What Is Bring Your Own Device?

Bring your own device describes staff using personally owned equipment for work. It is widespread whether or not an organisation has a policy, because people read work email on their own phones.

The security problem is structural: corporate data on equipment the organisation does not own, cannot fully control, and has limited right to examine or erase.

The three approaches

Full management — enrolling the device so policy applies to all of it. Strong control, and staff resistance is considerable, because it extends organisational reach over personal equipment.

Containerisation — corporate data held in a managed workspace, separate from personal use, selectively removable. This is usually the arrangement that survives scrutiny. Access-layer control — no management at all, with restrictions applied at the point of access.

Access-layer control is the pragmatic default

Where devices cannot be managed, the controls move to what the device may reach: browser-only access with downloads disabled, no persistent session, and no offline copy.

That gives people a functioning route without extending trust to equipment you cannot assess. Conditional access is the mechanism, and the decision worth making explicitly is which applications and which data classifications are reachable this way.

The legal and consent dimension

Remote wipe of a personal device raises obvious questions about personal photographs and messages. Monitoring raises privacy questions. Examining a personal device during an investigation raises both.

Policy has to state what the organisation may do, the employee has to consent knowingly, and selective removal of only corporate data is what makes that consent reasonable to obtain. These are employment law questions as much as security ones.

Device currency is the quiet constraint

Personal devices are frequently older and run unsupported operating system versions, which cannot be made safe by any policy. A minimum version requirement enforced at the access layer is the mechanism that addresses it.

It is also the requirement most likely to generate complaints, because it effectively asks people to replace personal equipment. Where that is unacceptable, browser-only access is the compromise.

Offboarding a device you do not own

On departure, corporate data has to be removed from equipment that leaves with the employee. Containerisation makes this a single action; without it the options are a full wipe, which is disputable, or trusting the individual.

Which is a strong practical argument for the container approach regardless of the other considerations, since the alternative is a problem with no clean answer.

Corporate-owned personally enabled, as the alternative

Providing the device and permitting reasonable personal use inverts the problem: the organisation owns the equipment, so management, wipe and monitoring rights are clear, and the consent difficulty largely disappears.

It costs more in hardware and removes most of the legal ambiguity. For roles handling sensitive data it is frequently the cheaper option overall once the cost of controlling data on equipment you do not own is accounted for.

Where to start

Establish whether corporate email and data are currently reachable from an unenrolled personal device with a persistent session. In most organisations they are, and that is the exposure.

See securing the remote workforce. GuardsArm delivers zero trust security.