The "Bring your own device" conundrum for organizations and investigators: An examination of the policy and legal concerns in light of investigatory challenges

Abstract

With the expansion of technology and the desire to downsize costs within the corporate culture, the technology trend has steered towards the integration of personally owned mobile devices (smartphones) within the corporate and enterprise environment. The movement, known as "Bring Your Own Device" (hereinafter referred to as "BYOD"), seeks to eliminate the need for two separate mobile devices for one employee. While taken at face value this trend seems favorable, the corporate policy and legal implications of the implementation of BYOD are complicated by significant investigatory issues that overshadow the benefits of utilizing BYOD. In this paper, we set a context for the BYOD conundrum, then examine associated corporate policies, highlight the limitations to the digital investigator's reach regarding digital evidence and review the investigatory challenges presented by BYOD. We conclude by offering recommendations such as implementing proper policies/procedures, utilizing Mobile Device Management, corporate owned devices, and enforcing agreements.

Systematic Literature Review on Security Access Control Policies and Techniques Based on Privacy Requirements in a BYOD Environment: State of the Art and Future Directions

“…To address these risks, organisations can effectively manage BYOD usage by implementing security access control and security policy technologies that address these vulnerabilities and obstacles [6]. However, there are significant gaps between the security offered by current BYOD access control policies and the desired outcomes [7]. Rhee et al [8] provide fundamental access control policies that address security and privacy issues in three primary categories: authenticity, confidentiality, and integrity.…”