Det blir allt vanligare för de anställda, att använda sina privata enheter som smarttelefoner eller surfplattor för användning på sina arbetsplatser. "Bring Your Own Device" (BYOD) är ett koncept för att ansluta arbetstagares enheter till företagets nätverk och datorer. BYOD-lösningar involverar säkerhetsrisker, t.ex. när information överförs till eller lagras på privata enheter. Användarens sätt att hantera enheten kan också medföra risker, exempelvis i form av virus, lösenordsskydd och sättet att hantera information som finns på enheten. Denna uppsats fokuserar på att hitta rekommendationer om hur verksamheterna ska gå tillväga för att undvika eller förebygga de största säkerhetsriskerna i en BYOD-lösning. Stora säkerhetsrisker har identifierats utifrån en teoretisk studie. Några exempel på risker är, användarnas beteendemönster, Wi-Fi-anslutningar och risker vid förlust av en enhet. Sex intervjuer har sedan gjorts med olika organisationer för att få en översikt över BYOD-lösningar som används idag. Intervjuerna tillsammans med de teoretiska upptäckter, har resulterat i 40 rekommendationer om säker hantering av BYOD. Dessa rekommendationer handlar bland annat om, att användarna får en utbildning i ett säkert användande, att se över informationssäkerheten, att använda en säkerhetslösning på applikationsnivå och att upprätta en policy för BYOD. Rekommendationerna ger förutsättningar för organisationer att undvika risker med BYOD. / Employees are increasingly using private devices like smartphones or tablets for use in their workplaces. “Bring Your Own Device" (BYOD) is a concept for connecting employees´ devices to company networks and computers. BYOD-solutions involve security risks, e.g when information is transferred to, or stored on private devices. The user's way of handling the device may also pose risks for example in the form of viruses, password protection and the way to manage the information available on the device. This paper focuses on finding recommendations on how businesses should proceed to avoid or prevent the largest security risks in a BYOD solution. Major security risks are identified from a theoretical study. Some examples of risks are user behavior patterns, Wi-Fi connections and loss of a device. Six interviews have then been conducted with different organizations to get an overview of BYOD solutions in use today. The interviews together with the theoretical findings have resulted in 40 recommendations on BYOD security. These recommendations is among other things about, training users in a safe usage, to review the information security, using a security at the application level and to establish a policy for BYOD. The recommendations provide opportunities for organizations to avoid risks with BYOD.

Le phénomène du Prenez vos appareils personnels (PAP) représente une tendance lourde sur le marché du travail. La pression vient plutôt du côté des employés, les employeurs étant la plupart du temps à la merci des choix de leurs employés en termes d’appareils et d’utilisation. Cette recherche étudie le PAP à travers la théorie institutionnelle pour mieux comprendre le PAP dans l’organisation en tenant compte du point de vue de l’employé et de l’employeur et en expliquant comment il est vécu. Neuf thèmes ont émergé de l’étude de cas à l’aide d’entrevues semi-dirigées : l’aspect pratique, la distinction entre la vie professionnelle et la vie personnelle qui s’effrite, la dépendance aux appareils, le stress, la liberté, la productivité, la sécurité de l’organisation, le besoin d’une politique pour encadrer le PAP dans l’organisation et le coût. Cette étude jette les assises d’une recherche sur une politique organisationnelle pour encadrer le PAP.

The bring your own device (BYOD) phenomenon has proliferated, making its way into different business and educational sectors and enabling multiple vectors of attack and vulnerability to protected data. The purpose of this multiple-case study was to explore the strategies information technology (IT) security professionals working in a university setting use to secure an environment to support BYOD in a university system. The study population was comprised of IT security professionals from the University of California campuses currently managing a network environment for at least 2 years where BYOD has been implemented. Protection motivation theory was the study's conceptual framework. The data collection process included interviews with 10 IT security professionals and the gathering of publicly-accessible documents retrieved from the Internet (n = 59). Data collected from the interviews and member checking were triangulated with the publicly-accessible documents to identify major themes. Thematic analysis with the aid of NVivo 12 Plus was used to identify 4 themes: the ubiquity of BYOD in higher education, accessibility strategies for mobile devices, the effectiveness of BYOD strategies that minimize risk, and IT security professionals' tasks include identifying and implementing network security strategies. The study's implications for positive social change include increasing the number of users informed about cybersecurity and comfortable with defending their networks against foreign and domestic threats to information security and privacy. These changes may mitigate and reduce the spread of malware and viruses and improve overall cybersecurity in BYOD-enabled organizations.

Research conducted by Tech Pro (2014) indicated that the Bring Your Own Device (BYOD) concept is gaining momentum with 74% of organizations already having some BYOD program or planning to implement one. While BYOD offers several benefits, it also presents challenges that concern information technology leaders and information security managers. This correlational study used the systems theory framework to examine the relationship between information security managers' intentions, perceptions of security, and compliance regarding BYOD implementation. Participants of the study consisted of information security managers in the eastern United States who had obtained the Certified Information Systems Manager certification. Data was collected from 94 information security managers through a survey instrument. The survey instrument integrated three other instruments with proven reliability developed by other researchers. Data was analyzed using a multiple regression analysis to test for a relationship between the variables of the study (security, compliance, and intent to implement BYOD). The multiple regression conducted in this study was insignificant indicating a relationship did not exist between the study's variables (F(2, 86) = 0.33, p = .718, R2 = .00). A significant negative relationship was found between security and compliance indicating a weakly negative correlation (r = -.26, p = .016). Using the results from the study, information technology leaders may be able to develop strategies from which to implement BYOD successfully. Implications for social change include increased knowledge of securing personal devices for employees and consumers in general and reduction in costs associated with security and data breaches.

Något som har blivit en stor fråga på sistone där arbetsgivare tvingats ta ställning är huruvida anställda har tillåtelse att använda sina privata enheter på arbetet eller inte. Användandet av smarta telefoner och surfplattor i privatlivet har på bara några år ökat relativt drastiskt. I och med detta så har viljan också blivit större bland arbetare att kunna utnyttja sina privata enheter även i arbetslivet. Detta fenomen kallas för Bring Your Own Device och implementationen av detta kan orsaka vissa problem och kan exempelvis påverka nätverkssäkerheten. Arbetet ämnade, att genom en enkätundersökning, undersöka hur pass vanligt det var att man tillät privata enheter i arbetet bland Sveriges kommuner och landsting. Det ämnade även undersöka vilka skyddsåtgärder som hade utförts för att skydda den resterande delen av infrastrukturen om man valt att tillåta BYOD. Resultatet från enkätundersökningen visar på att frågan ofta har lyfts bland organisationerna. Däremot har de oftast valt att inte införa BYOD på grund av olika anledningar såsom säkerhet, kostnader och brist på resurser. Har organisationerna istället valt att införa BYOD så har enheterna oftast separerats från de övriga nätverket på grund av säkerhetsskäl. / An ongoing question which have been brought into consideration lately is whether employees should be given the permission to bring their own devices to their jobs or not. The numbers of people using smartphones and laptops have been growing and with that, the will to make use of those devices at work. That phenomenon is called Bring Your Own Device and the implementation of it can cause network security related problems. This essay was written with the intentions to find out how many of the municipalities and counties that have allowed people to bring their own devices. The intentions was also to investigate which security actions that have been taken into consideration when securing the rest of the network from the brought devices. This was performed by sending out a survey. The result that the survey gave proves that BYOD have often been taking into consideration among the organizations. It also proves that many have chosen to not implement the phenomenon because of reasons like problem with the security, the costs, and the lack of resources. An overrepresented majority of the organizations who have chosen to implement it have decided to have the private devices in a separate network to secure the rest of the network infrastructure.

The security policies of mobile devices that describe how we should use these devices are often informally specified. Users have preferences for some apps over others. Some users may avoid apps which can access large amounts of their personal data, whilst others may not care. A user is unlikely to write down these policies or describe them using a formal policy language. This is unfortunate as without a formal description of the policy we cannot precisely reason about them. We cannot help users to pick the apps they want if we cannot describe their policies. Companies have mobile security policies that definehowan employee should use smart phone devices and tablet computers from home at work. A company might describe the policy in a natural language document for employees to read and agree to. They might also use some software installed on employee's devices to enforce the company rules. Without a link between the specification of the policy in the natural language document and the implementation of the policy with the tool, understanding how they are related can be hard. This thesis looks at developing an authorisation logic, called AppPAL, to capture the informal security policies of the mobile ecosystem, which we define as the interactions surrounding the use of mobile devices in a particular setting. This includes the policies of the users, the devices, the app stores, and the environments the users bring the devices into. Whilst earlier work has looked on checking and enforcing policies with low-level controls, this work aims to capture these informal policy's intents and the trust relationships within them separating the policy specification from its enforcement. This allows us to analyse the informal policies precisely, and reason about how they are used. We show how AppPAL instantiates SecPAL, a policy language designed for access control in distributed environments. We describe AppPAL's implementation as an authorisation logic for mobile ecosystems. We show how we can check AppPAL policies for common errors. Using AppPAL we show that policies describing users privacy preferences do not seem to match the apps users install. We explore the differences between app stores and how to create new ones based on policy. We look at five BYOD policies and discover previously unexamined idioms within them. This suggests aspects of BYOD policies not managed by current BYOD tools.

Ineffective deployment of mobile technology jeopardizes healthcare quality, cost control, and access, resulting in healthcare organizations losing customers and revenue. A multiple case study was conducted to explore the strategies that chief information officers (CIOs) used for the effective deployment of mobile technology in healthcare organizations. The study population consisted of 3 healthcare CIOs and 2 healthcare information technology consultants who have experience in deploying mobile technology in a healthcare organization in the United States. The conceptual framework that grounded the study was Wallace and Iyer's health information technology value hierarchy. Data were collected using semistructured interviews and document reviews, followed by within-case and cross-case analyses for triangulation and data saturation. Key themes that emerged from data analysis included the application of disruptive technology in healthcare, ownership and management of mobile health equipment, and cybersecurity. The healthcare CIOs and consultants emphasized their concern about the lack of cybersecurity in mobile technology. CIOs were reluctant to deploy the bring-your-own-device strategy in their organizations. The implications of this study for positive social change include the potential for healthcare CIOs to emphasize the business practice of supporting healthcare providers in using secure mobile equipment deployment strategies to provide enhanced care, safety, peace of mind, convenience, and ease of access to patients while controlling costs.

Bring Your Own Device (BYOD) phenomenon is important in the healthcare environment because this growing trend is totally changing the workplace landscape in healthcare organizations, such as British Columbia (BC). The organizations need to be proactive and aware of this trend to decide the best way to approach this phenomenon. Currently, there is little current research that exists in Canada in context to provide a distinct understanding of the complexities and difficulties unique to this phenomenon within the nursing practice. In order to develop an understanding of BYOD in healthcare workplace, a perspective was needed of those experiencing the phenomenon of interest. The premise of this research was to explore the BYOD phenomenon from the nursing perspective. This study focused on the experiences, views, and perceptions of nurse executives/managers about how they make decisions regarding use of personal handheld devices in the workplace. A qualitative description was undertaken and the collection of data involved telephone interviews in which participants were asked to reflect on their views and/or experiences regarding BYOD in the workplace. During the literature research process, the researcher discovered that there were similar research studies previously done in the early 2000s that found early healthcare organizational concerns with the use of personal digital assistant devices (PDA) in the clinical setting. In this study, four major themes emerged that provided an insights as to how nurse NEx/M make decisions regarding BYOD. The four major themes included: 1) management perspective, 2) opportunities, 3) disadvantages, and 4) solutions. The results of this study will aid in bringing greater awareness of BYOD to other executives and managers in nursing and should also provide information to the leaders throughout the healthcare organizations and health IT department. / Graduate

Submitted by Automa??o e Estat?stica (sst@bczm.ufrn.br) on 2017-04-17T21:38:09Z No. of bitstreams: 1 MarcosPauloDaSilva_TESE.pdf: 5717561 bytes, checksum: 79eed29f2011f51218a5d93114dd58e7 (MD5) / Approved for entry into archive by Arlan Eloi Leite Silva (eloihistoriador@yahoo.com.br) on 2017-04-19T18:39:53Z (GMT) No. of bitstreams: 1 MarcosPauloDaSilva_TESE.pdf: 5717561 bytes, checksum: 79eed29f2011f51218a5d93114dd58e7 (MD5) / Made available in DSpace on 2017-04-19T18:39:54Z (GMT). No. of bitstreams: 1 MarcosPauloDaSilva_TESE.pdf: 5717561 bytes, checksum: 79eed29f2011f51218a5d93114dd58e7 (MD5) Previous issue date: 2016-12-20 / O presente estudo busca compreender de que forma usu?rios e gestor de Tecnologia da Informa??o (TI) adotam pr?ticas de Bring Your Own Device (BYOD), ? luz dos princ?pios da teoria Effectuation. No referencial te?rico, desenvolvem-se discuss?es sobre o contexto da consumeriza??o, suas aplica??es e implica??es para as organiza??es e indiv?duos, a abordagem da teoria Effectuation, o racioc?nio effectual, seus princ?pios e o processo. Trata-se de um estudo explorat?rio-descritivo, utilizando o m?todo misto de pesquisa ? qualitativo e quantitativo ? por meio de um estudo de caso ?nico, do qual participaram 42 usu?rios e o gestor de TI de uma empresa que atua h? 49 anos no setor varejista/atacadista de Natal/RN. Para a an?lise dos dados coletados junto aos usu?rios de TI, utilizou-se a estat?stica descritiva, regress?o log?stica (bootstrap), correla??o de Pearson e teste U de Mann-Whitney, com o aux?lio do software Statistical Package for the Social Sciences (SPSS) vers?o 21. Para a an?lise da entrevista concedida pelo gestor de TI, utilizou-se a an?lise de conte?do categorial ? an?lise tem?tica ? com o aux?lio do software ATLAS.ti, vers?o 7.5.15. A pesquisa mostra, por meio das metainfer?ncias, que existem diverg?ncias entre a ado??o das pr?ticas de BYOD pelos usu?rios de TI ? perfil effectual prevalente ? e pela empresa, representada pela gestor de TI ? perfil causal ? considerando que os aspectos da gest?o voltados para a mitiga??o de imprevistos, seguran?a da informa??o e o controle para o uso com foco no trabalho v?o de encontro ? perspectiva dos usu?rios de TI, de que por meio das pr?ticas de BYOD ? poss?vel uma atua??o aut?noma e dirigida ? inova??o, em raz?o da explora??o das conting?ncias e a realiza??o de parcerias com colegas de trabalho e/ou clientes e/ou fornecedores. No entanto, usu?rios e gestor de TI convergem em rela??o ? perspectiva sobre os benef?cios para as atividades da organiza??o, no que diz respeito ? satisfa??o dos funcion?rios, ? melhoria do atendimento aos clientes e ? realiza??o de parcerias para a ado??o, visto que o gestor percebe como uma parceria a disponibiliza??o da infraestrutura de TI organizacional para que os funcion?rios possam utilizar seus pr?prios aparelhos. Conclui-se que a realiza??o de parcerias engloba a ocorr?ncia de intera??es entre os usu?rios e o gestor de TI, o que potencializa a a??o humana na constru??o da ado??o das pr?ticas de BYOD, sobretudo quando o altru?smo inteligente se faz presente. Deve-se destacar que, na gest?o da ado??o, se dever? considerar o n?vel de escolaridade do usu?rio e a perspectiva de que a ado??o das pr?ticas ocorre em virtude da possibilidade dos aparelhos serem usados em qualquer lugar, conforme os modelos logit, a fim de otimizar o atendimento das demandas da maior parte dos usu?rios de TI da empresa. / The following study seeks to comprehend in which way Information Technology (IT) users and manager conduct the adoption of Bring Your Own Device (BYOD) practices, under the light of Effectuation theory principles. The theoretical framework brings discussions on the context of consumerization, its applications and implications for organizations and individuals, the Effectuation theory approach, the effectual logic, its principles and process. This is an exploratory-descriptive study, which uses both qualitative and quantitative research methods by means of one single case study, in which took part 42 users and the IT manager of a company that has been operating for the last 49 years in the retailer/wholesaler sector in the city of Natal/RN. Descriptive statistics, logistic regression (bootstrap), Pearson correlation and Mann-Whitney U test were used for the analysis of the data collected from the IT users, along with the aid of the Statistical Package for the Social Sciences (SPSS) software, version 21. Categorical content analysis ? thematic analysis ? was used for the analysis of the interview granted by the IT manager, with the support of the ATLAS.ti software, version 7.5.1.5. The research evinces, by means of metainferences, the existence of divergences between the adoption of BYOD practices by IT users ? effectual profile prevalent ? and by the company, represented by the IT manager ? causal profile. The management aspects concerning unforeseen events mitigation, information safety and control enforcing the used towards work activities go against IT users? perspective, which assume that, by means of BYOD practices, it is possible to attain an autonomous and innovation-biased performance, due to contingencies exploration and the establishment of partnerships with coworkers and/or clients and/or suppliers. Nevertheless, both IT users and manager converge regarding the perspective towards the benefits to the organization activities, in terms of employees? satisfaction, to the improvement of customer?s services and to the realization of partnerships for the adoption, since the IT manager perceives the availability of IT infrastructure by the company so that the employees may use their own devices as a partnership. It is concluded that the establishment of partnerships encompass the occurrence of interactions between the used and the IT manager, which enhance the human action upon the construction of BYOD practices adoption, especially when intelligent altruism is present. It must be highlighted that, in the adoption policy, the user educational level and the perspective that these practices adoption occur due to the possibility of the devices being used anywhere must be considered, according to the logit models, in order to optimize the meeting of the demands from most IT users of the company.

Syftet med denna studie är att få en grundläggande kunskap kring begreppet bring your own device. Eftersom ämnet är väldigt nytt och att det finns en viss okunnighet kring begreppet är det intressant att ta reda på varför BYOD är en uppgående trend, hur svenska verksamheter tänker inför tillåtandet, vilka krav som ställs och vilka problem som följer. För att komma fram till dessa slutsatser har intervjuer genomförts på tre olika verksamheter. Varav en verksamhet har tagit sig an BYOD och de andra två planerar inför tillåtandet av BYOD. Det har även genomförts intervjuer på både unga studenter, unga i arbetslivet samt en jurist för att få en tydligare bild av företeelsen. Resultatet visar att fördelar med BYOD är kostnadsbesparingar, flexibilitet och nöjda anställda. Däremot finns det vissa säkerhetsrelaterade problem samt juridiska problem med BYOD. Sådana problem kan handla om äganderätt, osäkra nätverk, obehörig åtkomst och frågor kring abonnemang. Många av dessa problem kan däremot förhindras genom att verksamheter skriver en policy som är speciellt framtagen för BYOD.