123

I just got a new job at a medium-sized (~100 employees) company and one of the first things I was told is that I cannot use my own computer, because I need to be able to connect to their network, access files, etc. I didn't think that made much sense because to my knowledge, as long as I'm on their network, I should be able to access anything I need to.

So I asked my friend this question, who told me it might be a security thing. Could there be a security-related reason as to why I'm required to use my employer's machine?

Stevoisiak
  • 1,515
  • 1
  • 11
  • 27
Marcus McLean
  • 1,249
  • 2
  • 8
  • 8
  • 270
    This is standard practice – wim Oct 13 '15 at 01:24
  • Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/30410/discussion-on-question-by-marcus-mclean-is-there-a-legitimate-reason-i-should-be). – Rory Alsop Oct 18 '15 at 17:13
  • @wim is it? I have never seen it, especially in small-sized companies like that one – njzk2 Aug 31 '16 at 20:20

12 Answers12

252

So this is an interesting question with a few points into why you not only should WANT to do this, but should do this for your own safety and security. It helps first if you understand that companies point of view before we talk about how it can benefit you.

Why would a company want to do this?

Many reasons. It makes it assured that your computer can access the network, do what it needs to do, and function how they need it to at a baseline. This way the IT department can maintain it easily, quickly, and up to standard.

Can they make me do this?

YES THEY CAN! They are having you work on their property, with their property, to make sure it works properly. This way you can actually do your job.

Should I do this?

Oh god yes.

  • This lets you pass the buck if needed. Now if something that is supposed to work, doesn't work, it isn't your fault.
  • Maintenance becomes a breeze because if your files are backed up to a safe place (any installers you used as well), then if something really bad happens they can restore it to a disk image and have your computer back to you in the matter of a few hours instead of days.
  • IF you leave the company for any reason, you don't have to relinquish your personal computer to them for driver scrubbing or making sure you don't take any company software or intellectual property with you.
  • IT has no claim to touch your personal computer for any reason.
  • For security reasons, you can make sure that your work computer is up to their standards and any potential breach won't be your fault, but their bad policies' fault.

And here's the whammy: It keeps you safe from the company!

In using the company computer your own personal information won't be on the company network, and you can keep your private life away from your work life. This is a big advantage because you can make sure that your own data, is your own data.

Community
  • 1
Robert Mennell
  • 6,968
  • 1
  • 13
  • 38
  • 80
    this and how do they know your machine isnt riddled with viruses? – Keltari Oct 13 '15 at 03:59
  • 21
    @Keltari They don't. Just like they don't know if their own machines are riddled with viruses. – CodesInChaos Oct 13 '15 at 08:23
  • 28
    They usually put in stringent user access to prevent common viruses from getting on your machines. Removing admin level access can prevent a LOT of damage. – Nelson Oct 13 '15 at 09:26
  • 3
    The little alliteration in the third paragraph is straight out of a prophecy! – corsiKa Oct 13 '15 at 16:20
  • 3
    the OP does not mention Active Directory. – njzk2 Oct 13 '15 at 17:46
  • 2
    @njzk2 should show that the active directory is an example of something that would require a lot of setup that they might not want to do by hand. – Robert Mennell Oct 13 '15 at 17:51
  • 1
    There was nothing about AD or even Windows in the question and from my experiences few companies of that size use that AD feature. But nevertheless the whammy is totally right! Often company computers are less secure than private ones of tech guys! – Arne Burmeister Oct 14 '15 at 06:16
  • 1
    In addition to only using the company computer on their network, you should also not use your personal accounts on that computer, except maybe some social media if those are allowed (and even then, consider only consulting those on your smartphone during breaks or downtime). – Nzall Oct 15 '15 at 11:57
  • 2
    You are, of course, assuming that corporate IT is on the ball. I've more than once had to e.g. arrange my own backups, with company owned and managed machines. And then there was the infestation of viruses a personal machine once caught from the corporate network ;-) (The rule there was that if I installed their software, I could use a personal machine for remote access - but could only instal the software from within their network.) – Arlie Stephens Oct 15 '15 at 20:31
  • 2
    @ArlieStephens What you described is covered by the breech being their fault. If a virus appears on their network, then they didn't do their job right, and you kept your computer safe from the breech by not using it. – Robert Mennell Oct 15 '15 at 21:20
  • 2
    You *should* *not* use a company network or machine for *any* personal communication. Big employers can and will scan what you do on the internet and read your encrypted traffic as per http://security.stackexchange.com/a/63306/45960 Progressive large employers typically provide a 'personal wifi' where you can only connect out to the internet which is not intercepted for you to do personal shopping and personal email on your own device. If the same employer has a remote desktop solution you can sit at the office on your own laptop VPNed into your work virtual desktop but why bother. – simbo1905 Oct 16 '15 at 19:28
  • 3
    Depending on the industry, it may be the case that the employer is /required/ to take your device if there's a lawsuit of some sort. The legal system is often a bit behind on how technology works, so some areas require that, when a hold order is placed, the whole original device be held rather than just an image. So, the company takes your computer- personal files and all - and gives you whatever the current value is. And you agreed to that when you clicked through or signed that stack of papers you didn't read. – dannysauer Oct 17 '15 at 20:47
152

As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy.

I do NOT want your equipment on my network, ever. I can't control it, I have no insight into how patched it is, how virus-ridden it is, and I do NOT want you to keep company data on your personal device when you leave.

The sheer number of things that have gone horribly wrong when an employee comes in on the weekend with their personal laptop so they can do personal stuff on it while working on their work laptop makes me shudder. One laptop was a host for 4 different botnets and the owner didn't even know it. My network knew it, though, when the bots started scanning and probing my network.

In the end, you need to ask your IT Security department these questions. They will be happy to describe in detail why their policies are the way they are.

schroeder
  • 123,438
  • 55
  • 284
  • 319
  • Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/30326/discussion-on-answer-by-schroeder-is-there-a-legitimate-reason-i-should-be-requi). – Rory Alsop Oct 15 '15 at 20:00
  • 1
    As long you give a decent machine to your developers, I agree with that point of view. Unfortunately I see in many places, companies with a lot of benefit (they have money) still giving poor machines and make their developer frustrated because they loose productivity because such policies (and proxy policies as well) – рüффп Dec 24 '16 at 15:52
  • @ruffp it is *not* the responsibility of a company to give their devs the most convenient machine *for the devs*. This entitlement attitude is why devs bring in their machines in the first place against policy. As I said in the 'extended chat' above, if the company wants the devs to write code entirely on paper, then that's the choice that is made. There are consequences, sure, but the tools used are for the convenience of the company, weighing multiple factors that don't always involve the dev. – schroeder Dec 24 '16 at 21:37
  • @shroeder If the development is on site and under the full responsibility of the company, then: "Yes it is" except if they want to loose money... after all if you find computer programmers willing to program with `vi` and only that why not. Just I think it is not a good management decision. – рüффп Dec 24 '16 at 22:36
  • @ruffp my point is that management has far more to consider than just the preferences of the devs. – schroeder Dec 25 '16 at 07:56
  • how is this different of the other answers? Yet another "me too" answer. –  May 17 '18 at 00:53
51

In addition to all the other reasons given:

Software licences. You and other employees need certain programs to do your work. These programs are usually licensed for a limited number of users.

The company want to control this and the easiest way is by controlling the machines. Letting employees install these programs on their own computers would be both a practical and legal mess.

Community
  • 1
Stig Hemmer
  • 2,403
  • 10
  • 14
  • It depends on whether the employees need any licensed software or not. Sometimes they do, sometimes they don't. Not everyone is a software developer you know; increasingly for sales/ mktg/ admin employees, all that is needed is a browser (to connect to SaaS, SalesForce etc.) and maybe a free Office/Word/PowerPoint clone (e.g. LibreOffice). – smci Oct 14 '15 at 09:10
  • 6
    @smci I'd say that has nothing to do with the job title of the employee. It's about the software that the company has selected, and the type of licenses. I'm a software developer, and use 100% open source software and libraries. Conversely, the majority of people I know who work in admin use Microsoft software (Windows / Office, etc.). – Jon Bentley Oct 14 '15 at 13:07
  • 1
    @JonBentley: I said it was about the job function, not the title. The fact is there are large categories of people who don't develop or test software or IT systems; their only needs are a browser and an office suite; both of which are free these days. In startups making or using SaaS, noone wants to pay a Microsoft tax of $150-400 per seat or $100/seat/year. Your comment *"The software that the company has selected, and the type of licenses"* is increasingly irrelevant in SaaS. Sales & Marketing people typically only need a browser and seat of SalesForce (or similar SaaS CRM product). – smci Oct 14 '15 at 21:30
  • I have never met a Sales or Marketing person who needed a license of anything, other than a seat of some SaaS CRM tool (e.g. SalesForce/ SugarCRM), an antivirus subscription and occasionally a seat of Atlassian Jira and/or a license of some proprietary calendar/meeting scheduler. – smci Oct 14 '15 at 21:34
  • 5
    @smci Hi. I was in marketing a while ago. I needed a license for Adobe Creative Suite. We've now met. Sort of. – Martin Oct 14 '15 at 22:10
  • @MartinCarney: did you do your own graphic design? for documents? – smci Oct 14 '15 at 22:16
  • @smci I was the graphic designer for my current employer's marketing department before transferring to programming. I made ads in many formats both digital and physical. – Martin Oct 14 '15 at 22:20
  • @MartinCarney: ok so you were more than a typical marketing person. So "Only SW developers/testers, IT people, DBAs, graphic designers... typically require non-trivial amounts of licensed software, not sales & mktg, admin & general". – smci Oct 14 '15 at 23:40
  • @smci You never met a single sales or marketing person that used neither outlook (I guess you can get by with the browser UI or thunderbird, but still), onenote, powerpoint (ok that one I really can't believe) nor Word/Excel (that one doesn't surprise me that much with Libreoffice being a pretty good replacement)? – Voo Oct 17 '15 at 00:01
  • @Voo: yes I only ever knew a few startup people who used Outlook, and none **on a personal machine** . SaaS people tend to use gmail+GoogleDocs, and that works seamlessly across mobile+desktop. Or LibreOffice (Impress) to view presentations; and *rarely* PowerPoint on an office PC to write them. I'm surprised at the people claiming incredulity that cash-strapped startups no longer pay $150-400/seat/year "tax" for basic functionality. As to MS OneNote, I have never seen anyone anywhere use it for anything, ever. I'm aware users of it exist, but evidently not many in small startups. YMMV. – smci Oct 17 '15 at 00:49
  • @smci you need to go out and meet more people :) I've worked at companies where marketing peeps need access to scrapers so that they can see how they're SEO efforts are doing of links are still active, some of these scrapers have network licenses. And some marketing people run SQL queries against slave/dev databases to run reports without waiting for a dev, and some of them require licenses to enterprise-grade SQL/Postgres clients. – ILikeTacos Oct 22 '17 at 14:57
  • @ILikeTacos: I know lots of people ;-) Startups rarely run on Microsoft stack, and small startups tend not to even have dedicated salespeople (just CEO/COO/CTO). And I specifically mentioned SaaS. Also, around 2012, Google Docs/gmail made big corporate inroads in traditionally Outlook turf, especially progressive areas like SaaS. YMMV – smci Nov 11 '17 at 03:06
16

It's a fairly standard corporate security policy to only allow company-owned rather than personal devices to access the company network.

Your corporate PC is typically only used for approved activities, covered by firewalls virus checkers and so on.

Your personal PC, in contrast, is not under the control of the company, often won't have anti-virus software installed, and who knows what dodgy software you may have downloaded. Therefore there is significantly more risk allowing you to connect a personal PC to the corporate network.

A separate issue is data protection. If your corporate network has sensitive data on it, which you copy onto your PC, which you then take home, there is more risk that data might leak because there's more risk your PC may be stolen for example.

In contrast to all this, "Bring your own device" is a common request from users, particularly for mobile devices, to IT departments are under pressure to reconcile these conflicting requirements.

Chris Denning
  • 271
  • 1
  • 3
11

It's my understanding that many companies prefer to restrict access to their own hardware so that they can better ensure proper security procedures. For example, suppose that company policy specifies every employee must use full-disk encryption. If employees were allowed to use their own personal machines, it seems quite likely that someone would forego encrypting their disk because it slows down their machine, or because they never get around to it, etc. Similarly if they want to enforce policies such as VPNs for Internet access, prevent less-secure versions of various software (e.g. web browsers) from being used, etc.

Of course, in practice, this frequently results in many employees' machines being less secure than they ordinarily would have been, because the IT department is chronically understaffed and overworked, or doesn't care enough, or whatever. (Example: I once ran into a company machine that was restricted to Internet Explorer 6 because nothing newer had been "certified" by internal IT. This was in 2011.) But the idea is often very appealing to higher-ups in management.

The "so you can access our network etc." excuse sounds like it might be something they tell employees who are less tech-savvy to avoid argument. "So you can access our network" is a lot easier to understand than "So that we can ensure your hard disk is properly encrypted."

This is, however, pure speculation. Having never worked at such a company, I have very little first-hand evidence. Everything I say is based off second- and third-hand information.

Joseph Montanaro
  • 510
  • 2
  • 8
  • 5
    "So you can access our network" really means "So you satisfy all security requirements we enforce when granting access to our network". – Dan Henderson Oct 13 '15 at 21:45
  • 1
    I actually think this an excellent answer - my experience is that IT departments are often dysfunct, understaffed and backwards basement dwellers who spend more time asserting their power and to little time helping users. That combined with the fact that most IT deparments are in bed with the worlds leading provider of insecure operating systems make me sceptical at best. – papirtiger Oct 20 '15 at 11:51
9

In addition to what has already been mentioned: if you own the equipment, you walk out with it when the job ends. Should the device contain importand data for the company, it becomes a major problem.

Had this issue once. There will not be BYOD in my company. Never again.

Tero Lahtinen
  • 267
  • 2
  • 6
5

In addition to what all other good answers highlighted, a company may ask you to work with their computer only to ensure that you invest your time in working and not in something else. This is particularly useful to monitor workers' productivity and efficiency especially in a period where the company faces hard times and needs to be sure of taking advantage of its full resources before taking the decision to recruit more workers and whom to fire. As a matter of proof, we hear from time to time cases of a worker who got fired from his/her job for spending lot of time on using Facebook at workplace.

Also, depending on the company you are working in, a company may need to monitor your machine's activities to protect itself from economic espionage.

And there are so many other reasons why it is not good for the company to let you use your own personal computer at workplace: the day you will get fired and feel it's unfair, you may take revenge by infecting their network or even more (this is not a fiction, but it happens)

Note that even if that is the standard as it was commented below your post, not all companies follow that.

4

Most company computers are hardened and updated regularly. They also contain AV and other SW to prevent and detect malware and other malicious attacks. By plugging your personal computer into their network you are providing an attacker with a system that is not as secure as the one they provide. Even if you believe your computer is more secure, it is up to the company to approve or deny such requests. A final reason would be, companies track where their information goes. By using a personal computer you could be exfiltrating their data (patents, ideas, proprietary SW...) and they wouldn't be able to track this. If you decide it is worth the risk, be prepared for the consequences. If you do decide to bring your computer to work, don't connect it to their network.

Jacob loves Rockstar
  • 43
  • 6
4

The best, and clearest response I can think of is:

Your computer is legally your property. Unless a person has a warrant for the data on your computer, they cannot access it. They cannot control it. They have no easy legal way to get the data back and certainly wouldn't have access to who may have been a recipient of it through your willful or unwillful actions. Not without at least expending some major $$ on an attorney for warrants, subpoenas possibly court, litigation, prosecution. I think you can see where this is going.

All the above, which are great answers, aside; Why would a company want to give anyone their knowledge base, and potentially leave themselves open to litigation down the road?

The example of: You take your personal computer into work with you as you're working on a Saturday to get caught up. Let's say in between your work, you want to access your favorite remodeling show, and chat with your neighbor about the next home improvement project.

As innocent as this sounds, technically you're breaking corporate policy and could be fired for 'stealing' bandwidth or violating policy or any number of corporate policy's that fall under the "I have read this document and agree to its terms" which we never, or rarely read.

Technically, you are 'stealing' bandwidth. It is their network and you're accessing it without express permission on a day when you don't have express permission to even be on the premises. Or at least that could be their argument if things got sticky.

Ben
  • 3,697
  • 1
  • 18
  • 24
Elaine Ossipov
  • 57
  • 2
  • 12
    The answer is fine until `As the corporations...`. The rest is off-topic and inappropriate for this site. – Neil Smithline Oct 13 '15 at 04:57
  • 2
    I think you should also make clear which jurisdiction the legal framework you describe belongs to - I know at least one, where this is not true. – Gerhard Oct 13 '15 at 08:10
  • 4
    What does the Fourth have to do with the question? I mean, why are you assuming that the OP is working/living in the United States? – ypercubeᵀᴹ Oct 13 '15 at 13:09
  • @ypercube why do you assume they're not. If they edit a country tag in, some answers will become out of date; but if we were to limit answers to those that only cover things that are true in every jurisdiction, they'd be woefully incomplete in almost all of them. If we limited answerers to people who know the laws well in numerous jurisdictions, we'd massively reduce the number of people who can answer. – Dan Is Fiddling By Firelight Oct 13 '15 at 14:43
  • 2
    @DanNeely I didn't make any assumptions, the answerer did. – ypercubeᵀᴹ Oct 13 '15 at 17:01
  • 2
    On the flip side - documentation at my company indicates that if my personal device contained company data, that fact would cause my personal device to become legally subject to forfeiture in the event of any legal proceedings. (e.g. if a client sued the company, a warrant could be issued for all the data about that client. If an email discussing that client is on my phone, I'd have to turn my phone over to the courts.) This is given as a reason they do **not** want employees using personal devices for company business. – Dan Henderson Oct 13 '15 at 21:51
  • 1
    +Neil Smithline, Sorry if that offended you. I felt it was On Topic because it is both legally and ethically in question with many legal proceedings, not the lest of which is TPP, TTiP, Net Neutrality, all of which affects the aspects of many employees and the liberties corporations can take imho, in violation your human/civil rights. However, having said that, if you feel it is not appropriate, I can modify, my statement if this is a requirement of the board. Applying references goes to credibility and provides a comprehensive knowledge base for the reader. – Elaine Ossipov Oct 14 '15 at 17:39
  • @ypercube The fourth amendment provide for all citizens to be secure. Secure from any one/thing in their home, their persons, their papers and effects from unlawful search and seizure. By using a personal computer on a corporate internet, you jeopardize, put yourself at risk also your family, friends, acquaintances. [link](https://www.law.cornell.edu/constitution/fourth_amendment#.Vh6UjOgyNhE) The Fourth but now, It's the united states and 11 additional countries [link](http://www.aflcio.org/Issues/Trade/Trans-Pacific-Partnership-Free-Trade-Agreement-TPP) AFL-CIO – Elaine Ossipov Oct 14 '15 at 18:04
  • I think people are missing the final paragraph above, getting bogged down in other concerns. I would pose the last paragraph to be the one which ultimately sums up the risk, and why a person should never use their own computers - devices at work, including using/having your personal phone- contact list on a work phone. It is very rapidly becoming a whole new world, with whole new risks. – Elaine Ossipov Oct 14 '15 at 18:09
  • 4
    This author seems to assume that his or her audience all happen to live in his or her particular country. How narrow-minded and offensive. – Lightness Races in Orbit Oct 18 '15 at 01:14
  • http://security.stackexchange.com/users/17040/lightness-races-in-orbit Please see the response to Neil Smithline dated October 13th, it is three comments up from your own, and I believe answers your concern about the author's narrow-minded and offensive attitude. – Elaine Ossipov Oct 27 '15 at 07:55
  • This is a terrible, and completely incorrect answer, both technically and legally. – Xander Aug 30 '16 at 22:19
4

Most likely reason for this is that they need to legally be able to install employee monitoring software with/without your consent.

I know this because I work for a company that makes that kind of software. Our software monitors all employee activity and reports to the boss(es) about your productiviy. And you wouldn't even notice or know that this is happening if you don't have extensive knowledge about computers and software...

As someone else has already mentioned it is a LOT easier (and possible) to do those things with the computers of their own.

Emre Beşirik
  • 41
  • 2
  • 6
    I don't agree that this is the "most likely" reason. A secondary reason for some companies, perhaps. But security is the overriding concern for most. – Jon Bentley Oct 14 '15 at 13:09
  • Beilve me when it comes to BYOD security is the least of their concerns. They can easily add employee computer to their domain and 90% of their security problems just solved and it is really easy. – Emre Beşirik Oct 15 '15 at 13:09
  • btw; well it alsoo depends who you asking to this question. IT will tell as you and many others told but if you ask the boss/owner about the reasons behind this policy (and if they give an honest answer) they will tell you exactly as I told you ;) – Emre Beşirik Oct 15 '15 at 13:18
3

  1. Many companies have certain hardware standards. Using their equipment means you stay within those standards and are capable of using the technologies they use and running the software you are required to run.

  2. They need to be able to set and maintain security on your system. They don't want to risk you being able to install a virus that spreads through their network stealing information and disabling computers. If it's a mobile device such as a laptop, they may require whole disk encryption.

  3. They don't want to have to pay you to install and configure baseline software and settings when they most likely have an image they can load right onto a new machine for you in a short amount of time.

  4. If you end up with important or sensitive data on your machine, they don't want to be on the honor system with you that "I deleted it" Plus if you have a software license for some very expensive software they would like to give it to the next guy if you don't work out and not risk being in violation because you try to keep it if you did.

  5. You will complicate so many things for the IT staff. And if we are talking about joining to a domain and having group policies setup on your system, you may not like restrictions that must be in place on YOUR system and your just going to end up mad.

  6. If something on your machine breaks, they can't just slap your hard drive into another computer and have you back up and running. They may not have replacement hardware on hand, and if something is really expensive that goes out they don't want to replace it. If something does break, they need to be able to get you up and running and back to your job that they are paying you for and let the IT staff do their job and repair the system. You really seem to like your computer. Would you want someone else fixing it when they don't want to pay you to and they expect you to get back to work on another machine anyway?

There are so many more reasons. This is scratching the surface. It's just plain a good idea for you and the company.

David-
  • 434
  • 2
  • 8
0

Is there a legitimate reason…

Yes ! Pretty simple and basic: responsibility.

If you use your personal computer within the network of your company and you cause any form of trouble, through any sort of virus, spyware, or any other malware, you will be personally responsible of all the consequences. Here responsible won't mean a lot of work to repair the damages (this house cleaning will be done by the IT team) this will rather mean a lot of money, reputation or job loss.

If, on the other hand, you use a company computer, this responsibility will be held by the IT team. (This is much more safe and comfortable for everyone.)

WhyEnBe
  • 103
  • 6
dan
  • 3,033
  • 14
  • 34