Sound Networks IT Support
Sound Networks IT Services
IT Support
Managed IT Services
Cyber Security
AI
Insights
Company

Request free IT audit

This site uses cookies for functionality and analytics Manage Close

Cyber Security

The hidden risks of BYOD

Most small businesses didn't make a conscious decision to let staff use their own phones for work.

It just happened. Someone set up work email on their phone one evening, someone else started sharing files over WhatsApp, and before long client data was sitting on half a dozen devices that nobody had documented anywhere. That's the silent side of BYOD (bring your own device). The risk is rarely one dramatic breach. It's a collection of small gaps, most of them invisible until something goes wrong. Here are the ones we see most often.

The phone left on public transport

Lost and stolen phones get plenty of attention, and they should. But the phone isn't really the problem. What's on it is. A personal phone with work email, Teams and a cached copy of the shared drive can hold months of client conversations and attachments. If there's no agreed way to remove that data, you're relying on whoever finds the phone to do the right thing.

Business data in the personal cloud

This one catches a lot of people out. Many phones back up automatically to personal accounts such as iCloud, Google Drive or Photos. Attachments saved to Downloads, screenshots of client dashboards and files opened in personal apps can all end up in those backups. You might cut off access to the business account, but copies can survive in places nobody thought to check.

Shared family devices

Work phones are rarely shared. Personal ones often are. A partner borrows a phone to check a recipe, or a child plays a game on the family tablet that's also signed in to work email. Nobody is doing anything wrong, but the device has quietly become a way into company systems for someone who isn't on your payroll.

Work in personal apps

People reach for whatever is quickest. Client files get sent through a personal WhatsApp group. Documents get emailed to a personal address so they can be finished at home. Spreadsheets get saved to a personal drive. Each of these moves data out of the systems you can manage and into the ones you can't.

The leaver problem

When someone leaves, most businesses disable the work account and assume the job is done. But disabling an account doesn't delete files that have already been downloaded to a personal phone or laptop. Without an agreed process for checking devices on the last day, a former team member may still be holding your client list.

Devices that have stopped getting updates

Old phones and laptops are a regular source of trouble. Manufacturers stop issuing security updates, but devices keep working, so they stay in use. Nobody notices the gap until a problem turns up.

The pushback problem

Here's a risk that isn't technical. When security rules feel like they're reaching into someone's personal life, people push back on them. They worry about being monitored, having their photos seen or losing their own device. Rules that feel heavy-handed get worked around, and then you're left with all the risks above and no visibility at all. You're now into Shadow IT territory. The fix is to be clear about what the business won't touch, as well as what it needs to protect. People sign up to rules that protect them too.

Problems beyond control of office data

Cyber insurers and schemes such as Cyber Essentials increasingly ask how you control devices that access company data, personal ones included.

Start with a written policy

A BYOD policy is the starting point. It sets out what's allowed, what you need from staff and what you will never look at. Writing one from scratch takes longer than most people expect, so we've put together a free template to help you get started.

Watch Guard network security partner
Datto ticketing and management system
Huntress security partner
Dell Technologies and services
Hyper-V routing technologies
BitDefender defending your hardware
Microsoft 365 professional services
3CX VoIP phone systems
Veeam partner
Signable partner
Cyber Essentials Certification
Power Automate automation workflows
GTIA
Watch Guard network security partner
Datto ticketing and management system
Huntress security partner
Dell Technologies and services
Hyper-V routing technologies
BitDefender defending your hardware
Microsoft 365 professional services
3CX VoIP phone systems
Veeam partner
Signable partner
Cyber Essentials Certification
Power Automate automation workflows
GTIA
Need Help?