In short
BYOD security covers the policies and controls that protect organisational data on personally owned phones, tablets and computers. The NCSC recommends five actions: set objectives and risks, develop a policy, understand costs, choose a deployment approach (browser, remote desktop, device or app management) and put technical controls in place, such as MFA, app protection and mobile threat defence.
Get a quote for BYOD security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What BYOD security means
The NCSC defines bring your own device (BYOD) as employees using their personally owned devices for work purposes: the organisation owns the data and services accessed from the device, but the device belongs to the user.
That ownership split is what makes BYOD security different from managing company devices. You cannot simply impose full control, because the owner has a reasonable expectation of privacy and may refuse. As the NCSC's BYOD guidance puts it, it is really the concept of device management that is key: how far the owner will let you manage the device. If staff accept full management of their own device, it effectively becomes a corporate device and normal controls apply. Most will not, so BYOD security relies on protecting the data and the access rather than the whole device.
A well-designed scheme matters for another reason the NCSC highlights: if the approved approach makes work difficult, people find their own ways round it, and that shadow IT is usually riskier than the scheme you were trying to avoid.
BYOD security risks
The NCSC lists the broad challenges: keeping devices and owners compliant with policy, supporting many device types, protecting corporate data and infrastructure, protecting the owner's privacy, and meeting legal and contractual obligations. In practical terms the main risks are:
- Data left on the device: email, downloaded files and cached data stay on a device you cannot wipe completely, including after someone leaves.
- Compromised or out-of-date devices: personal devices may be unpatched, jailbroken or rooted, or carry malicious apps, and you have little visibility.
- Phishing and smishing: staff read work email and texts and approve MFA prompts on the same phone they use for everything else.
- Data moving into personal apps: copy and paste, personal cloud storage and backups can take organisational data out of your control.
- Lost and stolen devices: personal devices are lost like any other, and may have weaker screen locks.
- Shared devices: family members may use the same laptop or tablet.
- Unclear responsibilities: without a policy, nobody knows what the organisation may see, do or wipe.
The NCSC's five actions for BYOD
The NCSC structures its guidance as five actions. They are a sound framework for any organisation, whatever its size:
| NCSC action | What it involves |
|---|---|
| 1. Determine your objectives, user needs and risks | Why you want BYOD, who needs it, what data they will reach and what could go wrong; whether alternatives such as company devices fit better |
| 2. Develop the policy | What users and the organisation each agree to: acceptable devices, minimum security, what the organisation can see and do, support, leavers and incidents |
| 3. Understand additional costs and implications | Licences, support for many device types, legal and privacy considerations, and the effect on staff and work-life balance |
| 4. Deployment approaches | Choosing how personal devices reach data: web browser, remote desktop or apps, device management, app management or a hybrid |
| 5. Put technical controls in place | The controls that enforce the policy for the chosen approach, tested before full rollout, plus training for users |
The NCSC also advises penetration testing your chosen solution before it is deployed widely, and training users on risks such as jailbroken or rooted devices and the need to keep devices and apps up to date.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What a BYOD security policy should cover
Your BYOD policy can be a section of your wider endpoint security policy or a separate document that staff accept before enrolling. It should cover:
- Eligibility: which roles may use personal devices, and for which data and services
- Minimum device requirements: supported operating system versions, a screen lock, no jailbreak or root, updates applied
- How access works: the approved apps or methods, MFA, and whether a device must be enrolled or just the apps managed
- Privacy boundaries: exactly what the organisation can and cannot see on the device, and what it can wipe (work data only, or the whole device)
- Acceptable use: no copying work data into personal apps or storage, no sharing work access with family members
- Loss, theft and leaving: what the user must report and when, and how work access and data are removed
- Support: what IT will and will not help with on a personal device
- Monitoring and security software: any app the user must install, such as mobile threat defence, and what it collects
Be honest and specific about privacy. Staff are far more willing to install security software on their own phone when they know what it does not see.
Deployment approaches compared
The NCSC's Action 4 describes several ways for personal devices to reach organisational data, each with different strengths and weaknesses:
| Approach | How it works | Strengths | Weaknesses |
|---|---|---|---|
| Web browser | Users sign in to cloud apps through the browser | Simple and versatile access | Some data is stored on the device; low assurance about its security; checks can be put in place but not reliably enforced |
| Remote desktop or virtual apps | Users see a remote view of corporate apps or a desktop | Minimal data stored on the device; MFA and simple compliance checks; focus on systems you control | Still exposed to malware on the device; poorly configured remote desktop is an attractive ransomware target; needs a stable connection |
| Bootable operating system | A managed operating system started from bootable media on a home computer | The NCSC calls it the lowest-risk way to enable home PCs for BYOD | More complex to set up; may need firmware changes; still relies on the underlying hardware |
| Device management (MDM) | The personal device is enrolled for management | More assurance than app management alone; controls enforced at platform level | Some device controls are not appropriate for BYOD; owners may reject stronger controls |
| App management (MAM) | Only work apps are managed and protected | Controls limited to work data; selective wipe; usually more appealing to users | Relies on good configuration; a compromised device can undermine the app's controls |
| Hybrid (MDM and MAM) | Partial device management with most work data in a managed container | Manages more of the risk of container apps | Users may have to accept more control of their device |
For many organisations, app-level protection on phones and a browser or remote desktop approach for personal computers gives the best balance. Forever Group's mobile device management service covers enrolment and app protection policies.
Is BYOD security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Technical controls for personal devices
Whatever approach you choose, these controls do most of the work:
- Strong authentication: MFA on every service personal devices can reach, and sign-in risk checks where your identity provider offers them.
- Device compliance before access: block access from devices that are out of date, jailbroken or rooted. See zero trust endpoint security.
- Work data separation: managed apps or containers that stop copying work data into personal apps and let you remove work data without touching personal content. IBM MaaS360 Deluxe, for example, containerises email and chat to separate business and personal data.
- Mobile threat defence: protection against phishing, malicious apps, risky networks and device compromise. Lookout states that it collects only the data needed to detect and remediate threats and can de-identify user data, which helps on personal phones. See mobile threat defence solutions.
- Remote removal of access: the ability to revoke access and remove work data when a device is lost or someone leaves.
- Limited exposure: give each user only the services they need on a personal device.
Other mobile security options we can supply include Sophos Mobile and Check Point Mobile Security, and our sister site covers Lookout mobile security in more depth.
BYOD and Cyber Essentials
Personal devices that access organisational data or services are in scope for Cyber Essentials, unless they are used only for native calls, native texts or an MFA app. That means they must meet the same controls as company devices, including supported and updated software and malware protection. Our sister site explains the Cyber Essentials BYOD requirements and how home working affects scope.
How we help
We can help you work through the NCSC's five actions, draft a BYOD security policy staff will accept, choose a deployment approach for phones and computers, and supply the security tools behind it, with pricing confirmed at quote.
Contact us to talk about BYOD security for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is BYOD security?
BYOD security is the set of policies and technical controls that protect organisational data when staff use their own phones, tablets or computers for work. Because the organisation does not own the device, it focuses on controlling access and protecting work data rather than managing the whole device.
What are the main BYOD security risks?
The main risks are organisational data left on devices you cannot fully control, unpatched or compromised personal devices, phishing and smishing on phones, work data copied into personal apps, lost or stolen devices, shared family devices and unclear responsibilities when there is no policy.
What should a BYOD security policy include?
It should cover who may use personal devices and for what, minimum device requirements, how access works, privacy boundaries and what can be wiped, acceptable use, what to do when a device is lost or someone leaves, support arrangements and any security apps users must install.
Do I need MDM for BYOD?
Not necessarily. Many organisations protect personal phones with app management, which manages only work apps and data, rather than enrolling the whole device. The NCSC describes browser, remote desktop, bootable operating system, device management, app management and hybrid approaches, each with trade-offs.
Are personal devices in scope for Cyber Essentials?
Yes, if they access organisational data or services, unless they are used only for native calls, native texts or an MFA app. In-scope personal devices must meet the same controls as company devices. Our Cyber Essentials site explains the detail.
How do I protect personal phones without invading privacy?
Use app-level protection to separate work data, and choose mobile threat defence that is designed for personal devices. Lookout, for example, states that it collects only the data needed to detect threats and can de-identify user data. Tell staff clearly what is and is not visible.
Still have a question about BYOD security?
Ask us and a member of our team will reply by email.