Main Nav

Hi, all,
I was taking a little pause on the top 10 issues, but Newton has taken us to issue #2 - Let's go with the flow, shall we?

Newton asks great questions.  Educause Issue #2  posts:

Issue #2: Supporting the Trends toward IT Consumerization and Bring-Your-Own Device

While the technology landscape has never been more personal or easy to use, it is simultaneously increasingly complex to manage and support. Faculty, staff, and students no longer need the IT organization as an intermediary in their adoption and application of the most commonly used technologies. They arrive with mature personal computing environments that they have self-configured to meet their specific needs, preferences, and styles of work and recreation. Any college or university that maintains hard-and-fast rules about which devices and communication tools must (or may not) be used risks being irrelevant. Yet the institution's data and intellectual property must be safeguarded, no matter where it is stored, transmitted, or accessed. Even the most strategic and flexible IT organization may, at times, need to be reactive. Institutions need to learn to adapt to and leverage personal computing environments, not proscribe them.

__

We started seeing an increase in BYOD a few years ago when the cost of laptops and thumb-drives dropped.  We've been open to the idea of BYOD for some time.  If protecting data is the concern, then we really are concerned about data on any mobile device, right?  Thumb-drives and other portable storage - as well as iPads, gaming systems, and smartphones.  So yes, when we look at the entire family of portable devices, we are definitely seeing an increase in the variety and numbers of devices. 

Then there's a second point:  connecting to the network.  That creates classes of BYOD:  those that connect to the network and those that don't.  The numbers of devices that are showing up with the expectation of network connectivity are increasing.  That is very challenging.  Challenge:  How do we grow and maintain the campus wireless network in a way that meets the service expectations of students, faculty and staff, and meets the objectives for mobility?  (I've written my thoughts on these challenges - http://thinkingcio.blogspot.com/2011/11/wireless-networking-challenges.html

Our policies are written to protect our assets and provide consistent quality of service, so we have polices for data protection and for network access.  I don't believe we will develop a BYOD-specific policy.

So far we've not invested in virtual desktops.  We'd like to for adding to desktop capability (like adding on virtual labs), but licensing has been a roadblock.  Our investments have centered on expanding the wireless network and improving wireless network access point density, while improving the tools we have to monitor network performance.

Look forward to the discussion -

Theresa




Comments

Message from shelf@westernu.edu

Hi All,

Interesting topic. One fascinating and amazing presentation was at a Skytalk, just this weekend, by Georgia Weidman, who worked with DARPA to develop a smartphone penetration testing framework, and has since founded a company around it (she gets to keep the IP, nice).

She also released her platform, incidentally, at a hacker conference, a tool that can be used for good or evil, but with an open source model in mind so that it improves (ostensibly for the "good guys").

What was most interesting to me is how easy it is to push a malicious app onto a smartphone, iPhones and Androids alike, and then steal the company data to which that phone is linked. Part of the security problem is a an end-user issue one, e.g., jail-breaking phones or rooting them, and then leaving the default root password unchanged. Part of it is a platform issue, e.g., most smartphones are not inherently set up with security in mind. Part of it is an organizational issue in that BYOD devices are allowed on the network, and, yet, are not tested to see if they have been or can be compromised. And finally, part of it is a market fragmentation issue, in that there are a plethora of OSes out there, especially in the Android world, and patching then all or ensuring they are all secure is highly unlikely.

Who's at fault when the president or CEO's phone dies the day before a big business trip, buys a random smart phone at Best Buy, demands it be put on the network immediately, and then that phone is compromised, along w/ the institution's private / secret data? If the phone is running an OS version known not to be secure, can the tech level one guy at the help desk tell the CEO, "No," without fear of retribution?

Fascinating topic at the high level, which, like most things with technical underpinnings, needs to be informed with the details.

More information re. this amazing talk here:


Because the recording of Skytalks is strictly prohibited, if anyone would like more information re. this talk, feel free to contact me offline, and I'll relate what I saw and heard (which is okay).

Having said that, someone posted a YouTube video here of a similar talk she gave at Security B-Sides Las Vegas 2012:


We should all be scared after watching this video. Georgia's a genius.

Thanks, Theresa, for bringing this one up!

Sincerley,

Scott Helf, DO, MSIT
CTO, COMP
shelf@westernu.edu






From: The EDUCAUSE CIO Constituent Group Listserv [CIO@LISTSERV.EDUCAUSE.EDU] on behalf of Theresa Rowe [rowe@OAKLAND.EDU]
Sent: Thursday, August 02, 2012 5:50 AM
To: CIO@LISTSERV.EDUCAUSE.EDU
Subject: Re: [CIO] BYOD policy & implementation - Issue #2 Top Ten

Hi, all,
I was taking a little pause on the top 10 issues, but Newton has taken us to issue #2 - Let's go with the flow, shall we?

Newton asks great questions.  Educause Issue #2  posts:

Issue #2: Supporting the Trends toward IT Consumerization and Bring-Your-Own Device

While the technology landscape has never been more personal or easy to use, it is simultaneously increasingly complex to manage and support. Faculty, staff, and students no longer need the IT organization as an intermediary in their adoption and application of the most commonly used technologies. They arrive with mature personal computing environments that they have self-configured to meet their specific needs, preferences, and styles of work and recreation. Any college or university that maintains hard-and-fast rules about which devices and communication tools must (or may not) be used risks being irrelevant. Yet the institution's data and intellectual property must be safeguarded, no matter where it is stored, transmitted, or accessed. Even the most strategic and flexible IT organization may, at times, need to be reactive. Institutions need to learn to adapt to and leverage personal computing environments, not proscribe them.

__

We started seeing an increase in BYOD a few years ago when the cost of laptops and thumb-drives dropped.  We've been open to the idea of BYOD for some time.  If protecting data is the concern, then we really are concerned about data on any mobile device, right?  Thumb-drives and other portable storage - as well as iPads, gaming systems, and smartphones.  So yes, when we look at the entire family of portable devices, we are definitely seeing an increase in the variety and numbers of devices. 

Then there's a second point:  connecting to the network.  That creates classes of BYOD:  those that connect to the network and those that don't.  The numbers of devices that are showing up with the expectation of network connectivity are increasing.  That is very challenging.  Challenge:  How do we grow and maintain the campus wireless network in a way that meets the service expectations of students, faculty and staff, and meets the objectives for mobility?  (I've written my thoughts on these challenges - http://thinkingcio.blogspot.com/2011/11/wireless-networking-challenges.html

Our policies are written to protect our assets and provide consistent quality of service, so we have polices for data protection and for network access.  I don't believe we will develop a BYOD-specific policy.

So far we've not invested in virtual desktops.  We'd like to for adding to desktop capability (like adding on virtual labs), but licensing has been a roadblock.  Our investments have centered on expanding the wireless network and improving wireless network access point density, while improving the tools we have to monitor network performance.

Look forward to the discussion -

Theresa




Glad to see this issue arise on this forum.

The licensing issue has been a real problem for us to figure out how to move forward with virtual labs on our campus.  I'd be interested in knowing how people are getting around or dealing with or paying for the expectations of licensing for virtual labs.  We envisioned students being able to connect (from anywhere on campus) to a virtual machine running the software that would previously have been running only on a machine in a lab.  We discovered that Microsoft expects us to pay a licensing fee for each student who could potentially connect to that software.  

Any ideas on how to virtualize cost effectively are welcome.

Bill

William Strausbaugh, Ed.D.
Associate Provost and Chief Information Officer
Messiah College
Mechanicsburg, PA 17055
717-796-5365
From: Theresa Rowe <rowe@OAKLAND.EDU>
Reply-To: The EDUCAUSE CIO Constituent Group Listserv <CIO@LISTSERV.EDUCAUSE.EDU>
Date: Thursday, August 2, 2012 8:50 AM
To: "CIO@LISTSERV.EDUCAUSE.EDU" <CIO@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [CIO] BYOD policy & implementation - Issue #2 Top Ten

Hi, all,
I was taking a little pause on the top 10 issues, but Newton has taken us to issue #2 - Let's go with the flow, shall we?

Newton asks great questions.  Educause Issue #2  posts:

Issue #2: Supporting the Trends toward IT Consumerization and Bring-Your-Own Device

While the technology landscape has never been more personal or easy to use, it is simultaneously increasingly complex to manage and support. Faculty, staff, and students no longer need the IT organization as an intermediary in their adoption and application of the most commonly used technologies. They arrive with mature personal computing environments that they have self-configured to meet their specific needs, preferences, and styles of work and recreation. Any college or university that maintains hard-and-fast rules about which devices and communication tools must (or may not) be used risks being irrelevant. Yet the institution's data and intellectual property must be safeguarded, no matter where it is stored, transmitted, or accessed. Even the most strategic and flexible IT organization may, at times, need to be reactive. Institutions need to learn to adapt to and leverage personal computing environments, not proscribe them.

__

We started seeing an increase in BYOD a few years ago when the cost of laptops and thumb-drives dropped.  We've been open to the idea of BYOD for some time.  If protecting data is the concern, then we really are concerned about data on any mobile device, right?  Thumb-drives and other portable storage - as well as iPads, gaming systems, and smartphones.  So yes, when we look at the entire family of portable devices, we are definitely seeing an increase in the variety and numbers of devices. 

Then there's a second point:  connecting to the network.  That creates classes of BYOD:  those that connect to the network and those that don't.  The numbers of devices that are showing up with the expectation of network connectivity are increasing.  That is very challenging.  Challenge:  How do we grow and maintain the campus wireless network in a way that meets the service expectations of students, faculty and staff, and meets the objectives for mobility?  (I've written my thoughts on these challenges - http://thinkingcio.blogspot.com/2011/11/wireless-networking-challenges.html

Our policies are written to protect our assets and provide consistent quality of service, so we have polices for data protection and for network access.  I don't believe we will develop a BYOD-specific policy.

So far we've not invested in virtual desktops.  We'd like to for adding to desktop capability (like adding on virtual labs), but licensing has been a roadblock.  Our investments have centered on expanding the wireless network and improving wireless network access point density, while improving the tools we have to monitor network performance.

Look forward to the discussion -

Theresa




I have just returned from Campus Technology in Boston where I attended a session by Link Alander and Oscar Ramos from Lone Star College System.

 

Their presentation was all about virtualization and VDI, and when asked, they said they had managed to work out (with their legal dept’s help) a strategy to license almost any software product they needed.

 

The presentations may be online now, but I’m not sure their licensing strategy is mentioned in the material; they answered several questions from the audience. You would get their contact information, however.

 

Ian McLeod

Director, IT Services

Camosun College

3100 Foul Bay Road

Victoria, BC   V8P 5J2

Tel: 250-370-3293

Fax: 250-370-3968

Email: mcleodi@camosun.bc.ca        

 

 

From: The EDUCAUSE CIO Constituent Group Listserv [mailto:CIO@LISTSERV.EDUCAUSE.EDU] On Behalf Of Strausbaugh, William
Sent: Thursday, August 02, 2012 11:46 AM
To: CIO@LISTSERV.EDUCAUSE.EDU
Subject: Re: [CIO] BYOD policy & implementation - Issue #2 Top Ten

 

Glad to see this issue arise on this forum.

 

The licensing issue has been a real problem for us to figure out how to move forward with virtual labs on our campus.  I'd be interested in knowing how people are getting around or dealing with or paying for the expectations of licensing for virtual labs.  We envisioned students being able to connect (from anywhere on campus) to a virtual machine running the software that would previously have been running only on a machine in a lab.  We discovered that Microsoft expects us to pay a licensing fee for each student who could potentially connect to that software.  

 

Any ideas on how to virtualize cost effectively are welcome.

 

Bill

 

William Strausbaugh, Ed.D.

Associate Provost and Chief Information Officer

Messiah College

Mechanicsburg, PA 17055

717-796-5365

From: Theresa Rowe <rowe@OAKLAND.EDU>
Reply-To: The EDUCAUSE CIO Constituent Group Listserv <CIO@LISTSERV.EDUCAUSE.EDU>
Date: Thursday, August 2, 2012 8:50 AM
To: "CIO@LISTSERV.EDUCAUSE.EDU" <CIO@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [CIO] BYOD policy & implementation - Issue #2 Top Ten

 

Hi, all,
I was taking a little pause on the top 10 issues, but Newton has taken us to issue #2 - Let's go with the flow, shall we?

Newton asks great questions.  Educause Issue #2  posts:


Issue #2: Supporting the Trends toward IT Consumerization and Bring-Your-Own Device

While the technology landscape has never been more personal or easy to use, it is simultaneously increasingly complex to manage and support. Faculty, staff, and students no longer need the IT organization as an intermediary in their adoption and application of the most commonly used technologies. They arrive with mature personal computing environments that they have self-configured to meet their specific needs, preferences, and styles of work and recreation. Any college or university that maintains hard-and-fast rules about which devices and communication tools must (or may not) be used risks being irrelevant. Yet the institution's data and intellectual property must be safeguarded, no matter where it is stored, transmitted, or accessed. Even the most strategic and flexible IT organization may, at times, need to be reactive. Institutions need to learn to adapt to and leverage personal computing environments, not proscribe them.

__

We started seeing an increase in BYOD a few years ago when the cost of laptops and thumb-drives dropped.  We've been open to the idea of BYOD for some time.  If protecting data is the concern, then we really are concerned about data on any mobile device, right?  Thumb-drives and other portable storage - as well as iPads, gaming systems, and smartphones.  So yes, when we look at the entire family of portable devices, we are definitely seeing an increase in the variety and numbers of devices. 

Then there's a second point:  connecting to the network.  That creates classes of BYOD:  those that connect to the network and those that don't.  The numbers of devices that are showing up with the expectation of network connectivity are increasing.  That is very challenging.  Challenge:  How do we grow and maintain the campus wireless network in a way that meets the service expectations of students, faculty and staff, and meets the objectives for mobility?  (I've written my thoughts on these challenges - http://thinkingcio.blogspot.com/2011/11/wireless-networking-challenges.html

Our policies are written to protect our assets and provide consistent quality of service, so we have polices for data protection and for network access.  I don't believe we will develop a BYOD-specific policy.

So far we've not invested in virtual desktops.  We'd like to for adding to desktop capability (like adding on virtual labs), but licensing has been a roadblock.  Our investments have centered on expanding the wireless network and improving wireless network access point density, while improving the tools we have to monitor network performance.

Look forward to the discussion -

Theresa



Security and BYOD seems to be a primary concerns.   Interesting current reads:

http://www.cio.com/article/712569/Can_Big_Data_Help_Universities_Tackle_Security_BYOD_
UTA and comments from our colleague Cam Beasley:
"As with other universities, we have tens of thousands of users representing an even larger population of networked devices," says Cam Beasley, chief information security officer (CISO) of the University of Texas at Austin."

http://www.infoworld.com/d/security/how-have-byod-and-security-too-197338
"The central tenet of the model is that devices with different levels of trust should have different levels of trusted data access, from none to full access." Roger A. Grimes

http://www.cio.com/article/711258/For_BYOD_Best_Practices_Secure_Data_Not_Devices
"Several different strategies are emerging to help organizations control their data in a mobile environment. One of the more popular strategies is MAM (Mobile Application Management), often associated with the creation of curated enterprise app stores. The idea behind MAM is to focus enterprise resources on managing what's really important to the business-its data-by taking charge of the apps that can access that data while leaving employees in control of the devices they own. "

http://www.eweek.com/c/a/Cloud-Computing/Data-Mobility-Security-Top-Cloud-Computing-Concerns/
"The biggest concerns of IT decision-makers dealing with public clouds are the loss of corporate data and control of data, a reflection of the known threats and risks of data leakage into the public cloud, according to a survey of more than 150 chief information officers (CIOs) conducted by storage services specialist Mezeo Software."

http://resource.onlinetech.com/byod-mobile-healthcare-policies/
Sample policies from healthcare.

http://www.eweek.com/c/a/Mobile-and-Wireless/BYOD-Initiatives-Grow-but-Security-Remains-a-Challenge-630915/
"The bring-your-own-device trend is gathering steam but posing challenges to IT departments, which are trying to figure out how to secure the various smartphones and tablets employees are using to connect to corporate networks, according to findings in OnForce’s Q3 Confidence Index, a poll that reflects the opinion of more than 500 technology service professionals."  Another view of the OnForce survey:  http://www.cultofmac.com/182733/many-companies-supporting-employee-iphones-and-ipads-ignore-mobile-security/

http://www.eweek.com/c/a/Enterprise-Networking/BYOD-Security-Management-an-Issue-for-IT-Gartner-821354/
Comments from Gartner in June

Have a nice weekend -

Theresa


Close
Close


Annual Conference
September 29–October 2
Register Now!

Events for all Levels and Interests

Whether you're looking for a conference to attend face-to-face to connect with peers, or for an online event for team professional development, see what's upcoming.

Close

Digital Badges
Member recognition effort
Earn yours >

Career Center


Leadership and Management Programs

EDUCAUSE Institute
Project Management

 

 

Jump Start Your Career Growth

Explore EDUCAUSE professional development opportunities that match your career aspirations and desired level of time investment through our interactive online guide.

 

Close
EDUCAUSE organizes its efforts around three IT Focus Areas

 

 

Join These Programs If Your Focus Is

Close

Get on the Higher Ed IT Map

Employees of EDUCAUSE member institutions and organizations are invited to create individual profiles.
 

 

Close

2014 Strategic Priorities

  • Building the Profession
  • IT as a Game Changer
  • Foundations


Learn More >

Uncommon Thinking for the Common Good™

EDUCAUSE is the foremost community of higher education IT leaders and professionals.