Having seen so many vendors talking about it and so many articles written about it, may make it seem like it has been around forever, but the bring your own device (BYOD) trend has only really been 'crossing the chasm' of wider adoption in the last 6-12months.

Quocirca started widely referring to BYOD over two years ago, but it first cropped up when employees in certain companies, mainly in the IT industry, perhaps most notably Intel in 2010, brought their own smartphones into the office, mostly to access email. Since then it has become a byword for anybody wanting to appear that they are up to date with mobile thinking - hence its presence in so much marketing material.

All too often BYOD is conflated with 'consumerisation', which it is an element of, but there is much more to using a personal networked device for work than the fact that it was procured as a consumer purchase. Which is why organisations need to understand what they are getting into, and why, when they rush to adopt BYOD.

Unfortunately the focus simply on devices, shiny and attractive though they are, misses the point. Whilst these are expensive tools and organisations might like to outsource the cost of them to the eager employee, it is the purposes that employees put devices to that matters.  The hope is that these tools make employees more productive and at a manageable cost to the business, without introducing it to unacceptable risks. For an IT manager, saying this and then 'crossing fingers' or 'touching wood' while they do, will not be sufficient.

A BYOD strategy is required, but as part of a wider IT strategy, encompassing remote working, corporate communications etiquette and standards etc. The most important thing to get to grips with is the 'work/lifecycle' of any and all personal technology used for work.

Anyone thinking, "we stop supplying phones and save money by letting users chose and bring their own" is being wildly over-simplistic. There are security and data protection risks with their associated costs, even if all that is being delivered is email on the move. For more complex or integrated IT applications, there may be architectural changes and this is where use of the cloud can be useful, but still requires a big shift in thinking and infrastructure.

As these are typically devices with networks and usage based contracts attached, there are direct operational as well as capital costs, which may be less transparent or easy to manage with BYOD. For example, what were once 'on net' calls within an enterprise contract, may now be between different carriers. The economies of scale of shared large data bundles could be haphazardly and uneconomically split across employees, mobile operators and Wi-Fi providers.

The worst of it is, no one will really know the true costs for some time as the lifecycle of device procurement, use, replacement and retirement is also completely fractured by BYOD. Software and firmware upgrade cycles will not be uniform across employees, who will also change, upgrade and add to their portfolio of device hardware at their own whim as finances allow.

Moving between departments or locations within an organisation might create additional strains, as the practices, hardware and applications suitable for one role may differ significantly for another. Finally when each employee leaves an organisation, the process of disentangling enterprise supported BYOD purchases, operator contracts and payments, and who has rights to which applications and data will not necessarily be easy.

'Who is liable for what', for many will not be a black or white 'corporate liable' vs 'employee liable' and it is the grey area in between that will catch out or cost organisations dearly, unless they plan 'exit strategies' for BYOD as well as adoption strategies. For more thoughts on what this might involve, Quocirca has updated and re-published its report "BYOD - who carries the can" which is available for free download.

So, it was a brave decision back in 1997 when Eugene and Natalya Kaspersky named the anti-virus company they founded, Kaspersky Lab, after themselves. The name sounds, and is, Russian and although the company now operates as a UK legal entity, it originates from Russia and many of its functions are still based there. Russia is perceived as a hotbed of organised crime and cybercrime, so why would you trust one of its companies with your online security?

In fact, compared to the examples listed in the first paragraph, Kaspersky is not widely known outside IT security circles (except in Russia itself, where it is a well-known consumer brand). There are two reasons for this. First, although its revenues, in excess of £600M, put it in the top 10 IT security companies, only the biggest are that well known, namely Symantec and McAfee (which is why the recent story about John was so widely covered).

Second is the way Kaspersky goes to market (outside of Russia). It has created a widespread network of OEMs (original equipment manufacturers) and ISVs (independent software vendors) that embed its anti-virus in their own products to provide that particular capability for their own offerings. OEMs and ISVs do not always reveal what is under the bonnet unless asked, however a long list of technology partners on Kaspersky's web site includes; IBM, Alcatel-Lucent, Cisco, Juniper, Blue Coat, Check Point and D-Link.

Such prestigious partners have underlined the pedigree of Kaspersky's anti-malware products and convinced many others to place their trust in the vendor; worldwide there are now over 400 million end-points under Kaspersky's protection. Technology partners now account for just 20% of its business with a further 30% coming from businesses across Europe and beyond via 5,000 plus resellers. The balance comes from consumers.

If Kaspersky relied on just selling anti-malware its long term future would be in doubt. As two recent free Quocirca research reports have shown, traditional IT security is no longer good enough on its own to defend against the growing numbers of targeted attacks and other emerging threats (see these links The trouble heading for your business; Advanced cyber-security intelligence). All IT security vendors have had to adapt and Kaspersky has done so with a number of additions and modifications to its product set over the years.

Bringing it all together is the Kaspersky Security Network, a global network that gathers data from over 60 million end-points from contributing Kaspersky customers, providing rapid protection by keeping all users' devices up to date with the latest information about malware and dangerous network links. However, such a capability is table-stakes for any IT security vendor and does not in itself defend against previously unseen (zero-day) threats.

So, the latest release of Kaspersky End-point Security for Business (KESB) includes a set of features designed to counter zero-day attacks. These include sandboxing, virtual keyboards, whitelisting, blacklisting, behavioural and heuristic analysis etc. The range of end-points protected has been extending to include tablets, smartphones and virtual devices. There is also an an overall device management tool to manage patching, usage policy etc.

In addition, Kaspersky System Watcher introduces a context aware security capability by combining information from Kaspersky's firewall, behaviour analyser and cloud-based reputation server to provide a broader overall risk assessment of suspected malware.

Kaspersky admits it is often not first to market but says this is to the long term benefit of its users as all of its technology is built in-house and therefore tightly integrated. Customers might not agree if they get caught out by some new threat whilst Kaspersky's innovations are still in its Lab. That said, many may be unaffected if, as is often the case, Kaspersky is used alongside other security technology.

Kaspersky is an important player in the IT security industry and with its continuing innovation it seems set to remain so. It is likely protecting your organisation against various security threats somewhere, even if you do not know it. It is one of the few Russian software companies with a global footprint and has achieved a level of trust many western business would envy; a jewel indeed.

There is a principal that internet service providers (ISPs) and governments should treat all data crossing the internet equally. It should not matter what type of device is being used, who the user is, or what site or application the data is being coming from/going to - net neutrality should mean no difference in charging models, no discriminating between the different use cases.

The arguments go back and forth as to whether this should be enshrined in legislation as a right, or allowed to drift in a competitive open market.

Despite the arguments and the capacity of technology to advance there are restrictions due to the laws of physics and certain resources that are therefore limited. This might not be too much of an issue with the massed bundles of fibre optics at the heart of fixed-line networks, but wireless networks have to balance range, capacity, power and the frequency spectrum in what is increasingly 'noisy' environment. Ideally without 'frying' anything en route.

While the resources are constrained, the boundless enthusiasm and appetite to access mobile data and applications is not. Nor, given the numbers of subscribers and devices, is the number of endpoints diminishing. In fact, with a re-awakened interest in machine-to-machine communications (M2M), or an 'internet of things', this is likely to accelerate further.

So what about unwired net neutrality?

There are already differential services that break the spirit, if not the letter, of the principal. To see how this happens consider how the way hotels have been offering Wi-Fi is changing. Initially it appeared to be a new revenue stream, but then establishments realised it was costly to get right. As more venues started to offer it, the differentiation was lost and it became a 'table-stakes' offering of free Wi-Fi once hoteliers realised that actually they really made money from renting out rooms and selling food and drinks.

Not all have reached this point yet, but the more progressive organisations have already gone a step further. They offer 'basic' Wi-Fi for free, but have a premium service that offers greater bandwidth, improved latency etc - what might be described as 'professional' Wi-Fi, compared to currently simple 'hotspots'. Basic allows a bit of email and gentle browsing, but the premium service would be good enough for consumers' IP telephony, gaming and video streaming or virtual desktops and unified communications for the enterprise user.

Then there are cellular networks. Some carriers are premium-pricing their higher speed 4G offerings compared to the tariffs on their 3G networks. Of course with differential caps on usage it also gets a little confusing as to which is the best service for an individual user. In countries where only one or a few of the mobile networks are offering 4G today, there will be rapid pricing changes as operators switch between land grab, maximising revenue and maintaining network quality modes.

Given that users have different needs - from M2M applications that might only require a few guaranteed kilobytes to video streaming gamers who need high bandwidth and low latency - there will have to be different types of services offered. Setting caps on how many minutes of communication or megabytes of capacity will be bundled and then charged for will no longer be sufficient.

Different qualities of service will need to be differentially priced. This might require application bundling, e.g. all the social media you can eat, but video is charged by the megabyte or guaranteed service levels, e.g. all gaming traffic in sub XYZ latency, but email transmitted as 'best efforts'.

It will be a real challenge for rating, billing and marketing, but there is no dark fibre in the sky and all the innovative use of spectrum has its eventual limit, which with ever more users and usage is close by. 

The superfast mobile net is unlikely to be very neutral, but that might work out to be beneficial in the long run.

Anyone with a personal mobile phone will have seen the odd big bill, perhaps as a result of roaming or with tariffs where the bundled time, text and megabytes did not match the actual usage, or maybe just too many international calls. But most people only get stung once or twice. Once they understand the consequences of their usage, they can use less hungry data apps, perhaps get a different tariff, or switch from voice calls to text.

Or just pay, after all, tariffs are getting cheaper, bundles bigger and there's always free Wi-Fi, right?

However, as soon as you introduce business use - whether on a work supplied device or a 'bring your own device' (BYOD) - the picture gets a little murky.

First who pays, and for what? In the recent halcyon days of all work related mobile devices being corporate supplied on business tariffs most businesses would deal with the contract side covering all costs with some recovering from employees the cost of personal calls, if they could identify them.

Many employees would never see their individual bills and in some organisations only the finance department would have any idea, until things got really expensive. But hey, these mobile phones boosted the productivity of traders, sales and field service people so was it really a big deal? Not really, until many mobile users appeared, usage patterns changed, bills went up, budgets became tighter and organisations started to think about telecoms expense management (TEM). There are also legislative and tax issues that surround the who pays for personal usage issue.

Now with heavy data usage and employees as consumers wanting to, willing to and doing just about everything on their personally owned mobile phones and other devices, the business/personal usage line is almost impossible to draw.

These devices typically come with Wi-Fi, so that's a free option? No, it may be free in certain quarters, but according to the latest research from enterprise mobility provider iPass, almost 60% of mobile workers have had to pay $20 or more for one-time Wi-Fi access. While some mobile and internet accounts have Wi-Fi access or minutes bundles, more often than not with a disjointed cacophony of providers, limited Wi-Fi account 'roaming' and quirky logins, much Wi-Fi usage outside the office is going to be paid for in an ad hoc manner, expensed and not tracked.

Does BYOD take the issue away? Not necessarily, as it depends whether there is BYOC (contract) as well, and even here the costs do not fall clearly.

Everything appears fine if the employee wants to pay for everything - business and personal use - on their own contract and tariff.

But that may not necessarily reduce costs overall. For a start, the organisation, especially if large or multi-national, would probably have a good deal on its corporate tariff, that personal tariffs just cannot match, so employees are likely to be paying higher rates than when contributing to business contracts.

Business tariffs will also be with one provider and might link into the fixed phone system so that 'internal' or 'on net' calls would be free or very low cost. With employees bringing their own contracts it is likely that multiple operators would be involved and inter-employee calling made more expensive than otherwise.

Employees may also balk at paying for business use or having business use take them closer to their personal data usage caps - but how are they going to claim? One off claims for Wi-FI etc. may be easy, but this is again often going under the radar from the enterprise perspective if it only shows up on expenses rather than a telecommunications budget, so not really acceptable longer term. Finally, if business use is starting to dominate then changing behaviours to limit business usage for personal cost reasons undermines the whole idea of using mobile technology to enhance productivity.

The alternative of "employee-choice with BYOD, but employer picks up the tab" is also fraught with challenges, as personal usage could go completely unchecked incurring not only a direct cost on the monthly bill, but also the indirect cost of time spent not working. This is always a risk, but if the employer is paying for everything on a personally chosen device, could easily be a big problem.

The reality is even more complex as employees will increasingly have a clutch of devices - smartphone, tablet, laptop - each with some element of work and personal use, some of which may be corporate supplied, others not. It may not be sensible or even possible anymore for employers to lock this whole situation down, but it is necessary to understand what is going on in order to keep some control of costs.

More thoughts about mobile expense management are in this recently revised and re-published Quocirca report.

Things change, but recent advances in technology coupled with social changes are changing the work/life balance, and not in the way that was once expected. Shorter days and more leisure time was a twentieth century dream for the twenty first century world of work, but the reality is somewhat different.

At one time, information and communications technology (ICT) for the working environment was only made accessible to a select few, controlled by central diktat and superior to anything you were likely to see at home. Now the complete opposite is true and consumerised IT not only extends the working day into individuals' personal lives, but also allows them choices and to bring their personal devices (BYOD) and activities - especially social communications - into the main hours of the working day.

While this blurring may not be an issue providing employees do not push too much personal activity so as to be a detriment to their work, it does create other challenges.

One in particular is related to another change, but this time instigated by the organisation. There is an increasing need to open up business applications to communicate and share information with users outside of the organisation. This includes outside the physical boundaries and the need to share with employees on the move or working from home, but also outside the corporate boundaries to contractors, third party suppliers, business customers and even consumers. The reasons for this are to improve relationships with customers, transact directly with them and to more tightly integrate the supply chain.

Organisations are themselves also increasingly using social media to do this as they feel that it will make it easier to identify, communicate with and retain customers.

The problem then is how and what to share, and will it be safe?

Up until recently the main method of sharing information remotely with anyone external would either be physical media - CD, memory stick, etc - especially for large volumes of data; or, more often for smaller volumes, email. Most organisations are relatively confident they can secure email sharing, and there are certainly many tools to support this and minimise data leakage.

Physical media is more tricky, and as mobile devices have become increasingly prevalent, this increases the physical device risk further. This might be by direct connection through USB such as memory sticks (although 'podslurping' was a term coined for downloading gigabytes to a connected iPod) or over the air through a cellular or Wi-Fi connection.

The risks this brings through the potential loss or theft of device are well known and understood, with mobile device management (MDM) protections often put in place to lock or wipe, and sometimes, though not frequently enough, through on-device encryption. There are also those who avoid data residing on the device at all through virtual connections that leave no permanent data footprints.

However, a greater risk comes from user behaviours related to the increasing use of social media - posting or sharing something 'out there' on the internet. This might be as an update to 'friends' via a social media site or a dedicated cloud storage provider.

Either way it is potentially out of sight from an enterprise perspective, as employees will be using their own preferred tools to create a Bring Your Own Cloud or Collaboration (BYOC) experience. If this casual and informal usage translates into how official or formal information is shared with third party businesses and consumers, the organisation is not in control, making the demonstration of compliance virtually impossible and increasing security risks.

It might be that enterprise IT has its own set of endorsed tools for information sharing via cloud based services, but the blurring of boundaries in employee behaviour may make the use of these difficult to enforce, especially if employees have been allowed or even encouraged to BYOD in an uncontrolled manner. One way or another, lax behaviour may need to be reined in, monitored or checked.

Mobile technologies are no exception, yet a short look back in time tells us that things are not always as revolutionary as first perceived. For a while, mobile email was something special. There were dozens of software vendors, although not typically the major email players, offering email on the move. Then there was the BlackBerry - the must-have email gadget for former-Yuppy executives looking to replace their Filofaxes. In fact, mobile email itself was so special that senior folk demanded special exceptions must be made to security policies but that only they should have it.

Now the edge has worn off, it turns out that email is just email, but you can also access it on the move i.e. while mobile. BlackBerry has lost some of its shine and the need for dedicated mobile email software vendors has evaporated. There are certain things that make mobile email more complicated - such as being careful how much is downloaded to keep data costs down and watching out for the risk of loss or theft if private attachments are on the mobile device - but these are management challenges, not reasons to say that mobile email is so radically different.

The broader needs of complete mobile working also seem to be following similar lines.

What started out as a special tool for certain roles and only with certain devices has exploded into a consumer-led boom of a huge diversity of smartphones and tablets. These devices might be operated differently with touchscreens instead of keyboards and connect over public wireless rather than private fixed networks, but they are essentially doing the same job - allowing their users to communicate and interact with data.

Extra risks occur because of the use of open and public networks, a greater variety of devices and increasingly that employees want to be told 'you can bring your own devices' (BYOD) and use them for work. These things are not necessarily unique to mobile devices and some businesses will have had employees connecting in from domestic desktop computers over the last couple of decades, but the consumer mind-set towards IT has really gathered most of its momentum from mobile devices.

The risks this varied mobile usage brings do need managing, but it is not enough to think it is simply about mobile device management (MDM), because actually the things that need protecting are sensitive assets that belong to the employer and the employees' ability to get their work done efficiently without incurring considerable extra costs.

There are several areas beyond the devices themselves that could do with further attention.

First to consider is applications. How will these be deployed, installed and correctly configured now that the concept of a standard corporate build on a standard corporate device is out of the window? It needs to be done in a simple, flexible, self-service manner, delivered over the air with enforcement to ensure critical apps are installed, and unapproved ones are not, or are at least contained. Application versions and configurations need to be managed over the complete usage lifecycle and secured for access control and data leakage prevention. The whole thing needs wrapping with tracking and monitoring of performance, usage and compliance.

The next area that most companies consider is data. The knee-jerk reaction of the most paranoid security manager will be to lock everything down and encrypt everything. Most users will rebel against this at some level if it makes work too complex or difficult, and most especially if their own BYOD phone or tablet is the device the data is on. An organisation, and it is the line of business,  not IT's responsibility, has to determine to value and risk of data in order to decide how much security to apply. Access controls based on users, roles and the capabilities or risks of classes of device might be applied; some data may be 'geo-fenced' to ensure it can only be access in certain locations, other may be only accessible from a cloud service and never residing on the device. The important thing is to ensure that the right controls can be exerted on data of known value or risk, without removing the flexibility that mobile brings - otherwise employees will work around the issue, bringing potentially great risks.

Beyond protecting those tangible digital assets, the next question is what are employees doing? For managing the mobile enterprise, this breaks into two areas of interest - behaviour and expenses. These areas might often be related and both are greatly challenged by the move to BYOD. However the relationship between employers and employees with communications technologies - desk phones, internet access etc - has always been one of trust and consequences. And if that seems to be failing, monitor what employees are doing and block things that are not allowed. Little changes.

All together, effective IT management requires an enterprise to consider all aspects - devices, applications, data and users - and apply suitable controls based on the risks. These might be elevated by mobile, but should be assessed based on value and risk to the business.

While all sorts of powerful tools can be readily deployed, it should always be remembered that their goal is to automate the hopefully sensible procedures and policies that an organisation has put in place to support its strategy. This is still true of mobile, just as it is with other technologies. Disruptive? Yes, but ultimately not that different to other innovations in that its implementation needs to fit with the business.