Getting personal again

The cellphone, the PDA, the laptop. Yours, or your employees'? Managed and controlled by you or left to the discretion of someone who may let his three-year-old run riot with a device that contains sensitive corporate data. Security risk? Definitely. Ban it outright? Definitely not. Manage it? Now there's the trick.

"Many knowledge workers," says Gartner in a report entitled: The Impact of Personal Infrastructure on the Enterprise*, "will increasingly access enterprise systems through an extensive 'personal infrastructure'. Enterprise IT departments must learn to accommodate this and adjust their policies accordingly." This is something that all IT departments are aware of. How to manage the monster, however, is not as well established.

The trick, says Gartner, lies in implementing "clear policies that are intelligently designed, regularly updated to reflect changing requirements, well communicated and consistently applied. The consumerisation of IT focuses on how enterprises will be affected and can take advantage of new technologies and operating models that originate and develop in the consumer space, rather than in the enterprise IT sector. One such current trend is for many employees to perform some (if not all) of their work from home.

As a result, most enterprises, whether they recognise it or not, are being forced to interact with personal infrastructures, which creates many issues for enterprises - some more obvious than others and some potentially more serious than others," the report says.

"While a few enterprises (such as those involved in security services and some financial institutions) might be able to justify enforcing a blanket ban on any interconnection with personal infrastructure, this is neither necessary nor sustainable for the majority of enterprises. Some level of accommodation - from toleration through active support instantiated by defined policies for acceptable use and behaviour - is a more appropriate response and will result in a more positive and responsible attitude on the part of the individual (who might otherwise be inclined to do it anyway) toward addressing the majority of the risks posed by the unmanaged devices," it notes.

Issues related to the use of personal technology to access corporate infrastructures, Gartner says, include the obvious, like security, support, regulatory issues, e-discovery and liability. Issues that organisations may not have considered include asset management, personal publishing (Web sites and blogs) and the benefits individuals receive from using such infrastructure.

On the asset management side, Gartner says: "Software licences and their control should be considered. Many end-user licence agreements restrict the use of free or personal licences for use for commercial purposes. This is somewhat of a grey area, but a potential avenue for litigation. The extent to which enterprises can scan personal infrastructure (either knowingly or unknowingly) to determine the presence of installed products is a matter for debate."

The extent to which enterprises can scan personal infrastructure is a matter for debate.

Gartner

As far as personal publishing is concerned, the report notes: "Many individuals now maintain personal Web sites and blogs, which represent a procedural extension of their personal infrastructure. If enterprises wish to impose constraints on these activities, they must ensure that these restrictions are well communicated, well defined, reasonable and consistently implemented to avoid problems. As the number of active bloggers increases, these issues must be raised and resolved at the recruitment stage rather than through disciplinary procedures at a later stage. Despite issues of security and privacy relating to corporate information, restrictions on activities increasingly likely to be regarded as normal by a digital native workforce will rapidly become public knowledge. Policies viewed in the marketplace as unreasonable or extreme will begin to impact the recruitment capabilities and market perception of the enterprise in a potentially damaging manner.

"Individuals are developing personal infrastructure for their own personal use and benefit, but if they perceive a benefit from using their own personal infrastructure for business activities, then unreasonable attempts by the enterprise to deny such usage will be viewed in a negative light," Gartner warns.

Previous Gartner research on the use of personal notebooks has shown that, although cost savings are to be found, improved employee productivity, job satisfaction and other intangible benefits are likely to be more significant.

"As personal infrastructure and infrastructure become more widespread, and infrastructure - whether personal or enterprise-owned - becomes more of a basic commodity, the question of ownership will become less of an issue. Enterprise policies must be updated to reflect the changing trends toward home working, remote access and the use of non-corporate devices. However, as regulatory oversight and concerns over security, privacy and ethical business behaviour grow, enterprises should anticipate an increasing focus on the use, security and management of confidential data. Clear policies - intelligently developed and consistently deployed - will be essential to control the risks of these trends to employees and enterprises."

* Source: Gartner, The Impact of Personal Infrastructure on the Enterprise, Stephen Prentice, 24 May 2007.