BYOD: 'We Have Met the Enemy & He Is Us'

When it comes to BYOD, Pogo, the central character of a long-running American comic strip, said it best: "We have met the enemy and he is us." It was 1971 when Walt Kelly penned the cartoon with the celebrated quote; Pogo, who lived in a swamp, was talking about Earth Day. Today, the same sentiment could apply to the phenomenon of bring-your-own-device to work.

Last week, Ericsson predicted that by 2019 the total number of devices subscribed to mobile networks will reach 9.3 billion, smartphone subscriptions will triple and smartphone traffic on broadband networks will increase 10 times. This should not be an earthshaking revelation for anyone in IT who has been grappling with the explosion of mobile devices in the workplace.

But the rapid and unrelenting pace of the smartphone uptake adds a new urgency to the problem. "It took more than five years to reach the first billion smartphone subscriptions," Ericsson senior vice president and head of strategy Douglas Gilstrap noted in a press release. "But it will take less than two to hit the 2 billion mark."

We already know that the issues surrounding mobile security and BYOD are complex, solutions elusive, and in some cases, surprisingly non-existent. InformationWeek’s recently released 2013 Mobile Security Survey shows that although corporate mobile security practices are improving, many security fundamentals aren’t being implemented. For example, 78 percent of respondents identify lost/stolen devices as a primary security concern, but just 28 percent require either hardware or software encryption, and only 39 percent have mobile device management (MDM) systems that could remotely wipe corporate content from a device.

In terms of BYOD policy, the vast majority of respondents -- 88 percent -- say their companies allow or will soon allow employees to bring their own mobile devices into the workplace to access corporate systems and store sensitive data. Yet only 39 percent of organizations have widely deployed MDM or other technologies considered to be an essential element in effectively managing and securing those devices.

Beyond the practical decisions about MDM or the best authentication practices for smartphones and tablets are new challenges springing from social media. Where do you draw the line between the personal and professional when social business collaboration via LinkedIn, Twitter, Google+, and Facebook is becoming an increasingly accepted -- and even encouraged -- part of the job description? How do you know if employees are watching cat videos or a substantive interview with an industry thought leader on a YouTube business channel? How do you mitigate the security risk these services introduce?

These are all issues I hope to explore with you in InformationWeek’s new security community. Just like any other community -- sci-fi nerds, sports fans, or Girl Scouts -- what binds people together are the unique memes, experiences, private jokes, and lingo that they share. Some have described that bond as a kind of secret handshake. In the coming weeks I hope to be "shaking hands" with you all as we hash over a wide range of IT security issues, everything from applications to zero-day exploits.

To kick things off, take a look at our flash poll on BYOD. We want to know your views on the best policy to manage bring-your-own-device. Your choices:

And, if you have another idea or point of view, be sure to share it in the comments so that others can weigh in.

At the end of the day, when it comes to BYOD and every other security concern, there are no easy answers. As Pogo said 40-some years ago, the enemy is "us." And it will be up to all of us -- technology experts and end-users -- to figure out what to do about it. I look forward to the conversation.