united-kingdom england-and-wales
Would using a wired BYOD device to connect to a corporate network be considered a breach of the BYOD policy? - United Kingdom
<p>I connected my laptop to one of the ethernet ports at work, having signed a BYOD policy allowing me to bring my own devices to work. The document never explicitly said that I couldn't connect my device via the wired network.</p>

<p>I have my account suspended and am facing being banned from bringing my own devices into work with me.</p>

<p>The argument that the sysadmin made was that I could have introduced malware and other viruses onto the network if my antivirus wasn't up-to-date.</p>

<p>Should my account be suspended and should I be banned from BYOD?</p>

<p>Your company is free to allow you to use your own devices in the workplace and connect them to their networks. In most places in the world, including the UK, they would also be allowed to not to allow you to use your own devices in the workplace and connect them to their networks, or set up conditions that you have to meet to get the permission. </p>

<p>If you have a sysadmin at your company cancelling your account claiming that you violated a policy, then this isn't a law issue but a workplace issue. He is allowed to do this if the company allows it. If you are supposed to have violated a policy that didn't exist, that would seem unfair and something to sort out with your manager and his manager. if he closes your account and that keeps you from doing your job, and the reason is that he is a little man on a power trip, then this is definitely something to sort out with your manager and his manager. So this really belongs on workplace.stackexchange. </p>

<p>From legal point of view ... I think you should obey whatever BYOD policy states. IT department knows which parts of their network are more secure and which are less secure. If desired access method for BYOD devices is not explicitly mentioned in BYOD policy then I would say that <strong>IT department needs to improve communication with employees</strong>. You don't have to figure out on your own which parts are secure and which are not. Also, if IT department is smart enough they could automatically enforce this "legal requirement" by configuring their Ethernet switches to drop traffic from unknown source MAC addresses as first layer of defense to prevent accidental BYOD policy violations (of course MAC address can be changed, but this would imply that you know what you are doing).</p>

<p>From technical point of view ... Authentication and Internet Packet filtering security <strong>could be implemented differently for wireless and wired access methods</strong>. This means that sometimes Wireless access method could be safer (for example, if over wireless you are required to use VPN Gateway that can filter <em>all</em> unwanted traffic and run anti-virus "in the cloud"). However, sometimes wireless can be less secure if they don't have VPN gateway and solely depend on WiFi authentication that is unsafe. There are other variables that could effect security, but it is hard to judge without knowing how network is configured in your company. Where I am going with this is that, if your company has reasonable upper-management you could try to escalate this issue to them. However, you will need to argue from security point of view why you are right and network admin is not. This would require you to understand how IT department has wired up network in your company.</p>

<p>From relationship point of view ... As another person pointed out in a comment, sometimes it is better to apologize and say that you did not know about this BYOD requirement. You have to understand that network admin and you will be working in the same company for some time. You don't know when your paths will cross again.</p>

<p><em>Also, I would be really careful about disclosing too much information about your company's IT configuration publicly.</em></p>
