2

I connected my laptop to one of the ethernet ports at work, having signed a BYOD policy allowing me to bring my own devices to work. The document never explicitly said that I couldn't connect my device via the wired network.

I have my account suspended and am facing being banned from bringing my own devices into work with me.

The argument that the sysadmin made was that I could have introduced malware and other viruses onto the network if my antivirus wasn't up-to-date.

Should my account be suspended and should I be banned from BYOD?

  • 1
    This isn't a legal question, is it? Your company can say how employees connect to the network, if at all, especially if in compliance with written policy. Have you talked to HR? – Patrick87 Dec 11 '15 at 18:18
  • Question: Did the document expressly permit you to connect your devices to the wireless network? Comment: You are probably more likely to have a favorable outcome if, instead of being argumentative, you react by apologizing and saying that you were acting in good faith, unaware that connecting to the wired network was not covered by the BYOD policy. – phoog Dec 11 '15 at 21:10
  • Not to mention that your sysadmin is an idiot. Connected is connected; if he doesn't have the same security on wired as wireless ports then he is a fool. – Dale M Dec 11 '15 at 21:19
  • 2
    @DaleM Actually it is quite common practice to have different policies for Wireless and Wired connections. I work in one big tech company in Palo Alto and we have Wired (has access to internal resources) and Wireless (unsecured, requires VPN to have access to internal resources). The Wireless+VPN option asks you to use RSA token each time to authenticate. – Jonny Dec 11 '15 at 21:58
  • @DaleM the wireless network may be intended for, and therefore configured for, guest access. – phoog Dec 12 '15 at 1:20
0

From legal point of view ... I think you should obey whatever BYOD policy states. IT department knows which parts of their network are more secure and which are less secure. If desired access method for BYOD devices is not explicitly mentioned in BYOD policy then I would say that IT department needs to improve communication with employees. You don't have to figure out on your own which parts are secure and which are not. Also, if IT department is smart enough they could automatically enforce this "legal requirement" by configuring their Ethernet switches to drop traffic from unknown source MAC addresses as first layer of defense to prevent accidental BYOD policy violations (of course MAC address can be changed, but this would imply that you know what you are doing).

From technical point of view ... Authentication and Internet Packet filtering security could be implemented differently for wireless and wired access methods. This means that sometimes Wireless access method could be safer (for example, if over wireless you are required to use VPN Gateway that can filter all unwanted traffic and run anti-virus "in the cloud"). However, sometimes wireless can be less secure if they don't have VPN gateway and solely depend on WiFi authentication that is unsafe. There are other variables that could effect security, but it is hard to judge without knowing how network is configured in your company. Where I am going with this is that, if your company has reasonable upper-management you could try to escalate this issue to them. However, you will need to argue from security point of view why you are right and network admin is not. This would require you to understand how IT department has wired up network in your company.

From relationship point of view ... As another person pointed out in a comment, sometimes it is better to apologize and say that you did not know about this BYOD requirement. You have to understand that network admin and you will be working in the same company for some time. You don't know when your paths will cross again.

Also, I would be really careful about disclosing too much information about your company's IT configuration publicly.

  • Thank you for this, I have actually emailed and apologized and cc'ed in my manager, so all good now ;-) – user3715 Dec 11 '15 at 22:56
0

Your company is free to allow you to use your own devices in the workplace and connect them to their networks. In most places in the world, including the UK, they would also be allowed to not to allow you to use your own devices in the workplace and connect them to their networks, or set up conditions that you have to meet to get the permission.

If you have a sysadmin at your company cancelling your account claiming that you violated a policy, then this isn't a law issue but a workplace issue. He is allowed to do this if the company allows it. If you are supposed to have violated a policy that didn't exist, that would seem unfair and something to sort out with your manager and his manager. if he closes your account and that keeps you from doing your job, and the reason is that he is a little man on a power trip, then this is definitely something to sort out with your manager and his manager. So this really belongs on workplace.stackexchange.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.