can be restricting for users. COPE is often the choice of larger organisations. They retain ownership of the devices in use. COPE is familiar with highly sensitive or regulated sectors such as healthcare or finance.

Dr Zulfikar Ramzan, CTO of RSA Security tells IT Pro: “Although data can be a tremendous asset, it quickly turns into a liability given the seemingly endless barrage of large-scale data breaches. As the stakes increase, stemming from breach-related expenses, regulatory fines, and the potentially irreversible loss of customer trust, we may see a shift to a world where certain industries consider Bring Your Own Data policies that leverage user-owned decentralised storage, thereby reducing the liability in the event of a breach.”

The popularity of BYOD across firms of all sizes will continue to expand. As smartphones, in particular, continue to become more powerful, they can be used in more business environments. Managing these devices becomes a critical business strategy.

Consumerisation of IT

The consumerisation of the workplace has been evolving for the past five years. For businesses on a trajectory of digital transformation, the dexterity with which they can utilise mobile digital technologies now available is a differentiator.

BYOD has shown how workers covet their devices and will feel friction if forced to use other sanctioned technologies. The key is to balance how consumer technologies are implemented and then how they interface with the established IT infrastructure.

One of the most obvious ways this is happening is how devices are managed.

According to Leif-Olof Wallin, research vice president at Gartner: “Mobile Device Management (MDM) has evolved into Enterprise Mobility Management (EMM) and there is now a market termed Unified Endpoint Management (UEM).”

“The focus has also shifted from managing the entire device to just focusing on managing the corporate applications and data,” he adds. “Many organisations deem this model adequate and provide the needed level of data leakage prevention.”

But could these concerns and adaptations all be for naught?

“Some clients are reporting problems getting the BYOD adoption rate up as users may have a perception that the organisation gets too much control over the personal device or that the personal use of the device is being deteriorated,” Wallin tells IT Pro.

Reticence among employees to hand over their devices to their devices isn’t the only stumbling block either, as some lauded business benefits have failed to materialise.

“Many Gartner clients that initially embraced BYOD aggressively and made it the norm (typically for smartphones, tablets and, to a lesser extent, PCs) have reevaluated their programs for various reasons or have changed their policies significantly,” says Wallin.

“Expected cost savings from moving to BYOD often do not materialise. Conditions that made BYOD attractive initially may have changed, or the ability to enforce BYOD for all or most users has met resistance.”

It’s not all doom and gloom, though, as some organisations will find conditions that made BYOD initially unattractive have changed.

“As platform management controls provide increasingly granular data controls, enrolling the device in UEM (Unified Endpoint Management) is no longer a requirement for BYOD,” Wallin explains. “This has resulted in clients increasingly embracing BYOD for some select user-profiles and CYOD for others.”

Making connections

The technology mix that enables businesses to remain agile and use the latest digital tools will have a BYOD component. Consumer devices, though, need to be brought into the IT environment of a company balancing user convenience and above all, security.

Connecting personal devices to network infrastructure, and how these devices can be controlled, is clearly a focus for CTOs that see this trend expanding and accelerating before their eyes.

BYOD and its close siblings CYOD and COPE are an evolution of digitisation that is on-going. Businesses need to appreciate how personalised devices are now an inevitable component of their processes. Workers have shown their desire to use their own devices and react badly when constraints are placed upon them.

Business IT is now consumer IT. Companies that embrace personal devices, place them within a secure environment, and leverage their power, will be able to innovate at speed

Even though most of us haven’t been able to take our personal hardware anywhere over the last year, it hasn’t stopped many of us from purchasing new devices like Chromebooks, smartphones and laptops. Chromebook sales have been “through the roof”, according to Canalys research, as organisations have looked for cheap solutions in order to provide equipment to remote workers.

Once we know where we’ll be working and the so-called "new normal" is fully implemented, these new devices might come with us to work through a Bring Your Own Device (BYOD) scheme. In the years leading up to the pandemic, it was a growing trend where employees were encouraged to use their personal devices in the workplace.

Part of the BYOD’s popularity is down to the consumerisation of IT with smartphones, laptops, and tablets appealing strongly with the general public. Many people choose the fastest laptop or latest model of smartphone and generally use them to check emails or talk to co-workers and employers.

Moreover, this has coincided with a sharp rise in the use of apps and SaaS tools, many of which can be easily downloaded and installed on personal devices. The line between work and our personal lives is often blurred when apps like Google Workspace, Slack and Microsoft Office are installed on a personal smartphone or device, even when they may already be on a laptop provided by an employer.

The benefits of BYOD

The most significant benefits of BYOD include lower IT costs and increased productivity.

Employees who can select their own device for work, whether it’s a computer, tablet or smartphone, can be more productive as they are more motivated.

IT departments don't need to stump up the cash for new equipment or software licenses and employees are more likely to look after their equipment if it's their personal device too, so maintenance and repair costs will be lower.

Additionally, technology chosen by employees is likely to be more up to date than IT departments can offer everyone, which means they'll often feature faster processors, more advanced security such as fingerprint readers and can be used alongside the latest iterations of apps and software to ensure workers have the resources they need at all times.

In 2020, BYOD will have proven a boon to companies that have had to adopt mass remote working. While adoption of laptops has increased in recent years, not every employee in every organisation is equipped with one. When lockdown began, it may have taken time to kit workers out with suitable devices – assuming the organisation had the resources to do so. BYOD will have served as a great stopgap in some cases – in others, it will have become a new normal that has allowed businesses to continue operating with relative continuity over the long term.

The challenges of BYOD

What is probably the main challenge of a BYOD policy is the lack of homogeneity across staff devices. This means that IT departments might struggle with managing enterprise hardware, as some applications required to ensure the security and smooth operations of the business may not be compatible with different versions of operating systems. For example, some employees may prefer macOS over Windows, while others will opt for Android instead of iOS, making their unification more difficult than if everyone was provided with the exact same device and model.

This might also lead to increased IT support expenses, as instead of using one type of resource for all enterprise hardware, the IT department will be forced to source it from a few different providers. A good way to try to minimise this, according to GCHQ, is to provide employees with some limitations on the choice of hardware, such as a list of free or subsidised devices which they will be able to choose from.

Another significant challenge of a BYOD policy is maintaining the business’ cyber security posture. Unfortunately, this means that IT departments should be on the lookout for potential threats as well as gaps in the company’s MDM (mobile device management) policies. In order to ensure that device freedom doesn’t result in a company data breach, staff should be made aware of the top BYOD risks, as well as educated on best security practices.

One nightmare scenario could involve an employee bringing in a virus-ridden device into the office and connecting it to the company’s network, potentially infecting other devices with malware.

BYOD is a security trade-off that must be weighed up and can put an extra burden on the IT department, which in turn could reduce productivity gains experienced by employees from other departments.

Key considerations before implementing a BYOD policy

Before you make the jump to BYOD, it's important whenever possible to ensure you have the policies in place before you invite employees to start introducing their personal devices into the corporate environment.

These include:

• Having a list of devices your employees can and can't use. Although you should be as open as possible, do not permit devices with a poor security record. This may involve only permitting devices made by specific manufacturers or operating systems.
• Enforce a stringent security policy for all devices, whether that's only permitting certain passwords (they must include a combination of uppercase and lowercase letters, at least one number and a symbol for example).
• Invest in staff training so employees are aware of the risks if their device falls into the wrong hands.
• Register each and every device that is being used for work, whether that's a smartphone, outside tablet, laptop, or even smartwatch.
• Ensure your network can be locked down sufficiently to resist attacks and your infrastructure has the capacity to run BYOD.
• Define which applications are allowed to be installed on devices and which aren't, or at least which can be run on your corporate network.

The amount of flexibility we have in our working lives is one of the best things about the business world today for many people. Thanks to mobile devices like smartphones, tablets, and laptops, we can carry out our duties more or less anywhere with a connection to the internet. We can even have a better work-life balance, since we can choose to work the hours that suit us.

Similarly, the the Internet of Things (IoT) is bringing in a variety of small devices and sensors that can aid organisations with core aspects of their business like productivity monitoring, increased automation, and preventative maintenance.

However, each one of these endpoints represents a potential security threat to the business.

55% of vulnerable endpoints contain sensitive or confidential data, according to The Cost of Insecure Endpoints report from the Ponemon Institute. If these endpoints are stolen, lost or accessed by a malicious actor – through spyware, for example – this data is at risk. A compromised endpoint may even allow a bad actor access to the information stored on it, or information that has passed through it, and it also provides an opportunity for this kind of individual to infiltrate the corporate network itself.

IT has had to turn its attention, therefore, to putting the right endpoint and data security solutions in place, as well as network security to maintain the safety of a business’s data.

What is endpoint security?

Protecting individual user devices that connect to a corporate network, and the confidential data they hold, is a practice known as endpoint security. Usually, this is implemented through the use of a centrally managed software that communicates with client software installed on each device.

Like any other security policy, endpoint security protects against existing and emerging threats to software, although devices tend to be targeted most often by the likes of trojans, which are designed to spread the reach of botnets, or occasionally ransomware.

Given that endpoint security is often offered as part of a software package, capabilities can differ depending on the provider. Most basic suites will offer antivirus protection, anti-spyware functions, firewalls, and host intrusion prevention systems (HIPS). You might also find data loss prevention, email encryption, network access control, endpoint detection, and application whitelisting services offered as part of the package, although the way these are deployed might vary and not all of them will be discrete options.

Endpoint security implementation best practices

What configuration of endpoint security services will be most effective will depend on the business you’re in. For example, a business that operates a bring your own device (BYOD) policy, or has a large number of IoT sensors deployed across a manufacturing line, will have notably different security needs over a business that runs a single traditional office environment.

However, there are some basic principles that every business will need to follow if they hope to get the most from endpoint security.

Know the risks

When planning this kind of security strategy, it's important to know what your endpoint landscape looks like. This can include a survey of your IT estate (company-issued laptops, PCs and smartphones, for example) as well as an audit of what personal devices access corporate data and which users they belong to.

It's also important to understand what data is passing through your endpoints. This can help establish an access management policy not just by the user but by the endpoint, which can help catch security threats early through behavioural analysis.

It's also worth keeping in mind any regulations in your industry, such as GDPR, that could dictate who is able to access what data.

Deploy endpoint protection

Antivirus on the endpoint is not enough nowadays. Endpoint security needs to cover as many threats as possible, so protection software needs to offer malware protection, application whitelisting, access control and so on.

Sometimes, one endpoint protection suite isn't enough. You may find that it's better for you to add dedicated antimalware, plus a separate access control or containerisation system, plus a level of artificial intelligence or machine learning to help detect divergence in normal behaviour or unknown devices trying to connect. However, bear in mind you will also need to manage all these setups, so a single solution that fits your needs as closely as possible may be more practical.

Amid all this focus on endpoints, it's also important not to forget the network perimeter. Corporate firewalls, data encryption and segregation are all still vital components of any security strategy.

Endpoint security in 2022

How businesses manage endpoint security has come under increased scrutiny since the mass move to remote work.

Although not an entirely new concept, many businesses have been forced to introduce brand new policies to cope with the sheer number of employees working away from the office. Although the mandatory work from home orders are no longer in force, businesses have been slow to move back to the old ways. In fact, only a third of companies plan to introduce a full return to the office, and those that have tried to revert back have been met with resistance from those employees who have demonstrated that you don't need an office to stay productive, or secure.

What's largely emerged from the pandemic is a hybrid model of working, embracing the fact that employees are going to be remote at least half of the time. One prominent example of this is Salesforce, which revealed in 2021 that employees would have the choice of three different working models, provided they have proof of vaccination; namely fully office-based at its San Francisco site, fully remote, or a combination of the two. Prior to the pandemic, just 18% of staff were deemed remote workers. Today, most Salesforce workers are either hybrid or fully remote.

This arrangement, while beneficial for employee wellbeing, raises legitimate questions about endpoint security. Combining remote working with in-office might prove troublesome to oversee from a security standpoint, particularly if there's no formal BYOD policy in place, or there's a blurring of the lines between what is a home device and a work device even if it's company provisioned.

IT teams will have to be mindful of what kind of devices staff are using, as well as the software they're installing – this may force some businesses to roll out fairly restrictive policies.

Mobile device management (MDM) is one of the most important business tools used by UK organisations. This is a system that helps IT administrators to secure and control tablets, smartphones, and computers used by employees in an organisation.

Thanks to new and modern initiatives like hot-desking and bring your own device (BYOD), and obviously the recent surge in remote working, MDM has become more and more popular in recent years. In particular, COVID-19 has led to a surge in the demand of this tool among businesses looking to take on MDM solutions. As the world of work is currently transforming into a hybrid model, it is probable this demand will continue or even grow, with UK businesses aiming to ensure endpoints distributed across their networks stay secure.

It is crucial for GDPR compliance to ensure your employees can only access the data they need, and that they are restricted from accessing other information. After all, organisations will be aiming to remain as compliant as possible to reduce the chance of getting a fine. Two ways that MDM systems can help businesses on their compliance journeys is by locking data if a device goes missing, or restricting data access for employees.

In addition to smartphones, MDM systems can manage laptops, tablets, and desktop PCs. This makes them extremely useful as they can manage cyber security risks across all workplace devices. For example, malware can be downloaded inadvertently in various ways, like through phishing attacks, and infects a number of devices regardless of their form. The best MDM systems out there will manage various devices at once, wiping or treating those infected with malware before the infection has time to spread.

Whatever your needs are from an MDM solution, there are many options available from a variety of providers. Here's a round-up of some of the best options, including offerings from IBM, Citrix and more.

Cisco Meraki

Perhaps one of the most well-known MDM platforms, Cisco Meraki allows you to manage every type of device in your business from one dashboard. No matter what you need to monitor - be it Android and iOS smartphones, or Linux, macOS and Windows PCs - you can do so. There's also an app for managing devices while not at your computer, monitoring usage and making sure all data is safe and sound.

Cisco Meraki offers a bumper feature set, enabling you to enforce device security policies, deploy software and apps, and perform remote troubleshooting if any problems arise, monitoring calls and more on the devices across your network. Every device managed and monitored is regarded as a separate device, even if they're linked. This means you can, for example, allow certain apps to run on an employee's iPad but not on their linked smartphone.

Cisco Meraki enables all of this to happen over the network, so even if you're trying to manage remote employee devices, it's a breeze. You can keep tabs on everything without anyone needing to be on the same network. It’s also easy to test-drive the platform with a browser-based demo with slated network devices and users. Plus, you can request trial hardware and get technical support to help with setup.

Pricing: Available upon request

IBM MaaS360

IBM entered the MDM market following its acquisition of Fiberlink Communications back in 2013. Since then, Big Blue has been making some big improvements to its flagship MDM product. The service, which is powered by Watson AI, will easily integrate with existing IT infrastructure, enabling you to manage a diverse, complex endpoint and mobile environment.

IBM Maas360 also puts security at the forefront, securing and containing data accessed by users and keeping corporate apps and content separated while allowing for easy removal and access revocation. Its integrated threat defence also proactively shields corporate data.

IBM might not be the cheapest out there - especially since some of the services that you'd find bundled with other providers come at an additional cost - but with IBM's lengthy experience in enterprise security, you know you're getting a good quality solution for your money.

Pricing: From $4.00 (£3.32) per client device per month

Hexnode MDM

Hexnode MDM lets you provision and manage devices, and prides itself on a user-friendly design. Users can add their own devices by connecting to the network or by using a portal installed on your company's website or intranet. Their device will then be added using their Active Directory credentials.

Once the devices are added, you can manage them whether they're connected to the corporate network or being used remotely. That means you can push configuration settings to the device, restrict functionality, manage mobile applications (including blocking App Store downloads and implementing a black/whitelist), check and enforce compliance and even remotely lock and wipe devices.

Hexnode MDM also offers a 30-day free trial if you want to get give it a test run.

Pricing: From $1.08 (90p) per device/month

Soti MobiControl

Soti allows you to manage Android, iOS, Linux, macOS, and Windows devices from one place, for the entire lifecycle of the device within the organisation. They can be provisioned when first added to the company's fleet of devices, managed throughout their service and then wiped when it comes to retirement.

The platform was designed for use with ruggedised devices often used by fieldworkers and the healthcare, logistics, retail, and transport sectors.

The MDM platform can be installed on-premise or deployed on Soti's cloud. You can add devices to the platform using its Express Enrollment feature, which automatically delivers the settings, apps, and files a user needs over the air to get them up and running.

Pricing: Available on request

Citrix Secure Private Access

Citrix Secure Private Access, formerly known as Citrix Endpoint Management, is a zero trust network access tool with MDM functions. It allows the containerisation of business apps and personal apps, making it best suited to BYOD workplaces. Every device, including desktop PCs, smartphones and tablets, can be managed from one centralised console and devices don't even need to be enrolled to benefit from MAM, too.

As well as allowing the device owner to use a device provisioned and managed by the organisation, Citrix Secure Private Access has also been designed to let multiple users have access to one mobile device. This is particularly useful for industries such as healthcare, where field workers and emergency service workers may need shared ownership of one device.

However, it's likely one device will need applications and service provisioned with different access rights and this can be set up simply with Secure Private Access's MAM capabilities. IT managers can also lock down the device depending on the network location, stopping staff from using certain features outside of the corporate network.

Pricing: From $3 (£2.52) per device/month

VMware Workspace ONE

VMware Workspace ONE (formerly called Airwatch prior to its VMware acquisition) offers endpoint protection for all devices, regardless of the operating system, with full device management, whether it's a BYOD or shared corporate device.

You are able to deploy and manage any app via the platform's app catalogue, whether employees are trying to access them natively, on-device, via the web or remotely. The layered security across the individual user, endpoint, data, and network can all be centrally managed using the same mobility platform too.

Workspace ONE uses automation to carry out many everyday MDM tasks, which reduces the strain on IT staff. You don't have to manually provision or enrol devices - this happens without the need for any manpower, making it a perfect option for resource-stretched businesses.

Pricing: From $1.66 (£1.39) per device/month

The future of mobile device management

With life now beginning to return to offices across the world, it’s never been more important to ensure your organisation’s workers have great security. It’s likely that this will keep being seen by IT departments as one of their biggest challenges too.

Part of this is because of how popular hybrid working has become in recent times. There have been a number of attempts to make this the mainstream, including by the likes of Salesforce, which decided in February 2021 to offer employees the choice of three models for working. These were office-based in San Francisco, flex, or fully remote. This is a big step considering that approximately 18% of employees at the company were fully remote before the pandemic, compared to 50% by June 2021.

Some companies have gone an extra step, such as Airbnb, which told employees in April 2022 they can work from “anywhere”, regardless of the country they live in. The company’s new remote work policies stated that employees could also enjoy up to 90 days of work abroad.

Despite these benefits, combining in-office working with remote might be problematic when it comes to security. This is because the lines between what constitutes a home or work device inevitably blur, even if the organisation provided the employee with dedicated hardware. Importantly, it also involves workers regularly accessing their private networks at home, with the risk of falling victim to a wider variety of threats, and even transferring malicious software over to an organisation’s network when they work from the office. Companies not only have to think about adopting a clear BYOD policy, but also be extra vigilant when it comes to the security of their network.

With more employees making their way back to company property, even in a hybrid work model, MDM solutions are going to have a big role to play not only when it comes to security, but in GDPR compliance too. Bear in mind, however, this can come at a high cost. Decide which MDM option would be best for your business before investing anything. It’s also best to think about the scalability and price of the software, how good its security is, and how many devices or employees it’s able to support. Obviously, there are other things you’ll need to bear in mind before buying your ideal MDM solution, but this is a good place to start.

Of course, it would also be helpful to devise the appropriate MDM business plan on whether you are likely to see an ROI. However, security should be of paramount importance to any business. Failing to protect data can be catastrophic for a business, so there's no excuse not to take every measure to make sure your business stays afloat.

It's not abnormal for many of us to seek out the Wi-Fi network when entering a building, or a new place of work. For businesses, this can mean that the majority of their employees will have signed into corporate networks using mobile phones, tablets, and increasingly devices like smartwatches.

Research has suggested more than three-quarters of all organisations have more than a thousand business devices, including laptops and tablets supplied by the company, typically connected to the business network. It's difficult enough to manage the sheer number of endpoints without then taking into account the wider picture. Approximately a third of companies, 35%, in the UK, US and Germany responded suggesting that more than 5,000 non-business devices are connected to a corporate network each day, with 40% used for non-work-related tasks ranging from logging into social media platforms to downloading films and games.

Devices such as these, which haven't been organised by network and security teams, are part of a burgeoning issue for IT teams and are commonly referred to as shadow IT, or even stealth IT and rogue IT. The growth in cloud services has made the problem worse, and it's become more and more difficult for IT teams to understand exactly where business data is stored and which employees control what.

This isn't just about individuals hooking up their phones to corporate Wi-Fi networks, however. Shadow IT also comprises unofficial flows of data, including data that's exfiltrated from corporate networks on USB drives, or software that's installed without the support or knowledge of the IT department. This may even include software like an instant messaging tool that may make business communications easier.

Why is shadow IT a problem?

Aside from the issues around how employees in a company are spending their time, the bigger problem is that non-business devices often aren't installed with the security functions and standards of devices supplied or managed by an organisation.

Similarly, software and applications that haven't been authorised by IT may end up unwittingly presenting a security threat.

Even harmless apps on personal devices can carry hidden threats. In 2017, McAfee researchers identified 144 apps on the Google Play store that contained a malware strain called Grabos, which was disguised as seemingly harmless audio players, but had been downloaded up to 17 million times.

Shadow IT is a symptom of a wider problem; that employees are taking matters into their own hands when it comes to hardware or software they need in order to work effectively. Some of the most common shadow apps are instant messaging and file sharing apps such as Skype and Google Docs, which staff are installing and using in order to collaborate across the business.

Although using software like Google Docs may seem harmless on the surface, it opens up the risk of employees accidentally (or deliberately) leaving sensitive documents exposed online - the digital equivalent of leaving a document on the train. When staff leave, the IT department need to know that there are no stray files on non-business sharing systems that may have been forgotten about.

Shadow IT doesn't always have to be negative, however. Companies with a bring your own device (BYOD) policy are actively encouraging the use of personal technology in the workplace, often because the benefits of increased productivity and cost savings outweigh the risks. There are also ways that IT departments can reduce security risks with BYOD, including educating staff on secure passwords, encouraging installation of the latest updates and security patches on operating systems, and defining which applications can actually run on a corporate network.

One type of shadow IT that may grow to be a particular problem in businesses is IoT devices. Devices like connected kettles, digital assistants, smart TVs and even fitness trackers are growing in popularity, and all need an internet connection, which in a business, ends up being the enterprise network. There are well-reported issues with IoT devices at present, including the Mirai botnet which has grounded some of the world's biggest technology companies.

For some industries, shadow IT poses challenges around compliance. If data is being transmitted through unofficial channels, it can prove impossible to comply with initiatives like the GDPR, financial standards and data security principles.

Here are some other common implications of shadow IT that businesses may face:

• Inefficiencies and performance bottlenecks. If shadow IT systems are being used as well as or instead of existing systems, it can be difficult to identify more efficient work processes;
• Hidden costs from other workers needing to re-check the validity of data, and setting up systems and software without the necessary experience;
• Inconsistencies in both business logic and approach, with small differences and errors accumulating across versions of applications with no version control or linking between them;
• Risks of data loss or leaks, as data that goes through unauthorised applications or devices may not be subject to proper backup procedures, or authentication for appropriate access;
• Wasted investment in software that may be doing the same job in a business.

Business attitudes to shadow IT

Some businesses are very relaxed about shadow IT. They believe that the benefits brought by increased collaboration and innovation, particularly with the pace of change in technology, outweigh any direct security risks, and instead focus on educating employees to be able to identify threats.

Because of the way it encourages productivity and agility, shadow IT can also be used as a prototype for future workflows, technologies and systems that can then be approved in the future.

However, others see shadow IT as a risk to the way staff work, instead believing that it is better for tools to be implemented across an organisation to avoid information and workflow silos. It is also easier for the IT department to identify and combat threats if they're aware of what hardware and software is operating on the business' network.

Managing the risks of shadow IT

It's almost impossible to turn back the clock when it comes to shadow IT, and many staff would resent reverting to a highly locked-down IT environment, especially in a workplace which seeks to encourage collaboration.

Instead, IT professionals must look to manage shadow IT rather than fighting it. This can be done by making a comprehensive list of applications staff are using, and seeing how it varies across departments, which in turn can also be a good way to identify tools that the business can adopt 'officially'.

Endpoint management is one way to keep an eye on all assets and software on a business network. Once these have been identified, the next step is to ensure that these are in line with the company's policies, and to identify potential issues with any vulnerable applications.

Security awareness training can also be a valuable tool in an organisation's security strategy. Making staff aware of the dangers of clicking questionable links to the business network, even from their personal devices, can reduce incidents of carelessness. This is also a good opportunity to reinforce any company policies around personal device and application use, as well as existing software the business may already have access to.

Shadow IT in 2020

The events of 2020 have only accelerated the use of shadow IT as many businesses pivoted quickly to a remote-working model. For organisations that weren’t fully prepared for the pandemic and resulting lockdown, BYOD may have been the only way to allow for operations to continue in the absence of enough hardware to allow employees to continue to work from home.

Some workers may have turned to a series of unsanctioned apps as they sought to create new workflows after the severe disruption of not seeing their colleagues face-to-face or being able to take advantage of any on-premises resources they formerly relied upon. Currently we can’t even speak to our co-workers without the use of an app, so shadow IT systems will have proven invaluable in many situations to keep operations moving amid the disruption.

What this means for organisations and IT departments is that they must be especially vigilant for the vulnerabilities that can be caused by shadow IT in these suddenly hugely dispersed networks. While oversight might be harder under current working conditions, you need to make efforts to keep track of how your employees are working and to emphasise awareness and good practice in order to prevent shadow IT from becoming a serious problem for your organisation.

Loyalty to an operating system can sometimes be compared to that of a football team or a political party. And this is certainly the case when it comes to Android vs iOS. Most iPhone users are Apple-til-they-die and can be keen on pointing this out at any given moment. These are the 'brand lovers' that wittingly chose vendor lock-in and have MacBook's and iPads to go with their iOS-based smartphones.

While there are many solid reasons to be an Apple-ite, the world's most popular mobile operating system is actually Android. With Google's OS, user can choose pretty much any other smartphone manufacturer (except Huawei) and arguably enjoy more interoperability with different laptop, tablet and smartphone ranges.

You may have one or the other as a consumer, but what should you do as a business? Do you kit your employees out with the best of Apple or do you sign them up to Google's Android and let them have a bit more device choice?

Unfortunately, there's a lot more to it than that. Security is arguably the most pressing concern for businesses – particularly as most will have been working remotely and look set to continue doing so. Then there are key details such as cost, compatibility, how easy it is to instal, use and learn. You may be an Apple aficionado, but does Jeff in accounting know his way around an iPad?

These are the consideration you need to make when choosing a business-wide operating system. Just like being Liverpool or Everton, Labour or Tory, you can be Apple or Android (or neither if you find a niche OS).

Android vs iOS: Hardware choice

Although we are mainly focusing on the operating systems, your choice will almost certainly be led by the hardware they support. It is very unlikely that a consumer will choose an iPhone because they prefer iOS as it is usually a case of having iOS because it is on the iPhone they want.

So, the choice of hardware is a little more limited on Apple's iOS as it only offers iPhones. However, now is a pretty good time to go for one as they've had a strong couple of years. The current crop includes the iPhone 14 Pro –with iOS 16 – which has some of the best camera and video technology around. The design is also pretty much the same as the iPhone 13 and iPhone 12, both of which are very high-quality devices – with these, you can also get an iPhone mini. There is also the more budget-friendly iPhone SE, which has an older design and none of the fancy features.

With more than 1 billion of them in circulation, the iPhone is the world's most popular smartphone, however, this doesn't automatically mean iOS is the most popular mobile OS. That title is taken by Android and the main reason for this is because it works with more manufacturers. So while iOS only works on Apple iPhones, Android is used by Samsung, Sony, Google (of course), OnePlus... practically every other brand.

Overall levels of choice is the biggest bonus of being on Android and not just choice of brand - there are more different types of handsets available here, from standard 6.1in screens to massive phablets, such as the Samsung Galaxy S22 Ultra. Plus, it gets bigger still as you have a number of foldable devices on offer, such as the Z Fold 4 and the Huawei Mate Xs2.

Android vs iOS: Design

The latest version of Google's OS is a far cry from the days of clunky Android KitKat. Android 12 is a more slick and gorgeous experience with a plethora of features that help it to adapt to users' preferences. The Material You interface allows users to change themes and colours to their own preferences, even adapting from their own wallpaper uploads – a feature that isn't available on iOS.

However, Apple's OS has an established reputation for its simplicity and ease of use. The learning curve for new users is astonishingly low, and its commands and functions are simple to pick up. The design is based heavily on the idea that most users don't really need all the adjustable bells and whistles that platforms have normally offered. Google's Android system, meanwhile, suffers from its reputation as being a little confusing to navigate. By contrast, this offers an insurmountable depth of customisation, but much of this is hidden deep inside menus and interfaces.

One of the main issues with designing your user interface to be overly simplified, however, is that it normally comes at the cost of functionality. By default, iOS just doesn't give you the kind of space to adjust your user interface, or its functionality, to make it stand out in the same way you can with Android devices. Google's OS is so much more feature-rich, offering greater customisation options and an array of settings to tweak your device to fit your precise needs.

While iOS on iPhones looks great, it has conventionally shone on tablets where the software can take advantage of powerful multitasking features supported by superb Apple processors. The laptop-style experience you can create on an iOS tablet is simply far superior to anything an Android unit can offer. Having said that, however, Apple will soon roll out a dedicated iPadOS, breaking free of the iOS mould with specially-tailored software.

Android vs iOS: Compatibility

The iPhone is the most popular device in the world, so it's absolutely no surprise that software makers and accessory manufacturers generally choose to prioritise it over Android. This means if you've got an Apple device, you can all but guarantee whatever app, platform, plugin or attachment you want to use will be supported – though there are some companies that take issue with its 30% app store tax, so not all are available.

Another potential issue for some users will be the fact that Apple has chosen to remove the headphone jack on later devices. This isn't a major problem, given that there's a Lightning to 3.5mm jack adapter supplied in the box and Bluetooth headphones are widely available. And although some devices, such as the Samsung Galaxy S20, have ditched the headphone jack too, an Android device may be a better option if you're dead set on the 3.5mm port – though it is very rare to see one at all.

Connectivity is a consideration if you want a USB Type-C connection as that is the default for seemingly all modern Android devices. Apple's handsets are all on its lightning cables, though EU court rulings may change that for future iPhones.

Android vs iOS: Security

Mobile security is too often overlooked by businesses, but if you're issuing devices to your employees, you should make certain that they're as secure as humanly possible. The list of vulnerabilities, exploits and other security flaws that have been discovered in the Android OS is long and extensive, as is the list of malware-riddled apps found on the Google Play Store.

iOS benefits from a better reputation, but it's far from unhackable. Recent notable flaws include the HomeKit bug and the Meltdown/Spectre debacle. Instances of major exploits in Apple's devices are much, much fewer than on Android, however, and it benefits from faster software rollouts, too. Apple can push updates to all of its handsets directly, whereas Android users must wait until their phone maker has implemented a version of Google's update that works with its own Android skin.

Android vs iOS: Verdict

Android has millions of fans around the world, and with good reason; it's matured into a powerful and versatile operating system, with heaps of functionality. With time, the OS has offered a smoother user experience and a more aesthetically-designed interface too. However, for business devices, the fact is that Apple's software remains king of the hill.

iOS is slick, easy to use, good-looking and boasts absolutely stellar security and privacy features. While it's not without its flaws, the benefits far outweigh the disadvantages, and for corporate devices, iOS should still be your first port of call.

From folding phones to 5G networks, MWC 2019 has created a new buzz about all things mobile. But how do CIOs make sense of all these developments in mobility, and how can they create a mobile strategy that's right for the rest of the business?

Well, that strategy will depend largely on the day-to-day needs of your business. For Dylan Roberts, chief digital and information officer at Leeds City Council, the immediate focus when it comes to mobile strategy is 5G. Roberts expects to make big progress in networks during the 12 months, with fibre and 5G capability providing the backbone for the development of new services for the city of Leeds and its residents.

"I want Leeds to be the UK city with the largest 5G coverage outside London," he says. "That's going to be enabled because I went to our executive board two weeks ago and I managed to secure support for a full fibre programme. We're going to go to market for this project which will cover the combined network requirements for public sector organisations across Leeds."

That programme will provide full-fibre connectivity to endpoints across more than 1,400 public-sector buildings and, according to early assessments, vendor partners will provide as much as 97% of that connectivity. The result will be a "spider's web" of fibre across the city that will provide an anchor for 5G and the development of new services.

"We're in discussion with the mobile operators now," he says. "It's all well and good putting in place 5G masts and cells, but you need a fibre backbone. We're hoping that we'll encourage the right kinds of conversations - we want to use the spider's web across Leeds as a backhaul network for faster 5G deployments. One of the things we're thinking about is the kinds of additional functionality we can provide."

Roberts says the low-latency networks associated with 5G will be critical for emerging mobile developments, including cutting-edge hardware like Microsoft's HoloLens 2. The city has already supported a trial of HoloLens technology in ambulances - health professionals can use the prototype technology to analyse a patient and ensure the right healthcare decisions are made.

5G for 5G's sake

One of the key lessons from that project, says Roberts, is the critical role of high-speed connectivity along all city routes. This awareness is helping the Leeds IT team focus on how 5G might be used to support mobile-enabled developments in other areas, including allowing clinicians to make video calls and assessments for remote patients in the local region.

Leeds City Council hopes to create the largest 5G network outside of London

"The idea is that the technology helps clinical staff make the right decisions in emergency situations," he says. "When it comes to developing our mobile strategy during the next 12 months and beyond, there's potentially huge uses cases for 5G."

This focus on business objectives is something that resonates with interim CIO and digital advisor Brad Dowden. He says the key focus for CIOs developing a mobile strategy must be on the key outcomes they are looking to achieve. "If you're implementing mobile technology for the sake of it, then that's unlikely to deliver the results your business demands," he says.

"However, if you're looking to implement technologies because you think it might help change the way your employees work, then that can become a guiding principle - and you can then work back from that and think about how an initiative like 5G or new mobile devices might help you achieve your business outcomes."

Dowden, who was CIO at recruitment specialist Airswift until late last year, says an outcomes-based approach must be applied to all areas of mobile strategy, whether that's for underlying infrastructure, application environment or security. And the CIO focus should be on how mobility delivers big business benefits.

"So, everyone in your firm has a mobile device, but is that necessarily the right device to meet your aims?" says Dowden. "You need to think about whether the device you use is workable. Delivery companies really benefit from having mobile devices that run pre-populated forms and that can capture signatures. Salespeople meeting clients, on the other hand, benefit from using a table or a convertible device. It's all about business outcomes."

BYOD still has its place

While meeting objectives is crucial, not every CIO will be spending big on mobility. Richard Gifford, CIO at logistics specialist Wincanton, says his firm doesn't have an explicit mobile strategy. The most senior people in the organisation are allowed to use whichever device they want to, with enterprise apps and data protected through mobile device management.

When it comes to innovation, and some of the types of devices that were showcased by the tech giants at MWC, Gifford says his firm is not prescriptive in how new tools are brought into the organisation and used. The firm runs a bring your own device approach, where executives use a range of approved applications on their own smartphones.

"We're not wedded to Apple, Android or whatever," says Gifford, considering how the use of mobile devices across the firm might change during the next 12 months. "The senior executives tend to use iOS devices, such as iPhones and iPads, and getting them to switch away from their chosen operating system can be pretty difficult."

Some in your business may be reluctant to give up their favourite mobile operating system

Wincanton also operates a fleet of devices for its warehouse workers and delivery drivers. Most of these employees use Android devices, however, like his IT leadership peers, Gifford says the key is to find a device that's fit for purpose - and, crucially, at the right price point.

Rather than worrying about 5G networks or foldable devices, the main objective for Gifford is to deliver value to the business right now. "If those devices get lost, stolen or broken, they're cheap enough to refresh and renew," he says.

So, while the potential benefits of applying 5G or investing in smarter devices might appear considerable, CIOs must be careful not to be seduced by the power of innovation and the promise of product marketing. Leeds City Council's Roberts says enthusiasm for emerging mobile technologies, such as foldable phones, must be tempered.

"We sometimes push technology for technology's sake and I'm a real believer in trying to tackle the problem you're trying to solve," he says. "Foldable phones are one thing, but improving digital literacy through tried-and-tested platforms, such as tablets, is more important than giving people the latest smart devices."

Bring Your Own Device schemes (BYOD) have been gaining ground for 20 years, but their popularity has been patchy. Higher-growth economies have been most enthusiastic, while mature markets have been more cautious.

An Ovum survey of 2012 found that less than half of workers in the latter group - countries such as the UK and US - were likely to use their own laptop or mobile at work. It compares poorly with the 75% who, in countries such as Russia, Brazil and India, have a say over the hardware they use from Monday to Friday.

If countries like these are expanding much faster than us, the question has to be asked: could allowing your staff to use their own kit make them more productive?

It may, but for many organisations, BYOB is far from a perfect fit. Giving staff the freedom to choose their devices can increase support costs, and gives them a sense of ownership that may not be warranted. This makes it difficult for management to insist on the use of particular applications, utilities and security protocols.

Perhaps it's no surprise, then, that the National Cyber Security Centre, part of GCHQ, recommends Choose Your Own Device (CYOD) in place of BYOD. In a scheme such as this, staff pick from a limited range of pre-filtered hardware. Depending on the price of the device they choose, they'd either receive it free, or be asked to contribute through salary sacrifice to fund anything more expensive than their employer had budgeted for.

Either way, the firm retains control over the device and, as the range of hardware on offer is limited, it can often reduce its support costs, too.

Staff 'buy in' by buying in

When Intelligent Rewards rolled out a CYOD scheme for an international charity, 43% of the charity's staff immediately gave up their assigned Dell laptops in favour of a MacBook. That's not particularly surprising, until you learn that the staff each paid more than 100 a month, before tax, to fund the upgrades themselves.

"There's sometimes a question about if schemes like this are employee benefits, which inevitably means HR needs to get involved, or if they should be driven by IT," said Tony Gregory, Intelligent Rewards' co-founder and director. "Our view is that it should be managed by the CFO, because these schemes are focused on cost savings, maximising the IT budget, and giving the employee an element of choice in a controlled environment. That way, the hardware range remains relevant to the working space, you can be sure it works with the corporate network and infrastructure, and guarantee that it's fit for purpose."

Schemes like this aren't a way for staff to buy cheap hardware for personal use, as may be familiar from cycle-to-work schemes, which is why they don't include TVs or an Xbox. They're alternatives to traditional procurement policies, which help firms benefit from co-investment in the latest tech, while reducing costs.

"We did an exercise with a UK-based technology outsourcing provider, which was giving its staff a choice of three mobile handsets. These were the ones that were bundled with its corporate contract with O2. If the staff instead wanted an iPhone 5 or Galaxy 6, they could, but they'd have to pay the difference," Gregory said. "The business [and the staff both] benefit from the new technology, but there's no cost to the business for doing that."

The government view

If you think it sounds like a company car scheme - choosing from a limited range, upgraded at regular intervals - you're not entirely wrong, but there is one key difference.

Company cars attract tax based on their benefit in kind (BIK) rating, which isn't the case with CYOD: the hardware on offer is a replacement for the tools an employee would be using anyway. This remains true, even if they've contributed to the price of a more expensive device.

CYOD schemes should be cost-neutral for employers, and could actually save money over the long term. Analysis by IBM indicated savings of 1,300 per employee once they removed the cost of hardware and associated support. Further savings can be made on the corporate side through reductions in employers' Class 1A NIC contributions. Staff make savings too, because they can usually buy the hardware at a discount. They also won't need to submit to a credit check, as any surplus payments will be deducted at source.

The Information Commissioner's Office reminds businesses that, whoever actually owns a device, "the [company's] data controller must remain in control of the personal data for which he is responsible, regardless of the ownership of the device used to carry out the processing." It means any machines carrying personal data, such as customer records, must be adequately protected and monitored.

Nonetheless, the ICO is by no means against such schemes in principle, recognising that BYOD, which spawned CYOD, has numerous benefits including, "improved employee job satisfaction, overall morale increase, increased job efficiency and increased flexibility".

Whichever way a PC or Mac is used, traces of that use will be scattered about its internal storage, which raises other questions where privacy is concerned. Notably, states the ICO, when "employees' use of their own devices will mean that the employer ends up processing non-corporate information about the owner of the device and possibly others who use it, for example family members."

Ideally, a distinction needs to be made between the machine's two uses, which may require that data management policies be written and implemented, or that the machine is partitioned to fully separate the "work" and "home" environments. You might also need security tools installed in the work partition to protect sensitive data, and keep it separate from personal records.

It's not for everyone

Making sure CYOD is fit for business isn't always appropriate. Some employees have little interest in choosing their own device; many might consider it bizarre to pay for the tools they need to perform their job, while some have roles that simply won't be suited to CYOD.

It wouldn't suit a call centre, where staff can rarely work remotely, but is better suited to sales staff, who may need to work off-site. Where it can be implemented, it gives employers a defined process for regularly updating hardware, while delivering savings that can be re-invested elsewhere, perhaps on hardware to support projects that would otherwise have been postponed.

Setting up a CYOD scheme through a finance model means that every two years a device could be updated, and have a residual value built in," said Gregory. When the scheme provider can pencil in guaranteed future income, it can often afford to discount the hardware.

"The employee won't need to pay the full price of the hardware over the agreed term [and] when the agreement comes to an end, they could pay fair market value if they wanted to keep it, or hand it back and enter into a new scheme."

However, it isn't always necessary to abandon your hardware supplier, who may be able to provide devices through a third party. Intelligent Rewards manages schemes for several large firms, effectively bridging the gap between their IT and finance departments, and the hardware suppliers.

The service needn't cost the employer, either. Intelligent Rewards makes its money through insurance and extended warranties, rather than charging an administration fee. The key, says Gregory, is to give staff sufficient choice, without introducing so many options that they could become a support burden for the company signing up. Offloading to a third party is likely the simplest solution, but active corporate buy-in is key, if it's to work for the business, as much as it is for its staff.

Image: Shutterstock

Enterprise mobility is the umbrella term for a number of interlocking strategies that ensure companies can operate in a flexible, modern way.

At the heart of enterprise mobility is the ethos that employees should have the tools available to allow them to work from anywhere, across a variety of devices. This isn't just about hardware, though software also plays a vital role.

Here we look at the key aspects of enterprise mobility to help you understand what's involved and plan your own strategy.

The evolution of enterprise mobility

While it may be a hot topic right now, enterprise mobility is in some ways nothing new. The earliest examples of this trend can be seen in the adoption of business-focused mobile devices, like BlackBerry smartphones and PDAs such as PalmPilot, by the top tiers of business management during the late 90s and early 2000s.

Typically, these were business owned and managed devices intended to help these senior members of staff stay connected while out and about at client meetings and other events.

Come the mid-2000s, though, the landscape was starting to shift, thanks in large part to the launch of the iPhone. This brought internet connectivity and apps, which had previously been the reserve of these executive devices, to the mass market and thus all layers of the business.

The mass availability and adoption of consumer smartphones led to the phenomena known as "bring-your-own-device" (BYOD) and the consumerisation of IT, which broadly refer to users accessing the corporate network or corporate data through their own smartphone or, latterly, home computers.

To BYOD or not to BYOD?

This is a crucial question when it comes to an enterprise mobility strategy and one that's far from settled.

While BYOD is widely used and accepted in some businesses, others still prefer to provide their staff with corporate owned devices.

There are arguments for both sides: on the one hand, BYOD is very cost effective and the staff member is clearly happy using the device in question, as it is their own. This means they're less likely to try and circumvent rules or revert back to their own device anyway.

On the other hand, businesses that issue devices to users maintain greater control not only over the hardware, but also the corporate data held on them. After all, you can't demand a user hand over their personal device when they leave the company.

There's no hard and fast rule as to which approach is best for any given business, so it's important to analyse the benefits and drawbacks for your business closely before making any decisions.

Mobility management software

As with any business project or large initiative, you can't just roll out the hardware and forget about it. Continuous management is a key part of enterprise management, but fortunately there's plenty of specialist software out there to help.

This includes apps that allow users to access corporate data and documents through their smartphone or tablet without it ever actually being transferred to the device itself. This is particularly useful in a BYOD scenario, where access can be revoked as soon as a staff member leaves the business, for example. Additionally, there are products that isolate corporate apps from the rest of the software on a user's phone, meaning there's less likelihood a malicious app could gather sensitive data. Once again, this is ideal for a BYOD scenario.

There's also other software that can restrict what users can access through devices that are connecting from outside the corporate network. This is particularly important for security, as the person trying to access the data, while a legitimate user, may be connected to an unsecured network that's vulnerable to data interception.

Overall, while enterprise mobility is a single concept, the implementation will be different for each business. Carrying out a full assessment of what you want to achieve, the risks associated with it, and how much you are willing to spend are vital first steps to ensuring a successful enterprise mobility strategy.

Main image credit: Bigstock

The cyber threatscape is a dynamic and rapid environment where individual threats hit the victim, the headlines and the waste-bin of history in quick succession. Some threats, however, are the hardy perennials of the security world. So how do you deal with those?

Malware

Malware is short for malicious software, and long on threat durability. Last year enterprise organisations downloaded a piece of known malware every 81 seconds. Malware itself is constantly mutating, with some reports suggesting as many as 12 million new variants were produced every month last year.

To frame that rate of growth in some contextual perspective, more 'new' malware was seen across the last two years than the entire previous decade in total. As more and more criminals cotton on to the fact that they can still make a tidy profit by selling 'malware-as-a-service' packages, expect this number to keep growing.

Endpoint protection software - i.e. software which protects the actual laptops and smartphone used by employees - is a good first line of defence against malware, as many forms of malware (particularly older strains) will be caught by modern anti-virus programs and the like.

For the same reason, making sure your software is as up-to-date as possible when it comes to security patches is a must. Most malware takes advantage of security holes in older versions of software that go unpatched by lazy or overworked IT departments, and issuing the appropriate fixes can often plug many vulnerabilities with a single stroke.

Sometimes, however, the caca inevitably hits the fan, and if the worst should happen, backups are an excellent way to ensure your business can bounce back in hours rather than weeks. Taking regular backups is an excellent way to de-fang ransomware in particular, as simply restoring from yesterday's backup is easier, faster and cheaper than ponying up the bitcoin to get your devices unlocked.

Phishing

Due to the extremely low entry requirements, phishing remains by far the most common attack vector for cyber criminals. The goals of a phishing attack can vary, ranging from simple financial fraud to credential theft and the installation of ransomware and rootkits.

Thankfully, phishing is relatively easy to defend against. There are numerous vendors selling phishing detection solutions and whatnot, but the simplest way of foiling phishermen is staff education. Training employees to spot suspicious emails in simulations and mock attacks can improve infection rates dramatically, and will pay dividends over time.

Of course, some attacks are more targeted than others and criminals will often use carefully-crafted 'spear-phishing' campaigns that have been specifically adapted to work against a certain target. These are more difficult to detect, which is where tools like spam filtering can be beneficial.

Distributed Denial of Service (DDoS)

Although malware remains at the top of hacker tools to disrupt network traffic and take websites down, enterprise-targeted DDoS attacks are hot on the heels of such strikes. In fact, the two often run side-by-side to cause as much disruption as possible to an organisation.

The problem with DDoS attacks is that they cause a huge amount of damage to a business and can bring an entire website down, even if the organisation thinks it has the capacity to deal with a digital battering ram. Consumers are largely kept out of the loop, only experiencing the results of the attack essentially, not being able to use a website rather than finding themselves directly targeted.

The motivation behind such attacks varies. Sometimes the attacker wants to take a political stand against the business in question, while other criminals might want to cripple the company financially. There's also the possibility of holding the firm to ransom, although it's less common than the other reasons behind DDoS attacks.

Whatever the reason hackers decide to launch a DDoS attack on a company, the overall motivation is to cause business disruption, affect customer churn and increase the cost of operating. Added to that, criminals sometimes use DDoS attacks to take the focus away from another attack on the network, so the onslaught could end up costing more than it originally appeared.

Business can protect against DDoS attacks using layered defences including 'scrubbing' networks, which entails passing it through high-capacity networks using scrubbing filters that clean the traffic, or by using web application firewalls that stop attacks from infiltrating the network.

Shadow IT

At number three on our list of cyber threats to the enterprise is something way too many people don't properly understand: shadow IT.

Although the term itself is becoming more commonplace, it tends to be wrongly dismissed as being synonymous with the Bring Your Own Device (BYOD) mobile technology phenomena. The real threat, however, comes to the organisation through rogue services that employees (and management up to and including the C-suite are often amongst them) use to increase productivity but which are completely unauthorised.

By flying under the organisational radar these services, which can range from cloud storage provision through to social media tools, are also off the security map. Securing endpoints that aren't visible to you isn't easy. In fact, it's pretty much impossible to stop all shadow IT use, but you can control and secure it through a mix of education, policy and technology.

Educated staff who are aware of the risks associated with unauthorised service use are more likely to ask for help, especially if policy encourages this rather than brandishing an executioner's axe. The final piece of the puzzle is technology, which can help bring visibility and control back to the organisation. Small steps such as monitoring expenses and implementing authentication through a centralised billing system can have a big visibility reach.

WATCH: Learn more about the security threats facing businesses today and how to combat them in this free webinar WATCH NOW

Getting the right mobile strategy for the business has to be a key aim for savvy CIOs. Yet as many as 48% of organisations do not have a mobile strategy in place, according to research from Econsultancy. With the number of devices continuing to increase, CIOs must adopt a strategic stance.

"The pace of change is only getting quicker," says Andrew Marks, former CIO and now UK and Ireland managing director at Accenture Technology Strategy. "Few CIOs will go away and adopt these developments straightaway. But such announcements form part of a constant feed of IT-led change."

So, how can IT leaders create a mobile strategy that's right for their business? As new technologies continue to come on stream, how can CIOs develop an approach that's fit for purpose today and into the future? Marks says executives must start thinking about long-term developments now.

"The consumerisation of IT drives CIOs to think daily about how technology might affect the way the rest of the business functions," he says. "What's different today relative to even two or three years ago, is the quality and range of services available to end-users with a mobile device. Everything is getting faster, better, quicker."

The next stage for mobility, says Marks, is likely to be a greater tie-in with advances across the areas of wearable and connected computing. He expects professionals to be able to tap into a collection of connected devices in order to pick up and complete particular business processes, rather than relying on a single device today.

The processing of an invoice or contract on a laptop, for example, could be 'passed' to a tablet and then signed off at a later stage via a smartwatch application. "There will be a greater interoperability regarding the devices used to complete a series of discrete yet related tasks," says Marks. "It's exciting to see the pieces forming and the situation is evolving quickly."

Such advanced developments are already taking place in what might be perceived to be a traditional business. Martin Draper, technology director at luxury retailer Liberty, is taking an integrated approach to transformation. Liberty, he says, simply has a business strategy mobile isn't separate; all types of IT must be used to help the organisation meet its broad aims.

As part of this business strategy, Draper is already investigating how the Internet of Things and other connected technologies could help the retailer offer unique propositions to customers in the future. The technology team's work around digital transformation isn't just confined to customer service. His firm has used the cloud to launch a new ERP platform through HSO in less than a year.

Liberty also recently launched its first iOS app to help staff complete B2B orders on the go. "Mobile provides great opportunities to give me new ways to enable our staff," says Draper. "We're all tech-savvy you have to use that technological opportunity to create more workplace capability."

Like Draper, Neil Moore, head of ICT at Hampshire Fire and Rescue Service, says strategy is a crucial to helping organisations make the most of developments in enterprise technology. Moore says he holds responsibility for making the key decisions in regards to the mobile strategy of his organisation. He works alongside his senior business peers to make the decisions and also pays due attention to standards and accreditation.

Moore says the organisation spent time in the past ensuring it complied with the ISO 27001 governance framework and the standards associated to the UK government's high-performance Public Services Network. Rather than being a hindrance to innovation, Moore says compliance helped the organisation accommodate a bring-your-own device (BYOD) mobile strategy.

He says support for that approach is now even stronger: "Digital transformation means we can draw on better solutions for supporting BYOD. It's been part of our accreditation for a number of years now, so we feel confident allowing people to bring their own devices to work."

Moore says the organisation relies on a large number of part-time workers who respond to calls for fire staff when incidents occur. The Fire Service does not issue corporate devices to these retained fire fighters. Instead, part-time members of staff use their own devices for operational tasks.

"It's important for us to know when these retained workers are available. These part-time workers can record their availability for work through their own mobile devices using a secure and dedicated application," he says.

"We've even got examples of fire fighters who have paid their own money to download apps that illustrate the risk of hazardous materials because it helps them in the business. This is the digital world we live in and people are using devices to download apps when they need them. If they find information to help them complete their jobs, then, culturally, that's acceptable."

Matt Peers, CIO at law firm Linklaters, agrees that any effective mobile strategy must recognise that people will want to use a range of technology to help them complete their work. What's more, the power of consumerisation means the majority of employees will always want the latest device. Peers says the firm saw about 185 Apple iPhone 7s join the firm's network on the device's launch day.

At a broader level, Peers supports a mixed approach to mobile technology at Linklaters. Everyone who works for the firm from the back-office to the chief executive receives a corporate-supplied iPhone. Peers has also embarked on a programme to give all fee-earning staff members the choice of either a Microsoft Windows 10-based laptop or tablet. However, he says openness to change is key to an effective mobile strategy.

"A lot of the decisions a CIO makes are based on cycles and my longer term is view is much more based around BYOD," he says. "I want people to be able to bring to the office and use whatever device they want to safely and securely, whether that's a Windows 10 laptop or an Apple MacBook Pro. Where we're at right now is a stepping-stone towards our ultimate goal."

Mobile working and BYOD has left businesses without sufficient security policies in place vulnerable to data loss, a new study has revealed.

The research was conducted by Arlington Research and Acronis back in May, and found that, while 60 per cent of the UK population are using personal devices for work, 40 per cent of companies have no security policies in place to prevent employees from sharing sensitive company information or accessing restricted data.

More than 1,000 senior UK business leaders were surveyed as part for the study, with 40 per cent of respondents also admitting they had no policy in place to dictate exactly how employees should use personal devices for work.

Daniel Model, manager of sales engineering Europe at Acronis, said: "The way people work is radically changing due to mobility. We are living in an always-on world where employees are on-demand more often and increasingly doing their work out of office.

"It is astounding to see how many UK businesses lack protection against unmanaged use of mobile phones and tablets and the critical company information that is accessible on them. The door is open to a serious risk of data breach."

Following the research, it was discovered that a further one in five employees admit to losing a personal device that had sensitive company data stored on it.

"We are calling for all UK businesses that are tapping into the power and productivity benefits of mobile workers to take data protection seriously and prevent easy access to and sharing of company data and remove the risks involved with mobile workers," Model added.

Android is the most widely used mobile operating system on the market, but has lagged behind iOS when it comes to the range of options available for Bring Your Own Device (BYOD) environments. With the launch of Android for Work, Google hopes to change this.

Android for Work's stand-out feature is the Work Profile, which creates vital separation between your users' personal and business lives, at least when it comes to what's going on with their phones. By giving users an entirely separate set of apps for their work account, controlled via your Mobile Device Management (MDM) service, Android for Work allows you to apply policy restrictions, create an approved list of work apps, and wipe your user's business account without affecting their personal Android account.

Android for Work is supported by most major MDM services, including IBM MaaS360 and VMWare AirWatch, but we're going to be testing it using Google's own MDM tools, built into Google Apps for Work, which costs 3.30 per user per month.

Configuration

If you're a Google Apps for Work user, then Android for Work's settings and options will be integrated into the Security and Device Management areas of your Admin interface. Non-Apps users will have to create a free Google Admin account in order to manage the token that authenticates your MDM provider.

Generating that token is done via a button on the Security screen. If you're using Google Apps for Work to manage devices, your next step is to go to Device management > Mobile > Set up Android for Work, where you have to paste in your token. The process is detailed in the Android for Work support portal, but we'd have welcomed a step-by-step wizard.

With your token accepted, you'll be told that you are "setup to manage Android for Work from Google Admin Console". By default, existing users with compatible devices will now be able to create Android for Work accounts on their phones and tablets, but you'll have to do a bit more work because it's fully functional. If you're already using Google Apps for device management, you'll notice that a few new options have appeared. The most important one in this case is Require Work Profile. Enabling this means that users with devices capable of creating a Work Profile will have to do so before they are allowed access to their files. Other recent additions to Google Apps' device management, which fall outside the scope of this review, include more advanced management tools for Chrome browsers and Chrome OS devices, as well as the ability to roll out network settings, including VPNs, across all your managed devices.

Whitelisting apps for your Android for Work users is a two-step process that starts in Google Apps' mobile management settings. Expanding the Android for Work tab displays a link which tells you how many apps are whitelisted. It starts with only one, the Device Policy app. To add more, you have to click through to the link and click the plus sign at the bottom right of the page.

You'll be prompted to paste in a link from the Google Play for Work store to add the relevant app to your management environment. Before whitelisting apps like this, you have to accept the Google Play for Work admin agreement and then approve the apps you'd like your users to have access to. You'll have to do this for everything, including Google apps such as Gmail, Drive, and Sheets, so it's best to approve and whitelist all the apps your users will need for work before rolling out Android for Work to them.

Your Play for Work admin account allows you to purchase group licences for paid-for apps, but very few apps have been made available by their authors for bulk purchase, and Google provides little information to support you in the process. You can also publish your own private apps to your Android for Work environment. Google provides a range of tools, docs and APIs to help with this, but you will have to pay a one-time $25 (17) registration fee before you can publish anything to the Play store.

User Experience

From the user's point of view, Android for Work is simple enough, assuming it's compatible with their device in the first place. If you're adding a work account to your current phone, you just download the Google Apps Device Policy app and sign in. If your phone has managed profile support, and your administrator has made Work Profiles compulsory, you'll be taken through the process of creating one. If Work Profiles are optional, an entry in the Device Policy app will allow you to set one up if you want to.

The installation process explains which rights your admin has, and then prompts you to modify your settings to bring them into line with your employer's policy before your device is allowed to connect to your Google Apps for Work account. Android for Work profiles require users to apply encryption, while most other settings are dependent on your company's Device Management policies. These include phone wiping, password modification, and disabling the camera.

Users can always manually remove their Android for Work account and have access to remote wiping and location tools in case they lose their device. Having a discrete set of apps associated with the user's work account means that admins can limit which apps are available to install from their Android for Work Play store, but that won't stop users from installing whatever they want from the personal account on their phone or tablet.

Creating Android for Work profiles on our Google Nexus 4 phone and Nexus 7 tablet both worked perfectly, adding new, separate apps to our app tray, including Contacts and a Play store. From the store, we were able to install apps whitelisted by our admin. All your work apps are marked by a little red briefcase icon, making it easy to tell them apart when you've got them pinned to a home screen.

We were surprised to find that our fully updated LG G3 running Android 5.0 was unable to create an Android for Work profile due to its apparent lack of managed profile support. Unfortunately, we've yet to find a list of which Android 5.0 and 5.1 devices currently support managed accounts. If you have a Lollypop device without managed profile support, you can still add your work account as a standard second Google account.

If your phone or tablet runs Android 4.0 to 4.4, which lack managed profile support, there's an installation method involving a third-party app, Divide, and a Google Apps for Work app. Configuration is more complicated for the user, but doesn't depend on a feature that they may or may not have.

The last stage of any device management review is to see how easy it is to remove the management tools from a phone. Users can unregister their own devices via the Device Policy app, which cleanly removes all Android for Work apps. However, when we carried out a remote account wipe on our Nexus 4, the apps were all left behind, with the user unable to log into them, but also unable to manually delete them. If you want to easily disentangle departing staff members' BYOD hardware from your Google Apps environment, this isn't ideal.

Conclusion

Android for Work marks a big step forward when it comes to allowing your staff to use their own mobile devices for work, without having to sacrifice either the security of your data or have a major impact on their ability to use their personal phones and tablets as they please. However, its usefulness is currently limited by the restricted range of devices that actually support it, and its remote account removal isn't as clean as we'd like.

Verdict

It’s inevitable that Android for Work will become an essential tool for business device management, and we look forward to its future development. However, although work profiles are useful, we’d be inclined to wait for the next update rather than rolling Android for Work’s full features out to staff at the earliest possible opportunity.

Device Requirements: Android 5.0+ with managed profile support, Android 4.0-4.4 with Divide and Android for Work apps

GCHQ has recommended that organisations remove employee smartphones and memory sticks to better protect against cyber attacks.

GCHQ calls staff the "weakest link in the security chain," reports The Telegraph, with action against such risks desperately needed. It has thus urged businesses to strip staff of smartphones, as warn employees to only use trusted Wi-Fi networks.

The advice comes from the CESG information security arm of GCHQ's '10 Step to Cyber Security' guidance report, which was created with the Cabinet Office, Business Department and Centre for the Protection of National Infrastructure.

Part of the government's effort to fight against cyber terrorism is to push for UK businesses to be more aware and take more precautions against possible threats, after the Prime Minister labelled such cyber attacks as "one of the biggest modern threats that we face."

Specific advice includes telling companies to monitor all user activity within their business, making sure that staff are aware "any abuse of the organisation's security policies will result in disciplinary action."

Taking smartphones away from employees is also mentioned with the advice for bosses to "assess business requirements for user access to input/output devices and removable media (this could include MP3 players and smart phones)".

"Some users will have to work in public open spaces where they are vulnerable to being observed when working on their mobile device, potentially compromising personal or sensitive commercial information or their user credentials," it continues.

The rise in popularity of employees using their own devices for work purposes has meant that the number of people conducting business over less secure connections, such as in coffee shops, has also increased.

A recent government study revealed the slightly startling fact that only 16 per cent of SMBs in the UK currently consider cyber security to be a priority for them. This contrasts with the 33 per cent of SMBs that were actually hit with a cyber attack in 2014, according to the Cyber Streetwise campaign.

Two-thirds of NHS trusts are risking data breaches because they lack a policy to manage their employees' personal devices, it is claimed.

Just over one third (34 per cent) of trusts have measures in place to govern what devices staff can bring into work, and what they can do with them, according to a Freedom of Information (FoI) request sent to 35 trusts.

Those without a BYOD policy have sacrificed visibility into what devices are accessing their networks, claimed virtualisation firm Citrix, which submitted the FoI.

More than half the trusts 18 out of 35 were unaware whether personal devices were being used for work purposes.

A Citrix statement read: "This lack of visibility means that NHS trusts could be vulnerable to data breaches if a personal device is being used without adequate protection.

"The ability for employees to securely access trust data on the device of their choice has the potential to improve productivity and potentially contribute to a reduction in IT overhead cost.

"However, the FoI results reveal that many NHS trusts are struggling to seize this opportunity, with the delay in uptake also potentially having a significant effect on ensuring security requirements are met."

The news comes as the issue of data security in the NHS becomes a hotter and hotter topic, with the controversy of the patient data collection scheme, care.data, ongoing.

The initiative is meant to enable GP surgeries and hospitals to share patients' medical records, but has been criticised by data protection advocates.

Care.data was originally due to be rolled out in April 2014, but was delayed by six months due to a poor public consultation.

It's now being trialled in GP surgeries in Leeds North, West, South and East, Somerset, West Hampshire and Blackburn with Darwen.

But sceptics fear patient data will be sold to companies, despite assurances to the contrary, after millions of patients' information was sold off to private sector firms over the last decade, according to a report by the NHS information centre last June.

Tim Kelsey, national director for patients and information at NHS England, believes there is a moral right to collect patient data.

Speaking at a Big Data conference attended by IT Pro in January, he said: ""There are gaps so big, so dangerous, that they just have to be filled from a moral as well as a political perspective. We're going to be doing that this year.

"The NHS is not capable currently of telling you how many patients are treated for chemotherapy, for example. And certainly not capable of telling you that if they are treated, [then] what is their outcome."

IT Pro has approached NHS England for comment, but had not received a response at the time of publication.

Chromebooks are proving to be increasingly popular in the enterprise, winning against Windows devices that boast too much functionality, according to Lenovo.

The Chinese hardware giant runs the Chrome OS and Windows operating systems on its devices, and said Google's software is making waves in the business world aspeople get turned off by Windows 8.

Steve Kendall-Smith, the UK head of public sector and enterprise at Lenovo, said Chrome is doing well in use cases where mobile workers need to access a small number of apps to do their jobs.

He told IT Pro: "We've just started to see some corporate customers looking at Chromebook. The reason for that is... it is appropriate for certain corporate customers.

"We've got one project that's going on with truck drivers now and they've got one app they use, so actually they're not putting together PowerPoint presentations or anything on spreadsheets, they just need to have this one app."

He pointed to the NHS as another customer eyeing up Chromebooks, for midwives who must put together weekly worksheets but need laptops or tablets for little else.

Asked whether the Chrome OS is eating into Microsoft's devices market share, Kendall-Smith said: "I think it's starting, it's probably early days in all honesty.

"It might be in some cases, they're not necessarily replacing Windows devices but [where customers] have limited use cases, they haven't needed the full blown Windows functionality."

While he backed Microsoft as the main vendor for the enterprise, he argued that Windows 8 has suffered low adoption, with those migrating away from the unsupported XP operating system moving to Windows 7 instead.

"To be honest there's not many on Windows 8," he admitted. "Really our business over the last year [has seen us do] a lot of Windows 7 refreshes, where corporate and enterprise customers are moving away from XP but they're not going to Windows 8."

A total 55 per cent of desktops around the world run on Windows 7, according to the latest NetMarketShare figures, compared to another 19 per cent still on XP.

In comparison, just 3.79 per cent of desktops run Windows 8, while Windows 8.1 has 10 per cent of the market.

Where customers are using Microsoft operating systems, they are running Windows 7 on PCs and Windows 8 on tablets, Kendall-Smith added, creating two different operating systems running in tandem.

With Windows 10 to be released later in 2015, that could change, but Kendall-Smith said it is too early to anticipate demand for the operating system.

BYOD

Lenovo's latest quarterly financial results showed the giant had a 4.8 per cent share in the global tablet market, with 3.7 million shipments, but Kendall-Smith said the BYOD trend of bringing personal devices into the office was not a popular one among customers.

He told IT Pro that - aside from the security concerns of giving personal devices access to a corporate network - the trend was simply not practical.

"Most corporate organistaions have looked at BYOD but felt there are too many limitations," he said. "What happens if you bring your own device to work but you forget the charger?"

Instead, Lenovo sides with Microsoft that the best way to get their products into enterprise customers' hands is by going through the IT department with Choose Your Own Device (CYOD), where customers get a choice of IT-approved tablets.

"It gives employees the choice, but still keeps it within a corporate standard, so it is definitely the best way," he said.

Public sector

Lenovo claims the popularity of laptops and tablets has helped it quadruple its UK public sector revenue from 50 million to 200 million in the last five years.

It ascribed some of this success to demand in the NHS and local government, with Lenovo winning part of a 25 million NHS tender that will see it provide nurses with mobile devices.

Meanwhile, Kendall-Smith said Lenovo has struck deals with four central government departments in the last year.

"They were looking for new ways of working, in the areas of convertibles and so on, out in the field. Still people are moving away from desktops onto laptops, that's definitely been the case," he said.

"We've done a number of big rollouts with tablets, convertibles across central government as well as standard laptops and desktops."

I've been involved in IT security for twenty years now, and you'd think - as a result - my teenage son would be mindful of such matters. But you couldn't be more wrong.

My lad has absolutely no security smarts, despite my efforts, and his mistakes are all too often mirrored in the corporate world. The consequences, however, are a tad more serious than someone posting embarrassing messages on Facebook. Let me explain.

Data sharing is the main problem I have with my teen. He signs into his social media accounts on someone else's device, and forgets to logout when he passes it back.

He thinks nothing of leaving the family laptop running for 15 minutes or more while his social media accounts remaing logged in.

Unsurprisingly, this has resulted in his mates, his girlfriend and me posting stupid things under his name using his account. Worse still, he also uses the same password for his social media, laptop, and his Xbox account.

In this, he's not alone. New consumer-focused research from Kaspersky Lab suggests 32 per cent of people take absolutely no precautions when letting others use their devices and 92 per cent store sensitive information on them.

Those numbers also sound about right for the business sector. At the smaller end of the enterprise scale, device sharing is pretty common and adequate security measures are not. As you move up the curve towards larger enterprises, things improve as far as device security goes, but the sensitive data issue remains.

It's all tied into the whole Bring Your Own Device (BYOD) problem, of course, and how to control what data is allowed where, who can access it and when.

Although the BYOD has been done to death, there remains a problem whereby shadow IT exists within the enterprise and a data-centric approach to security is not in place to help mitigate the threat.

How does this tie into my teenage son's device misuse? Well, unless you get to grips with securing data itself, then users of devices will remain the weak link in your strategic security chain.

You cannot control who uses a personal device once it is out of the workplace, and you cannot control what users do with it.

If you don't get serious about data security, rather than device security, you are heading for a fall. My son, on the other hand, is a lost cause. Luckily, he has no data of any value whatsoever. I know, I've seen his Facebook feed.

The days of workers being chained to a desk from 9am-to-5pm are long gone. The world has gone mobile, and businesses need to get on board or be left behind. But there's a lot more to getting your business mobile than just handing out laptops and tablets to your workers, and implementing the wrong mobility strategy can be worse than not having one at all.

In this Guide to Business Mobility we'll explain how to first assess your business, and then how to implement the right mobile strategy for your company.

The guide addresses key questions that can often be confusing...

• - What's the right device for my business?
• - When should you choose a tablet?
• - When should you choose a laptop?
• - When is a hybrid device the right choice?
• - How can I best mobilist my staff
• - How do I manage mobile devices?
• - How can I make BYOD work?

Going mobile is an important step for any business and the Guide to Business Mobility will help you do it right.

Read the full Guide to Business Mobility

For more advice on transforming your business, visit HP BusinessNow

Bring Your Own Device (BYOD) security problems have been overblown during the last few years. Sure, the increased uptake of cloud services and the pressure put on both budgets and staff expectations has led to more off grid devices appearing in the workplace. However, the use of them doesn't have to be a security nightmare; it just means the enterprise has to adjust its security posture accordingly to accommodate the risk.

The same goes for the 'Shadow IT' threat. None of which stops security vendor after security vendor from lining up to tell us all these things are a clear and present danger to enterprise data.

The latest of these "threats" to enterprise data is Wear Your Own Device (WYOD). According to new research from Accellion, published today, enterprises are simply not ready to tackle the security risks that come with "the dawn of the age of WYOD".

Aimed squarely at the UK enterprise, the research questioned decision makers from 100 organisations with more than 1,000 employees, and Accellion discovered that 77 per cent of them didn't include wearable tech as part of their broader mobile security strategic planning. What's more, 53 per cent said they hadn't even considered the possible impact of it on their security posture, despite 81 per cent also accepting any increase in wearable tech could be a security risk.

My main concern here is the figures simply don't make sense and I suggest the 'decision makers' who responded are immediately relieved of having to make any further decisions about enterprise data security as they are clearly not up to the task. I mean, seriously, half of them say they haven't considered the wearable threat yet more than 80 per cent accept wearables could be a security risk.

Did they not understand the question? If that were not enough to reinforce my knee-jerk distrust of such surveys, after all the responses are only as valid as the questions being asked. Another statistic emerging from this research is that 41 per cent of UK enterprises "currently have a BYOD policy in place that can be extended to cover wearables", which suggests that 59 per cent do not.

What the actual flip? More than half the BYOD policies out there, in these enterprises at least, are not fit for purpose because they do not cover own devices being brought into the workplace if they are strapped to a body part, apparently. Sorry, run that past me again, old chap?

Accellion says the figures "demonstrate that the wearable device poses a great threat to UK business, and if IT teams don't act quickly we could see many more cyber attacks as a consequence" which isn't the conclusion I am drawing from the headline figures. What I'm getting is they demonstrate a number of enterprises either have a really crap understanding of what a BYOD policy should look like or no idea what a wearable device actually is. Or both.

Don't get me wrong, I fully understand the threat that wearables introduce into the enterprise data landscape. What I don't understand is how that threat differs fundamentally from anything else that falls under the umbrella of BYOD. The clue is in the D bit, and a smartwatch or Google Glass, or USB storage underpants for that matter are all devices. End of. Next...

Managing data and applications on mobile devices should be a priority for IT admins, according to Dell.

Businesses need to focus on the software side of things, not just the hardware it is running on, Don Ferguson, VP and CTO for software at Dell told delegates during a panel discussion.

"Poorly designed software is the main reason for security breaches. Step one [for protection] is to make sure you have proper expertise for developing software," he said at Dell World 2014.

"Mobile device security touches everything from data classification [to] privileges. It's important to secure the device and ensure that only the right people retain rights to the data."

Meanwhile, Prasad Thrikutam, president and global head of applications at Dell Services warned businesses not to get complacent as the sophistication of mobile devices increases.

"There are at least 368 security major breaches to the end of October10 million records have been compromised," he said.

"There are so many windows of vulnerability [on mobiles]. Just the aspect of GPS on phones exposes them. Advertisers can know your position and [hackers can] get into the back end. Most of us use simple, easy to remember, one-finger security codes that makes them easy to access [too]."

Thrikutam's advice is for businesses to implement platform-based security, adopt two-factor authentication, use containers to sandbox data/apps and also direct attention to securing back-end infrastructure.

I'm not playing Buzzword Bingo this week, but I am going to mention BYOD (or Bring Your Own Device, if you prefer) and - as enterprises around the globe will testify - plenty of people do.

The explosion in using consumer devices in the workplace should not have caught anyone by surprise. When such devices catch up with, and in many cases surpass, business kit in terms of sheer power, flexibility and cost, then BYOD becomes a no-brainer. This is a good phrase, as it also sums up what appears at first glance to be some very worrying security news that broke this time last week.

The story claims the mobile Gmail app can be hacked with an impressive 92 per cent success rate. The fact research scientists at a couple of US universities have demonstrated a method by which it's possible, across Android, iOS and Windows platforms no less, to obtain personal data including passwords is surely a nail in the coffin of BYOD?

I'm not convinced, despite the shared-memory side channel-using 'UI state interference attack' being technically very interesting indeed. My 'meh' mode is activated because, practically speaking, it's much less interesting.

Here's the lowdown: a user downloads multiple apps, they all run on the same shared platform, and it's possible for one of those apps to employ that memory side-channel which is found in just about every GUI to access the others.

It was possible to do this 92 per cent of the time with Gmail. Shocking stuff huh? Not as shocking as the detail of what is actually required to get this to work.

First, the app that allows this to happen has to be installed. That's an unsigned app, and one that's carrying malicious code. The kind of app that would be prohibited by any half-decent enterprise BYOD policy, and avoided by any half-brained employee who wanted to keep their job.

However, even allowing for the fact such an app may get installed via a rogue app store or by an idiot user, even then attack success is not a given.

Secondly, on the 'things that are required for this exercise in intellectual masturbation to work' list is the attack would have to take place at the precise, exact, same moment the user was performing the action to be accessed using the target app.

Throw in the third requirement, that all of this is done without user knowledge at any point, and it becomes startlingly clear that in the real world (outside of the rubber walls of the research labs) it's an attack that is very unlikely ever to be successfully pulled off.

This reminds me of something very similar that I was writing about back in 2012, for our sister publication Cloud Pro, under the title of 'Cryptography attack: side-channel cloud threat is all nerd and no knickers.'

Although the side-channel threat is obviously made a lot easier on a mobile device, with regards to the requirement to be running on the same platform at the same time, I stand by the gist of what I said back then. Namely, that if you are an enterprise which follows basic security best-practice strategies, including BYOD policy implementation, then you can move on as there's really nothing to see here except fear, uncertainty and doubt.

A new report has investigated the use of Bring Your Own Device (BYOD) initiatives in local government, discovering they could do a lot better.

In fact, only five out of 14 of the London boroughs surveyed in the report had BYOD schemes.

Camden led the charge by far, with 252 personal devices activated on the network, most of which were iPhonea. However, this still only represents four per cent of the entire organisation.

The borough has increased the take up of its scheme too - only 74 people were using their own device for work purposes in 2012, with 171 on the BYOD scheme in 2013.

Wandsworth was at the bottom of the pile, with only two devices listed as BYOD, although nine of the boroughs did not provide a response and so were recorded as having zero BYOD activity in operation.

The report, prepared by Steven George-Hilley, director of technology at Parliament Street, concluded that there should be "calls for a bolder, more proactive approach from IT decision-makers to push through personal device schemes in in the workplace wherever possible."

He explained the barriers of adoption for local governments include security concerns, who will manage the process and implement it and whether employees are aware they can use their own devices for work.

Additionally, if local governments do decide to roll out a BYOD strategy, they must ensure the the necessary protocols, procedures and training is in place to make it an effective scheme, George-Hilley said.

All three of these factors apply to any enterprise and should not be exclusively applied to local government. However, George-Hilley noted local governments were in desperate need for "visionary IT leadership" and should be setting a precedent for other organisations outside of the public sector.

Councils should "factor in planned reduction in personal IT devices such as tablets and laptops and shift the onus onto employees to provide preferred devices where possible," he said.

Some users are being charged over the odds for repairs to their PCs and the service they receive is sub-standard.

So claims a report by Which? that found those using high street PC repair shops were subject to "poor quality repairs, aptitude and pricing from major High Street retailers and consumers paying over the odds for simple repairs."

The consumer affairs publication tested the repair shops by installing an easy to rectify software fault on 24 laptops. One laptop was then taken - using mystery shoppers - to six different branches of The Carphone Warehouse, Currys and PC World, plus independent PC repair shops. It also conducted the same test in six Apple Stores with six different damaged MacBooks.

Just 40 per cent of laptops were repaired successfully and many of the customers were asked to purchase a new hard drive for data to be transferred onto. In nine of the cases, no fix was found at all for the issue - despite Which? experts having repaired the problems in a matter of minutes. Furthermore, five of the mystery shoppers were charged double what they should have been for the fix (100 rather than 50), with one being presented with a bill for 170.

Carphone Warehouse came out at the top of the charts, managing to repair all but one of the computers supplied. The report noted that the mystery shoppers were charged varying amounts at different branches and a number of unnecessary fixes were applied - one of which cleared all data from the computer.

Apple came out second, with four of the six MacBooks repaired quickly and without charge, but independents and PC World performed worst with the latter only repairing one computer and charging 156 for something that should have cost less than 50.

"It's shocking that major high street retailers are failing consumers when faced with such basic repair issues and are charging people through the nose in the process," said Which? editor Richard Headland.

"We want to see improved staff training and repair procedures as well as fair and consistent pricing so people can be confident in the services they receive."

As the BYOD trend gathers pace in the enterprise such sub-standard work and overcharging could start causing business headaches as IT departments have to redo the repairs or users start claiming back costs for fixes via expenses.

Apple had not responded to the report's findings at the time of publication. A spokesperson for Currys and PC World told Which? the firm was disappointed it had failed to deliver its usual high standards of service.

"We repair 8,000 laptops each week, with a 97 per cent success rate, and the overwhelming majority of customers are very satisfied," he said. "We will learn from this to improve our service even further," the spokesperson added.

Carphone Warehouse said that it welcomed feedback in order to help it continue to improve the service it delivers. "The key learning for us is to ensure our high standards are consistent across all stores so customers receive the very best service wherever they visit," a spokesperson told Which?

For IT departments, the problem used to be external files brought in to the workplace from home on a floppy disk. Then there was the rise of the USB memory stick.

These devices had a habit of housing not only PowerPoint presentations that had been sweated over into a business environment, but also a veritable collection of nasties that may have assembled on said worker's computer.

It was a scary time, and it's hard to find an IT manager who doesn't still break out in a cold sweat when a USB key is produced.

However, the USB pen drive appears to have had its day, thanks to the continuous rise of cloud services, like Dropbox.

The cloud storage company's servers, and those of others like it, fight to keep data secure and encrypted, leaving just an individual's files where, in theory, they're supposed to be.

Yet has the phenomenal growth of Dropbox come at a price, and have IT departments just traded one security risk for another?

How We Got Here

Dropbox was one of a small number of now major services that ended up being the right service at just the right time. At the point when cloud computing services were being talked about, yet rarely deployed by SMBs and mid-sized businesses, here came a service that encapsulated many of the benefits with precious little fuss.

Courtesy of an entry-level free package that came with 2GB of storage and lots of ways to expand that in exchange for spreading the word, Dropbox has accrued over 300 million users since its launch in 2008. That includes more than 4 million businesses using the service.

To many of those users, it's become a vital workplace resource. More reliable than a flash disk (with less chance of it getting left in the back of a taxi), the service is used by people as the main place to store their work files for easy access from pretty much anywhere.

The service's appeal is it that it's just so simple to use. You drop a file in a folder, and it's instantly synchronised to every other machine linked to the same account. With most professionals carrying a tablet and pretty much everyone owning a smartphone, that means work can be carried around without relying on email attachments or time-consuming file transfers.

Packages range from the 2GB entry-level free subscription, through to Pro packages offering up to 500GB space, and business-focused offerings supporting up to 5TB of data (and sporting a price tag of more than $30,000 a year).

The entry-level free package is perfect for those just looking to shift files from one place to the other, and the truth is Dropbox may have effectively replaced the 2GB flash drive, which businesses were quick to ban. But it's also brought with it one or two extra security risks as well.

The obvious one is offset a little by the way Dropbox goes about its business. There have been moments where Dropbox has been inaccessible, and for people relying on the service for day-to-day work, this was a massive problem. A service like this has to be reliable if it is to achieve what its promising users.

The desktop client at least encourages users to keep a local version of their files. So, even though the cloud-based part of the service was faulty, the majority could still access their work.

It wasn't so easy for those relying on online access, or who use more selective syncing methods, though.

Compromised?

But there is a bigger problem. Unsurprisingly, many businesses have expressed concern at the idea of an individual's personal cloud storage service being resident on their work machines.

Notwithstanding the obvious distraction issues of having non-work material residing on business machines (as well as the presence of a third-party piece of software which, to be fair, most business networks can easily block), there's a sizeable issue the other way too, as important business materials are stored in a personal cloud.

This is part of the larger problem associated with the issue of BYOD, which has been a point of contention for businesses and their employees in recent times. Dropbox and other cloud storage services has been an incredibly valuable resource for the rise of remote working and collaboration between teams spread across different parts of the country or even the world.

How, do you police that? Are you cleanly allowed to effectively monitor someone's personal files, even if they're stored and/or accessed on a business machine? Furthermore, what happens when that worker leaves? How can a business retrieve its files? Is it allowed to go into that Dropbox account and make sure nothing business critical is following that employee out of the building?

The Dropbox website claims that files are stored using 256-bit AES encryption, with SSL for security with data transfers. It also says you can unlink lost or stolen devices to prevent snooping.

But Dropbox does not currently have compliance with a range of standards, such as HIPAA, FERPA and SAS 70. These are straight deal breakers for some organisations, who require a level of security and certification in place in line with their own policies.

Control and encryption are crucial. Dropbox argues that it complies with the US-EU Safe Harbour Framework, and that it takes security extremely seriously.

Furthermore, there's a potential vulnerability. A compromised Dropbox account could potentially offer a way into a company's network. This, in turn, opens up malware and data security issues.

Not for nothing are many IT managers and directors concerned at the huge growth Dropbox is experiencing.

USB sticks could be managed a lot easier. Furthermore, there's the inevitable concern over material being held on third-party services.

Does a business want valuable, critical information, on the servers of an independent company, to whose backend it does not have access?

It may sound like scaremongering, but public service institutions have been fairly brutal in blocking cloud services - including Dropbox.

As IT Pro reported back in June 2013, 54 per cent of UK councils have stopped access to cloud services such as Dropbox for users. Is that paranoia, a legitimate security concern, or common sense?

Policies

That said, with the right policies in place, most businesses can comfortably manage the overwhelming number of potential risks Dropbox poses.

Furthermore, for the majority of users, for the majority of the time, Dropbox is fine. More than fine, in fact. It's taken removable storage out of the office, cut back on large e-mail attachments, and proven to be a hugely convenient way of moving files between A and B.

Such is Dropbox's dominance that you'd be forgiven for thinking it was the only cloud storage player in town. With the likes of iCloud, SkyDrive, Box and Google Drive (to name but a few), other services are taking a chunk of the market, and the demand for cheap, reliable cloud storage is only growing.

Workers are simply demanding ways to make remote work simpler, and storing files on Dropbox means that they can instantly access what they were working on in the office, at home or on the train without even thinking about it. It saves time and fits in nicely with the current mood.

Still Evolving

Yet are we being too tough on Dropbox? It's a service that's still evolving, that's proven to package user friendliness with cloud technologies as well as the vast majority of alternatives.

Many businesses have managed the introduction of Dropbox to their servers cautiously, but don't bring the hammer down on it, and there are legitimate reasons for doing so.

Its usefulness can't be denied for many, and businesses do see an advantage to the convenience it offers.

But is it fit for business? To a point, it's hard to deny that it is. But as with most innovations of its kind, it requires careful and often overlooked management, to ensure the business feels the benefit, without the technical sting in the tail.

This article was first pubilshed on 02/08/13 and has been updated multiple times (most recently on 18/07/14) to reflect new information that has become available since its original publication.

Inside the enterprise: Much has been written, here and elsewhere about the rise of the consumer device in the enterprise. But hard data on how we use personal devices at work is still rather hard to come by.

Samsung, though, has attempted to quantify at least some of the effects of the use of both personal devices, and consumer-focused apps, at work.

The survey of 4,500 workers across Europe suggested that three quarters of people do work in their personal time, and take care of personal tasks at work. That might not be much of a surprise, given the hours many Europeans spend in the office.

But the Samsung study also found that on average, office workers have 10 personal apps on work smartphones. As many as 41 per cent of workers use a personal smartphone for work.

More worryingly at least for IT managers is the finding that 26 per cent of workers use personal technology to work round restrictions on the apps, services, or websites they can access using business-issued technology. Younger workers are the most likely to try to circumvent company rules.

That compliance with, or even awareness of, security and data protection rules is low will, again, surprise few CIOs or IT security teams.

According to the research, 11 per cent of European workers didn't know whether or not there was a company policy on using personal devices for work and used their devices regardless.

Some 44 per cent of companies did, though, have either a formal or an informal BYOD policy. Unfortunately for compliance, 18 per cent of European workers knew about policies, but also continued to use their own devices.

Compliance with security policies rather than more general rules on BYOD was rather more positive: 45 per cent of workers said they were aware of policies, and tried to keep to them. Another 15 per cent knew of a policy but confessed to not knowing its content. Another 12 per cent ignored the policy.

This suggests that companies have more to do, both to raise awareness of their policies, and to ensure compliance. Physical and software security measures do have their place. But if bright and well-meaning employees circumvent them in order to do their jobs, IT will always be on the back foot.

Instead, the focus needs to be on user education not just around the policies and rules, but explaining why those policies and rules are necessary. Samsung did find that security awareness has increased over the last year, and almost all companies said they had strengthened security measures too.

But to be effective, security has to be user-friendly as well as technically robust. In that area at least, it seems there is work still to be done.

Stephen Pritchard is a contributing editor at IT Pro.

Figure out what makes people tick and everything else will fall into place.

That was the key theme that emerged from our Good BYOD/Bad BYOD roundtable breakfast briefing this week, which brought together expert speakers and an array of IT decision makers to discuss and debate what works and what doesn't.

"If you can understand what the human beings are doing you can be much more mindful about technology," said speaker Dave Coplin, chief envisioning officer at Microsoft, who pointed out that although IT has evolved over the years, we're still using technology to essentially do the same things at work.

However, Coplin added that our personal lives have been shaped and dramatically changed by technology, meaning we have greater expectations in and out of the office and are frustrated by the apparent 'department of no'

"In the IT industry, we have forgotten the experience that is happening in people's personal lives. We have grandparents Skype-ing grand kids and so on. At work, though, people are greeted by some long bearded person like me saying 'no'."

He also warned: "If we don't get this right the only thing left for us is not to work smarter but work harder and I refuse to accept that."

Mark Evans, head of IT at construction firm RLB concurred that too often we let technology get in the way of what we are really trying to achieve from a business perspective.

"I asked our HR department about six years ago whether we hired the best people or just the best people who live in commuting distance of one of our regional offices. If we hired the David or Davina Beckham of quantity surveying and they lived in Truro, would they be willing to commute to our office in Bristol?" he said.

"Two years ago, I asked again whether we employed the best people. Or do we employ the best people who use windows? We are immediately crippling someone who could bring real value to the business [by handing them PCs automatically].

"That's not a criticism of Windows, but because it's alien to them they're hampered."

"If we became authoritarian and libertarian we would not be pleasing anyone. We've gone down the libertarian route. We're trusting employees with 500,000 contracts, if we can't trust them with 500 laptops then..." Evans added.

His vision of the future is to have a workforce so accustomed to the tools and technologies they use there isn't a need for the IT department as we know it.

"We wanted to remove barriers and make RLB a place people can come and work to best of their abilities ... it is a compromise. It offers flexibility to staff, saves money, doesn't discriminate based on location, doesn't discriminate based on technology and gives the business a certain amount of introspection so it can see the appetite for risk," he said.

"We are getting very close to a position where I can say to my CEO that he doesn't need us anymore. This is a fundamental change to our industry. There will be casualties."

Others in the room agreed that the nature of IT and how it is delivered was changing and that it is key professionals keep pace or else risk alienating users further.

Coplin added: "We have to stop talking about BYOD or the consumerisation of IT like it's another tool in IT. It's like putting an extra phone on someone's desk and saying

'You're twice as efficient now.' We need to look at it as a principle/service that allows people to embrace technology in ways they'd not imagined before.

"In order to get to a transformational experience, you need employees that are empowered and they need the tools too. You need to connect these three things ... the power is in unleashing the workforce. Unleashing all their skills, talent and inquisitiveness as to what tech can do..."

London Technology Week is taking place this week across in the capital. With over 200 events planned between 16 and 20 June expected to be attended by more than 30,000 entrepreneurs, investors and business leaders. The week will feature exhibitions, conferences, lectures, workshops and more.

Mayor of London Boris Johnson said: "London's first ever Technology Week will showcase London's role as the digital capital of Europe, with a range of innovative businesses now calling the city their home, attracting both significant investment and some of the best and brightest talent on the planet."

The events cover a range of subjects related to the technology sector, including Will Artificial Intelligence Put My Job at Risk' on 18 June, a series of conferences, exhibitions and networking events focusing on the Internet of Things from 17-19 June at the Grange Tower Bridge and the Cloud World Forum & Big Data World Congress exhibition on 17 and 18 June at Olympia London.

Gordon Innes, CEO of London & Partners, official promoters for London Technology Week, said: "This is just another milestone for London's tech business sector and cements London's status as a global hub for the tech industry. Our capital continues to play home to some of the most inspiring businesses and the best talent in the world.

"Like London Fashion Week is for the Fashion Industry, we hope this brand new event will be a global magnet for the world's tech sector."

The capital has been urged to support and nurture growth in the digital technology sector over the next decade, with it predicted to grow by 5.1 per cent a year, generating 46,000 new jobs by 2024, Reuters reports ahead of London Technology Week.

The city already employs more people in the tech sector than either New York City or San Francisco's Silicon Valley, it is claimed.

Ronan Dunne, CEO of O2, said: "It's crucial we use this inaugural celebration of London as a technology capital to attract more young people to the world of tech. With the digital economy now vital to the UK's long-term success, offering opportunities to those who have digital skills in abundance is of paramount importance.

"If the UK is to plug its growing digital sales gap, more businesses must play their part and this week is a great time to start."

Over the course of the next few days we will be bringing you all of the news from London Technology Week, so check for regular updates over the page.

Speaking on the campaign, Johnson added: "London is already the digital capital of Europe. But that is just the beginning. We want London to be the digital capital of the world.

"To do that we need to ensure that our young people have the skills that our digital firms need and that youngsters have access to all the opportunities our amazing digital economy has to offer," he concluded.

The Cloud World Forum, the industry's most comprehensive cloud event, is taking place at Olympia London and features input from companies such as Microsoft, HP, Google and more on Tuesdays 17 June and Wednesday 18 June, and forms part of the London Technology Week event listings.

Featuring over 300 speakers for brainstorming sessions, keynotes and live demos, this year's event has focused on changes for cloud computing in business and IT.

London School of Economics professor Will Venters commented: "What some businesses want from cloud and what cloud is truly offering are different things."

He warned of comparing it to current IT in light of history demonstrating that new technologies such as the cloud can often be years ahead of the curve.

IBM's CTO in Europe, John McLean, told journalists at the event of the "new breed" of business emerging that's set to take full advantage of cloud computing. He pointed specifically to the ability to automate complex processes and interact between businesses. He said:

"We are still at the beginning of a journey. Cloud is changing the way businesses interact with their users and business partners like never before."

The concept of office-bound work was also called into question, with the increasing popularity of BYOD and mobility rendering the idea of a fixed workplace obsolete. Speaking on the topic at the Cloud World Forum, Anand Krishnan, general manager of Microsoft UK's developer platform, said:

"The workplace used to be the place where you would have access to tools far more advanced than you would at home. Technology has become a lot cheaper and the form factor has changed. There is a logical desire to bring devices into the workplace."

Enterprises should take advantage of the mobility and BYOD trends to free employees from the burden of being office-bound during the working day.

General manager of Microsoft UK's developer platform, Anand Krishnan, claims the need for employees to trek to a central office each day is obsolete, now that enterprises are increasingly becoming obsessed with mobility and BYOD.

"The workplace used to be the place where you would have access to tools far more advanced than you would at home," he said, speaking at Cloud World Forum in London. "Technology has become a lot cheaper and the form factor has changed. There is a logical desire to bring devices into the workplace."

Companies have struggled in the past to integrate new devices, according to Krishnan, losing out to the end users who were busy finding more efficient ways to use them. Now organisations are faced with not just BYOD but also BYOS bring your own service.

Employees are bringing in their own cloud services and struggling to separate home software from their business software, adding to security risks and performance issues. A strain is placed unnecessarily on the IT department, added Krishnan, as they are forced to repair issues with out-of-house hardware and software.

"Why do we ask people to fit into the paradigm of work when it no longer really exists?" he asked. "Anyone who cares will be able to know whether my car's tax is up to date using cameras, databases, license plate checks ... so why do I need a piece of paper in my window to tell people I've paid it?"

There aren't a lot of employees who feel empowered to work from anywhere for their companies. Microsoft data reveals that 47 per cent of their workers worked harder when out of the office because they felt guilt about not being at their work computer

The office should be a meeting place, believes Krishnan, where people can come in to have meetings, network and relax before going to out to do their work in a library, a coffee shop or even the car.

"Just saying that you support mobility and flexible working does not mean you are actively changing things for your employees," he continued. "Why should people have to gather in an office and just sit there from one time of day to the other?"

Microsoft has called on businesses to embrace the mobility trend and transform the way they work.

Dave Coplin, chief envisioning officer for Microsoft UK, told journalists at the software giant's "Business Transformed" event in London today that companies need to "transform from organisations to organisms."

As such, companies need to introduce a "culture of data" into businesses, he claims, before adding that complaining about increased prevalence of tech in the workplace is "insane" due to the limitless possibilities it offers. "Employees powered by mobile devices [will] treat work as an activity, not a destination," he said.

John Delaney, associate vice president at IDC, agreed. He said employees are "bringing technology into the office rather than discovering it there", while the affordability of modern technology has made high-tech devices as common at home as at work.

According to Delaney, while businesses may at times find it difficult to balance the issues of bring your own device (BYOD) policies, they should look past the risks. Europe is experiencing a plateau on the BYOD front, according to the IDC, where the number of companies refusing to implement it has remained roughly the same year-on-year.

It's not all refusals and stubborn bosses, however, as the most popular devices brought to work laptops, tablets and phones are often provided by businesses in the first place, reducing the demand. Many think twice about using their tech at work and at home once they see the reams of paperwork they need to complete, explained Delaney.

Still, companies that throw their weight behind the mobility trend will reap the benefits of increased connectivity, he argued, adding that "it's no longer about managing the risk but exploiting the benefits."

Examples of how the adoption of mobile devices has benefited organisations and the way they work was discussed at the event. They included the emergency services, who could take pictures of accidents on mobile devices, and send them back to hospitals to help them prepare for the ensuing casualties.

As part of its push to get businesses to embrace mobility, Microsoft has made no secret of its efforts to win over staunch users of BlackBerry to its Windows Phone platform.

One company that has seen its users ask for Windows support for its devices is Barclays, something that Microsoft is keen to point to in order to demonstrate its growing market share.

"As a big high street brand we are representative of the demographics of the UK," Darren Foulds, managing director of Barclay's mobile banking, told IT Pro. "We have a feedback mechanism whereby we try to implement at least 85 per cent of all customer requests. Customers demanded Windows Phone support."

The Barclays app on Windows Phone has a five-star rating and is one of the most downloaded on the Windows Marketplace. "Mobile banking is our core product," added Foulds. "It took 10 years for the company to reach four million users through traditional methods; it took just 15 months to get three million users on mobile."

SaaS giant Salesforce has overhauled its Salesforce1 mobile app, adding more than 30 new features it claims will enables users to truly run their business from anywhere - including via wearable computing devices.

The app and the Salesforce1 platform that underpins it was only unveiled six months ago at the firm's Dreamforce convention in San Francisco. However, it says now the time is right as more people are using mobile apps over desktop apps.

Launching as a beta for Windows and generally available for other platforms (any mobile browser, including Blackberry Z10 and Good Access Secure mobile browser) from July, the new app will enable various business departments to keep on top of workloads - whether that be sales, marketing or customer loyalty.

New features include being able to respond to customer social media comments or email them directly from the app.

Facebook is a hyper-connected app that has won the hearts and minds of users, according to Michael Peachy, senior director of mobile products at Salesforce. In fact, because of its vibrant ecosystem, user-friendly interface and wealth of features, users spend more than 17 per cent of their total app use time on Facebook.

This, Salesforce says, means Zuckerberg and his team have "cracked the mobile code" and it wants to do the same for the enterprise space.

"Just four per cent of our time on a mobile device is spent in productivity or business-related apps," Peachy told IT Pro.

"There is a shortage of business apps and it's really difficult for enterprises to build and customise them and roll them out to their employees. One of the reasons behind that is it's very hard to connect those apps to legacy systems."

The real draw for many businesses will be the ability to take the app and customise it into their own line of business and other systems, according to Peachy, who dubbed the new Salesforce1 as the "Swiss Army knife of apps."

"Everybody is talking about the Internet of Things, but behind every one of those things is a customer. Indeed, behind every device and every app we build there is a customer," Peachy added.

'Mobility is really at the centre of everything here. We know that there will be five billion smartphones in the market by 2017 and, according to IDC, 70 per cent of the connected device market will smartphones [by then].

"The smartphone is really becoming the dashboard to our lives. As a consumer, I can order a cab, book a restaurant, pay a cheque into my bank account... But we need to be able to do more when we're working on those mobile devices."

Salesforce1 enables businesses large and small to "sell, service, market and manage any business process from any mobile device," according to the firm.The new features set includes the ability to:

• Sell from anywhere. Sales people get access to essential reports and dashboards, in addition to easy navigation and offline data access.
• Service customers anywhere and everywhere. Knowledge, Questions & Answers, and Email and Social Case Actions are some of the new features in the Salesforce1 Mobile App that enable agents to boost customer satisfaction and service levels right from their mobile device.
• Market to customers on a 1:1 basis. Marketers can access their contacts' social, campaign and related data collateral so they can understand and engage with customers on every level.
• Connect with legacy apps and back office data. Organisations can integrate third-party apps with new Canvas functionality. In addition, new SAP connectors from Informatica and Mulesoft enable the speedy building of mobile workflows that encompass mission-critical back office data.
• Build and deploy custom apps. Firms can also build and deploy custom mobile apps for their business processes so every employee, regardless of role, can work directly from their mobile device.
• Benefit from an ecosystem of more than 65 partner apps. The new app is the gateway to an ecosystem of key partner offerings such as FinancialForce's accounting app and Kenandy's ERP app.

I hate the BYOD (bring your own device) acronym with a passion. Whenever I put my journalistic feelers out among the security industry to get some comment for an unrelated article, you can bet your bottom dollar that no matter how precisely I've described the topic I'm writing about, someone will swing it round to BYOD.

"I'm looking for someone who can talk about developments in homomorphic encryption management as it applies to the cloud," I'll say, and the response I get from some idiot PR bunny will inevitably be: "We have someone who can discuss how BYOD can be managed in the cloud". Doh!

It's a combination of buzzword bingo syndrome (where certain tech terminologies get over-hyped to the point of press release saturation) and a need to jump on the mobile bandwagon.

Bring Your Own Device is nothing new, and security problems relating to the management of mobile devices did not start with smartphones or tablets. Laptops and netbooks have been causing security headaches for years.

Of course, laptops and netbooks never became commoditised to the point employees would rather buy their own and use them at work, which is what happened first with smartphones and more recently with tablets. As such, it's hardly surprising the need to manage these devices and control the data they access has verily exploded.

Unfortunately, the main place this combustion of need has occurred is in the media, rather than the enterprise. The smaller the enterprise, the truer this becomes. Which is why it's also hardly surprising that a newly released Gartner study has revealed that nearly a third of smartphone users who bring their own devices into the workplace have suffered a security issue and didn't tell their boss.

The report reckons only 15 per cent of respondents had signed any kind of BYOD usage agreement, and a third reported their employer had no formal policy

I did the math with the percentages in the study, and it turns out 59 per cent of employees are using their own devices in the workplace with no formal agreements or controls in place. With half of the people questioned using the device at work for more than an hour a day for social and productivity tasks, the risk to enterprise security is both obvious and potentially devastating.

The timing of the Gartner survey couldn't be better, coinciding as it does with the release of a warning from the Information Commissioners Office that businesses are failing when it comes to the security basics.

These include the storing of data in widely accessible locations. Forget Bring Your Own Device, maybe what BYOD really stands for is Bolster Your Own Delusions, both from the user who can't see the harm and the enterprise that can't see beyond the hardware cost savings.

British office workers are suffering from "infobesity" an overconsumption of data that is impacting their health and efficiency at work, it has been claimed.

According to research carried out by Microsoft UK, 55 per cent of office workers in the country regularly experience information overload, with 34 per cent saying they feel overwhelmed by the amount of information they encounter at work.

When it comes to mobile devices, 40 per cent of those who use them for work said they felt under constant pressure to check the device just in case they miss something, while 45 per cent felt under pressure to respond immediately, irrespective of where they are or what they are doing.

It is perhaps not surprising then that 58 per cent of respondents admitted to checking for work messages within 15 minutes of waking up in the morning. Furthermore, 52 per cent said it was one of the last things they did before going to bed at night.

Around 30 per cent of those surveyed said this information deluge has a negative impact on their job satisfaction and on their health and wellbeing.

Dave Coplin, Microsoft's UK chief envisioning officer, who has written a book on the subject, believes businesses are tackling data in the wrong way.

Instead of dumping everything onto workers, who are then overwhelmed, technology can be used to filter information and carry out behind the scenes analytics, meaning workers only have to handle snack-size amounts of information.

This in turn gives them more room to be creative, as well as feeling empowered and in control of their workload, rather than buried by it.

"Multi-tasking is not a human trait, it is a computer trait developed by computer scientists in the 1960s," Coplin told IT Pro's sister title PC Pro.

Once both employees and their bosses realise this, the heavy lifting can be returned back to the realm of technology, through business intelligence and big data analytics, and users can start to wean themselves off the "always on" culture that permeates the Anglo-Saxon world.

"The whole point of technology is knowing when to turn it off to give you room to think or relax, and when to turn it on to help you be more effective in your role," Coplin concluded.

Cloud Pro, IT Pro and PC Pro are organising an exclusive 'Good BYOD, Bad BYOD' event on Tuesday 24 June in central London, where Dave Coplin and Paul Ockenden will be speaking.

The event is for IT managers, IT directors and CIOs who are looking for real-world best practice - and worst practice - on how to roll out BYOD policies. If you're interested in attending, register your interest here.

Businesses stuck using Windows XP beyond the 8 April end-of-support deadline should consider going down the BYOD route for IT security purposes.

That's according to Mark Brown, director of information security at advisory firm Ernst & Young, who claims a Bring Your Own Device approach to Windows XP upgrades would allow end users to leave the aged operating system behind faster.

"BYOD potentially offers a fast track to upgrading outdated systems as employees, who tend to be using new operating systems at home, can thus increase the levels of protection provided to a business IT system," said Brown.

"However, this will bring new challenges and risk as it moves away from safer, traditional enterprise IT platforms," he conceded.

Microsoft has been urging enterprise users for several years to prepare themselves for the fact Windows XP will be exiting extended support on 8 April 2014.

This means XP users will no longer benefit from security or software updates for their systems, which could potentially leave them at the mercy of hackers, viruses and performance issues.

"Hackers will use this as an opportunity to take advantage of those organisations that have not got their house in order'," warned Brown.

"Far too many businesses are asleep at the wheel over this issue and this could mean valuable consumer data could be at risk."

According to the latest figures from NetMarketShare, Windows XP is still found on just under 30 per cent of the world's desktop devices.

As a result, Brown called on the Government to do more to encourage businesses to take the prospect of XP being out of support more seriously.

"Given the scale and significance of the threat, we want to see UK government doing more to tackle this problem and raise awareness amongst business leaders of the risk imperative of cyber security," said Brown.

"With only a month to go we now really need to see urgent action being placed onto establishing the business case to upgrade to newer operating systems such as Windows 7 or 8."

With 2014 in full swing, it's time to take a look at the stories that have caught the imagination of the IT Pro community over the past few weeks.

The looming end of support deadline for Windows XP is weighing heavily on the minds of readers, as the start of the New Year has seen a flurry of comments on this topic.

So too has Gartner's predictions about enterprise adoption of BYOD policies, along with our recent article on making Windows 8.1 a more productive tool for business users.

BYOD failures

This time of year sees lots of tech analysts and market watchers make predictions. One that caught our eye was Gartner's declaration that one in five BYOD projects will fail by 2016 because they're underpinned by heavy-handed mobile device management (MDM) strategies.

Fiberlink MaaS360 (which we're guessing isn't his real name) said Gartner's predictions should convince business IT decision makers to re-evaluate their BYOD strategies.

"If these are the types of predictions being made, then it's up to businesses to start adopting and adapting new policies to deal with BYOD issues now. If the industry can evolve, then BYOD will continue to grow and flourish," he said.

However, Mark Evans, a regular IT Pro commenter, took a slightly different view, and hit out at the article's suggestion that IT departments are staffed by a load of tech-focused party poopers.

"I'm always quite dismayed when I see IT teams being [labelled] spoilsports' for wanting to apply a little due diligence to any computer which has access to corporate data," Evans wrote.

"I appreciate there is a business imperative to be 'lean' and 'agile' and any other buzzword a management consultant can palm off on you, but there seems to be an assumed position [that] IT is stopping the use of consumer-level kit just because of some warped power trip.

"It would be an extremely short-sighted CIO or IT director who would want to stymie the development of their organisation, but it would also be an extremely short-sighted one who abrogates responsibility by making the mobile environment a free-for-all."

Windows XP expiration date

Microsoft has been banging on for years about the fact extended support for Windows XP, the 12-year-old operating system that millions of business users seem to have having a tough time saying goodbye to, ends in April 2014.

However, earlier this week, Microsoft confirmed that contrary to earlier reports it was extending support for its free anti-malware Windows XP tool until July 2015.

Some readers have queried if this means Microsoft might be planning to give XP (ANOTHER) stay of execution, but the software giant has categorically denied this.

Even so, judging by some of the comments we've received about XP this week, there's definitely still a whole lotta love out there for the OS that just won't die.

IT Pro reader MJS said Microsoft could have saved itself a whole heap of trouble by allowing its OEMs to make dual boot systems, that run both Windows XP and a later version of the OS.

"All PCs should have been sold to duel boot for years," MJS jeered. "One for the much-loved XP and the other for whatever hated thing Microsoft is monkeying around with at the time."

Meanwhile, Phil Lee thinks Microsoft would be better off ending support for Windows 8 and Vista instead, because the move would affect nowhere near as many users. Ouch.

"Windows 7 will almost certainly be my last Microsoft, and I'd still be on XP if it wasn't for the fact Windows 7 Pro was included with my last hardware upgrade," Lee stressed.

"We don't need more features', we just need support for the later hardware.

"And most of us would rather not have to learn a new interface every few years. If it ain't broke, don't fix it," he added.

Windows 8.1 gets productive

IT Pro recently published a tutorial to help desktop, tablet and laptop users get the most of Windows 8.1.

As is customary with these kind of articles , readers always offer up a few suggestions of their own, and it's been no different this time around. Although, most of their tips have involved uninstalling Windows 8 all together.

Batman (AKA as Bruce Wayne, we must assume) appears to be a Windows 8 fan and described the advice to uninstall the operating system as "poop."

In response, IT Pro's tech editor Khidr Suleman aired his suspicions that the "real" Batman is an Apple Mac user and hilarity (of sorts) ensued.

"I'm pretty sure Batman uses Linux," retorted Kaemon.

"Those gadgets must be as buggy as hell then," answered Suleman. Chortle

More and more businesses are having to cope with employees wanting to use their own hardware for work. Whether it's a smartphone, tablet or laptop, BYOD presents some major challenges for IT managers. Gary Tierney, Category Director Printing & Personal Systems Group HP, explains some of the challenges and benefits of BYOD.

For more advice on transforming your business, visit HP BusinessNow

A fifth of enterprise Bring Your Own Device (BYOD) projects will fail by 2016 because of IT departments' heavy-handed approaches to mobile device management (MDM).

Gartner has made the prediction, claiming employees are wising up to the fact many MDM tools allow IT departments to access their personal information and apps.

Therefore, the market watcher is urging IT decision makers to opt for products that keep their work and personal data separate.

Even so, Ken Dulaney, vice president and distinguished analyst at Gartner, said fears about losing important data means IT departments tend to push for the strongest MDM controls available.

"Whether via a formal BYOD programme, or just via devices coming in the back door and being configured to access corporate systems, the use of consumer technologies in the work environment presents a threat to IT control of endpoint computing resources," said Dulaney.

"Given the control that IT has exercised over personal computers by developing and deploying images to company-managed PCs, many IT organisations will implement strong controls for mobile devices."

The analyst house also had some words of warning for mobile app developers who hope their offerings could put them on the road to riches.

The organisation predicts, through to 2018, that less than 0.01 per cent of consumer mobile apps will be considered a financial success by their development teams.

However, Dulaney claims few apps are designed to be profit-making, but those who are serious about making money from their offerings could be disappointed.

"The vast number of mobile apps may imply that mobile is a new revenue stream that will bring riches to many," he said.

"Our analysis shows that most mobile applications are not generating profits and that many mobile apps are not designed to generate revenue, but rather are used to build brand recognition and product awareness or are just for fun.

"Application designers who do not recognise this may find profits elusive," Dulaney added.

Another issue flagged by Dulaney is the high prevalence of high quality, free apps on the market.

"There are so many applications that are free and that will never directly generate revenue. Gartner is forecasting that, by 2017, 94.5 per cent of downloads will be for free apps," said Dulaney.

"Furthermore, of paid applications, about 90 per cent are downloaded less than 500 times per day and make less than $1,250 a day. This is only going to get worse in the future when there will be even greater competition, especially in successful markets."

With mobility, mobile devices and BYOD becoming increasingly prevelant in the office, how do you ensure that you print solutions can cope with this influx of new platforms? David Smith, CEO Landscape Printing Systems, discusses the importance of mobility and the challenges it brings to the office.

For more advice on transforming your business, visit HP BusinessNow

The number of personal devices used by Transport for London (TfL) staff to access corporate resources has increased by 500 per cent since 2010, a Freedom of Information request has revealed.

However, it also shows that over the last year adoption has started to level out. Network automation provider Infoblox made the request, which also revealed that Apple iPhones and iPads were by far the most popular personal devices among TfL staff.

In 2010, there were just 106 BYOD devices on the TfL network, which more than doubled to 242 in 2011. The following year saw a 77 per cent increase from 2011 (430 devices), but to date - in 2013 - just a 33 per cent increase has been recorded, amounting to 573 devices. Considering the number of staff working for TfL is around 28,000, the actual take up of BYOD is rather low. "Personal mobiles and tablets are becoming ubiquitous in the workplace and IT directors will need to ensure that these devices can be used safely and securely on the network," said Chris Marrison, EMEA technical director at Infoblox. "Forward thinking organisations are already putting the necessary measures in place to enable improved productivity through BYOD initiatives, whilst safeguarding the organisation's network from unauthorised access attempts which put data at risk." Last year, TfL started rolling out Wi-Fi on the London Underground network so commuters would be able to surf the internet while on platforms at selected stations.

The Government appears to be begrudgingly paving the way for public sector organisations to adopt Bring Your Own Device (BYOD) polices, with the publication of new draft guidance documents.

The End User Devices Security Guidance documents have been issued by CESG, the information security arm of UK intelligence agency GCHQ, and are designed to help public sector system admins manage personal devices trying to access their networks.

However, the advisory document seems to suggest BYOD is a trend the public sector is reluctantly having to accept.

"While enterprise ownership of a device makes many information security aspects much simpler, it is not a prerequisite of this guidance," the introductory guidance document states.

"What is necessary is that the device is placed under the management authority of the enterprise for the complete duration it is permitted to access official information.

"Hence, a BYOD model is possible, although not recommended for a variety of technical and non-technical reason," it adds.

Before devices can be used to access Government data, the document recommends a factory reset is carried out to ensure the device is in a healthy, clean state.

"The enterprise must take control of device management at the point of provisioning, ensuring that the device is placed into a known good' state prior to allowing access to official information," the document states.

"Limitations of current technology mean that a health check' or device status' check is not sufficient to verify known good' [because] malware can easily subvert such a check," it warns.

It also implores readers to carry out a pre-deployment BYOD pilot, and to establish a helpdesk facility that users can notify if their devices are lost or stolen.

In another guidance document, the organisation has also set out a series of draft security considerations for Government BYOD followers, which include recommendations about protecting device data, authenticating users, application white-listing and dealing with malware threats.

Meanwhile, the CESG has also published separate guides for the various operating systems it expects public sector employees to use, including iOS 6, Windows 7, Windows 8, Windows Phone 8, Windows Phone RT, Android 4.2, BlackBerry 10.1, Ubuntu 12.04, Apple OS X 10.8 and Google Chrome OS 26.

The documents are in beta form, and CESG has asked public sector employees for their feedback on the recommendations it makes.

In a rush to embrace the latest transformational business technologies, many enterprises unwittingly leave themselves, and their data, vulnerable to attack.

With the move to cloud computing applications and services, the shadow of Big Data looming large and the all-encompassing and ever-present mobility acronym of BYOD comes an escalating set of increasingly complex cyber-attack vectors. The potential for data breaches, business disruption and reputational damage should not be underestimated during transformational times. The good news is that secure business transformation is no pipe dream. Indeed, it's very much an enterprise reality for those who have taken the time to acquaint themselves with the risks and how best to mitigate them.

Understanding the threat

As transformation projects take shape and start to be implemented it is important that enterprise security is aligned with the business. If it isn't, IT will find itself in the undesirable position of playing catch up. The concern then is that the channels via which data is uploaded and downloaded to and from the corporate network will become a serious security blind spot.

"To ensure that this doesn't happen, organisations need to look beyond the de facto technologies such as encryption and move towards managing document access and availability through application controls," says Tom Salkield, professional services director at Integralis.

It's all a matter of balance if you think about it, as cyber criminals will look to take advantage of moments of security instability that are created when new business technology trends are being introduced. "It is imperative that organisations implement balanced cyber securities to mitigate against this period of instability," warns Dr.Jarno Limnell, director of cyber security at Stonesoft.

"The era of siloed security across the organisation is over. New approaches to security should incorporate pro active strategies seeking to process early signs of danger, build scenarios, enable live-testing, observe behaviour trends and be constantly updated with hackers' latest thinking, tools and methods." In other words, a holistic, 360 degree , 24/7 view over an organisation's entire system of networks, inventories, processes and events is required to enable standardisation and rapid security decision-making across the enterprise.

Striking a balance between digital risk and business reward is essential, but precisely what this consists of is entirely subjective to the organisation involved. It's also dependent on the amount of risk they are willing to take in order to accomplish a specific investment return Dr Limnell argues. "Business leaders need to be wary of the dangers of being blinded by technological innovation, which can potentially dilute strategies and ultimately cause detriment to business enablement and security planning," he adds.

You'll also need to keep reviewing information security at each and every step of the transformation "to ensure that the information and security triad of Confidentiality, Integrity and Availability (CIA) is maintained," McNeil adds. CIA can be defined as:

• C: Protecting information from disclosure to unauthorised parties;
• I: Protecting information from modification by unauthorised users;
• A: Ensuring the information is available to authorised users.

Getting specifically secure

The generalisations are now out of the way. But what about best practice as it applies to securing the specific business transformational technologies of BYOD, cloud and virtualisation?

BYOD

Once an employee connects their mobile devices to the office Wi-Fi, you are facing a mobile file management situation. Often organisations will take this a step further and allow them to connect to the corporate email. However, by doing this, you then become responsible for the management of the information and content that enters and leaves your company network from their device.

"There are problems when people start bringing in different devices with different security levels and features," warns Alan Laing, vice president of Acronis in Europe, the Middle East and Africa (EMEA). "For instance, some older Android devices run operating systems that are not very secure, so you can have people sharing files over the company network and sending emails to themselves. Then the device will get forgotten on the bus ride or on an airplane and you have a serious data breach."

Newer devices like iPhones or iPads do have restrictions that can be applied, such as not allowing the use of Safari, email or locking the camera. Companies are able to do this if they add a small file to the device. However, the employee has to willingly provide the device for this. "For other devices, companies can provide mobile file management solutions which enable businesses to apply their own rules," Laing adds.

"You have a remote control, which allows you to see who has an iPad or an iPhone or who has six tablets and two smartphones and so on and then you can distribute those rules to those devices."

One of the most basic restrictions an administrator can enforce is access to the server on an iPhone. You can enforce a pass code to come up as soon as someone tries to connect a smartphone or tablet. "There are also apps that manage access to corporation information on devices," Laing says.

He continues: "They can be downloaded from Apple's App Store or the Android Market (Google Play) and give employees access to the enterprise network. They start accessing share points and network resources on mobile devices within the restrictions of the application. This means that devices aren't locked, but a company is able to ensure that its employees have something efficient and that is easy to use and gives them quick and easy access. This solution stops staff being able to send themselves emails or add corporate content to Dropbox or Skydrive."

"This can be simpler than it sounds. However, it should be addressed sooner rather than later or you'll be trying to undo years of poor practice," Laing advices. Here are his five steps for IT Pro readers wanting to implement a mobile data security policy:

1. Select a platform

The first place to start is deciding which platform and devices you wish to support. Most corporations pick Android and iOS. Then you start to build your strategy based around that. Remember, the platform you choose will influence the devices you allow and want to support.

2. Select a device

You need to know what you want people to be able to do with their device inside the corporate network. Windows 8-based devices, for example, have a huge advantage because they can facilitate integration into the corporate network and ensure that all staff have a standard way to access it. However, Apple seems to be winning the hearts and minds of the average office worker currently.

3. Select participants

The next step is to think about who you want to apply the Mobile Data Security strategy to. Are you going to apply it to all staff? Will you have the same restrictions that apply to corporate devices?

4. Select what you want to share

It then needs to be decided what corporate data should be shared. MDM/MFM solutions allow users to access files securely remotely. This enables real time syncing with the corporate network whilst on the go.

5. Set a budget

The total cost involved in implementing a mobility policy quickly adds up. There is the initial cost of purchasing the mobile devices, file management and security software and then IT labour costs. In order to remain budget savvy, businesses need to work closely with value added resellers to help implement an ecosystem that covers both the MDM and MFM challenges, at the best price.

Cloud

The majority (88 per cent) of business leaders in the UK believe that they relinquish responsibility for data security when it is stored in the cloud, according research by Iron Mountain. This means cloud is a transformational technology that can leave the enterprise at risk if not dealt with properly during implementation. Christian Toon, head of information risk at Iron Mountain, provided the following seven-point plan for IT Pro readers to help reduce risk when information is moved to the cloud:

1. Find out exactly where your data will be stored, who has access to it and whether it will or could be moved. This is vital for ensuring data security and integrity. Some data, for example HR records, cannot legally be moved across international boundaries.

2. Consider the physical and IT infrastructure of your provider's data centre. How secure is the building? Where does the provider source IT equipment such as servers and cables?

3. Don't forget the people. You need to trust the people who handle your information. Does your cloud provider have a rigorous vetting processes and security training in place for all employees?

4. Look for evidence of business continuity planning. Will your data be safe if something goes wrong? Does the provider have service recovery measures in place such as failover and redundancy, or back-up generators to minimise the impact of power failure?

5. Size matters. How much data are you trying to store? Attempting large-scale restoration from the cloud can be problematic. Moving information to and from the cloud requires large bandwidth. You're better off restoring from tape if you are working with volumes in excess of 20GB.

6. Don't put all your eggs in one basket. Depending on a single solution may mean that your back-up fails when you need it most. Build a tiered-approach so that you are prepared for any eventuality.

7. Safeguard sensitive information. The cloud may not be the best option for storing highly sensitive, unique or legally restricted data such as intellectual property, HR records or financial plans.

In the case of virtualised systems, businesses often erroneously think that security is somehow built-in, or that they are protected behind the physical computer's security. It is vital that virtual systems are considered in the same way as physical servers, when developing a business security policy. Specifically, the server may be virtual, but the data is real and must be secured. This includes anti-malware protection, data encryption and proper network segmentation (i.e. to prevent a breach of one virtual network being used to compromise another) and application patching.

"There are also specific issues related to virtualisation," according to David Emm, senior security researcher at Kaspersky Lab. "One of the benefits of a virtualised system is that a server can easily be created for a specific task. This may mean that the server may be down for a period, in which time automatic security updates that apply to physical computers aren't applied to virtual systems. On the one hand, this makes anti-malware protection to cover the resulting window of vulnerability' even more important. However, the same problem applies to anti-malware protection, i.e. while the server has been dormant' it hasn't been updated."

There are also performance and management issues to consider. While traditional anti-malware protection can be applied to each virtual system, this comes with a performance overhead, as each installation will download its own updates. "When a new server is created, anti-malware protection will have to be applied and if it's overlooked, there will be a risk of infection. Therefore companies should consider using a solution that's specifically tailored for virtualised systems," Emm concludes.

In conclusion

"Security is a constant balancing act, especially when it comes to emerging technologies such as mobile and cloud that promise to unlock massive business potential," says Martin Borrett, director at the IBM Institute of Advanced Security. "Each new wave of technology requires an enterprise to adapt its security posture, or risk being left behind."

Transformational technologies that provide greater operational efficiencies and lower IT deployment costs are brilliant for businesses, but a security strategy to avoid additional risk is an essential accompaniment. As we've seen, this strategy doesn't have to reinvent the wheel but rather just ensure that it's rolling smoothly.

"My general advice would be to address the basics first, before you spend money on tools. Get the system configurations right as a good configuration will provide a significant reduction in asset risk and give good ROI as it's repeatable," says Brian Chappell, BeyondTrust's director of engineering for EMEA and India. "Ensure that any tool purchased to address an element of your IT risk portfolio covers all the systems in your environment. You aren't going to find a tool that does everything (and if you do, it's probably a jack-of-all-trades, i.e. master of none), so make sure that each tool is the best of breed and covers as much of your IT estate as possible."

Finally, make sure you understand what you are trying to solve and ensure you have a good set of use-cases to test against. Remember, IT security isn't a point-in-time activity; it's an everyday activity (or every second activity).

Chappell warns: "We have seen the aftermath of enough IT security disasters to know that while it may seem expensive to spend money to avoid the risk of something happening, the cost of not spending that money can dwarf that spend."