1

As I try to come up with company regulations for IT security, the question arose if employees can use their company provided iPhones 8 for personal matters. Specifically they want to install spotify (and probably other apps like instagram, whatsapp and so on), so they don't have to own another smartphone. I know there are mobile device management tools that can block certain apps, but I am not sure if it is necessary to block such apps security wise.

What are the security concerns one has to think about when allowing employees to use their company iPhones privately and what restrictions does an employee have if they use only their company phone (e.g. can they log in with their own apple ID)?

3

The typical concerns are about 3rd party tracking, malware, and information disclosure.

Apps can gather and transmit an incredible amount of data about the user and the phone. All this data might expose the company and its users to 3rd party analysis. There was a recent case where a secret military base was discovered because personnel were using the same running app, which tracked their runs around the base using GPS.

Without any controls over what's installed, it is possible for apps to contain or be a gateway for malware. Restricting apps to approved, well-known apps helps to prevent this problem.

When using any device for mixed purposes (personal/business) it can be difficult for people to keep its use consistent, which can lead to inappropriate sharing of information. It can also lead to company data being saved in personal accounts (their Apple ID/iCloud storage), which you have no control over, even if the person leaves your company.

Is all this bad? That's not for us to tell. You need to perform a risk assessment to determine if the risks are acceptable and the cost/benefit of allowing this freedom.

"But people could use their personal phone to do all this, too!" Yes, that's right. Restricting phone use helps to prevent inadvertent issues (mistakes) or "drift" in the separation of personal/business, which can cause problems for the company. How much of a benefit this is to you is a matter for your risk assessment.

Personally, I prefer to enforce different devices for different purposes so that people can remember what they are using the device for. And maybe one shouldn't post that whiteboard with future plans on Instagram...

I would also promote the idea of permitting certain personal apps on company devices so that their use can be risk assessed. Like Spotify. The risk is likely low, but the benefit in employee experience will be high. And the Security Dept doesn't become the "Department of 'No'". The goal is always to say "yes", but to do so responsibly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.