- Eric Klein, VDC Research
Secure workspaces, containers and identity management tools aim to solve the problems that arise when workers use the same mobile devices for business and personal tasks. These technologies have succeeded in giving CIOs the peace of mind they need to extend more mobile applications to their employees, but they aren't for everyone.
Legal and privacy concerns complicate the use of devices for business and personal tasks in risk-averse organizations, as well as in regulated industries such as aviation, finance and healthcare. For these reasons, there is a sizeable portion of the workforce that carries separate work and personal phones with them most of the time. I call them "two-pocketers," and I know many would love to ditch that second device.
That brings us to dual persona mobile devices, a compelling option that separates work and personal assets on the same phone. Dual persona technology provisions and maintains two discrete and autonomous user environments on a single device.
For a worker, using a personal device while having access to the business productivity apps they need for work is very attractive. Plus, isolation of the work persona ensures that there is no risk of corporate data leaking into the user's personal apps. Add split billing to the mix, and organizations can ensure that they are only paying for work-related voice and data usage on that device.
Heavy policies hurt dual persona
Corporate counsels have only just begun to fully understand the legal ramifications of mixing personal and business tasks on the same device and the liabilities that may arise without the appropriate policies. Generic BYOD policies that don't address specific restrictions around approved cloud services or methods for corporate network access no longer suffice. Organizations need to enforce the use of passwords and encryption, require employees to immediately report lost or stolen devices, and reserve the right to remotely lock or wipe compromised devices.
Policies should also include language inferring that employees should have no expectation of privacy around company data on the device or personal data transmitted over the company's systems (such as email). Obtaining consent to monitor data that users store, send or receive on the device is also routine. Such policies may not fly with employees using their own devices, however.
Dual persona tools offer an attractive way to deal with the comingling of personal and corporate data, but large deployments of this technology have been scarce, and there is scant evidence of user acceptance. It may fit best in corporate-owned device deployments, where businesses have the legal right to implement the security policies they deem necessary. But even then, you have to consider whether the users will bother to use the personal profile.
With all these issues around privacy and usability, the verdict on dual persona mobile devices remains largely unknown.
How dual persona works
Complete guide to dual persona options
Pros and cons of dual persona mobile devices