BYOD guidelines and policies in higher education

The BYOD trend in Higher Ed has been in existence for decades and, in recent years, has moved to the forefront of software delivery goals. The introduction of the smartphone and popularity of Mac devices as a fashion brand has put IT departments on their heels around permitting their use on campus, providing official support, and how to permit safe access to campus resources.

In this article, we will examine the importance of a solid BYOD policy for campus and what details you might want to include. As much as some IT departments might hope that the BYOD trend will pass, rest assured it is here to stay and successful campuses will embrace the trend, taking full advantage of the ‘free’ hardware being offered by incoming students.

It's a method of passing relevant information to students and staff before they begin to use a personal device in place of/in addition to a university-owned computer. Many users may arrive on campus with their own machine expecting full functionality and be overly disappointed if any resources are not available for use for whatever reason. A comprehensive and well-publicized BYOD policy will help inform users what to expect and which resources are likely to be available. It is an opportunity to manage users' expectations. Finally, a BYOD policy can also help limit the amount of support the campus IT department is empowered to deliver and help protect the campus from undue liability.

When starting the development of your BYOD policy, some basic factors should be included. These may not be exhaustive and the policy can be added to over time as required. At a high level, the policy should address device type, operating system, available resources, and security. As mentioned above, a section on support may also be useful in the initial draft. Further details follow below.

Device Type

There is a wide range of device types to consider for use on campus. The major categories include laptops, tablets, smartphones, desktops, and gaming consoles. Your BYOD policy might make declarations on use by type, with restricted access for certain device types. For example:

• Smartphone: WiFi access only
• Gaming Console: WiFi access only
• Tablet: WiFi access only
• Laptop: WiFi and printing access
• Desktop: WiFi and printing access
• Other/Unidentified: WiFi access only

Operating System

The operating system of the user’s device might also introduce certain limitations when it comes to compatibility with services on campus. Detailing such restrictions will be important to inform users of the expected functionality when they arrive on campus. Furthermore, the version of each operating system might also be relevant. This section is a good place to indicate the level of support being provided by the IT department.

Windows:

• Permitted versions include Windows 10, all editions, from 1909 forward.
• Windows 7 is no longer permitted to connect to campus resources, including connection to WiFi networks.
• The campus Service Desk will assist with basic operations such as connecting to WiFi, printing documents, and initiating virus scans.

MacOS:

• Permitted versions include all MacOS versions from Catalina forward.
• The campus Service Desk will assist with basic operations such as connecting to WiFi and printing documents.

iOS/Android/Mobile:

• Permitted versions include all current and up-to-date mobile device operating systems.
• The campus Service Desk does not provide any support for mobile operating systems, but a wealth of information can be found on-line or from other students.

Linux:

• All up-to-date versions of Linux are permitted on campus, but on a self-supported basis only.
• The campus Service Desk does not provide any support for Linux operating systems.

ChromeOS:

• All up-to-date versions of ChromeOS are permitted on campus, but on a self-supported basis only.
• The campus Service Desk does not provide any support for ChromeOS operating systems.

Playstation/Xbox/Gaming:

• All up-to-date versions of gaming consoles are permitted on campus, but on a self-supported basis only.
• The campus Service Desk does not provide any support for gaming console operating systems.

Other/Unidentified:

• All up-to-date versions of other types of operating systems are permitted on campus, but on a self-supported basis only.
• The campus Service Desk does not provide any support for all other operating systems.

Available Resources:

Beyond the types of devices that a student is allowed to bring to campus, the next most important piece of information will be what do they have access to with their BYOD device. The most common four resources are:

• WiFi network: all devices are permitted access to the campus WiFi network, keeping in line with the restrictions noted above
• Printing: the campus provides web-based access to printers across campus. Simply upload your document and choose the printer you’d like to use.
• File storage: our campus does not offer central file storage, but instead offers cloud storage in the form of (Google Drive, OneDrive). This service ensures your files are available from anywhere on campus and is automatically backed up.
• Software: students can access most software (license permitting) from their own Windows-based computer using AppsAnywhere. Some titles are also available for the latest version of Mac computers. After logging in, the app store will automatically show you what is available for use.

Security:

Risk mitigation and protection of campus resources and assets are at the core of an IT department’s stance on security. A successful BYOD policy will balance user access with risk and implement the appropriate solutions to help find this balance. Security is discussed in more depth later in this article. However, informing students of why personal device use represents a risk to campus should be included in any policy as an opportunity to educate and inform. Again, most students are unaware of the risk and potential damage that can occur. The BYOD policy is a good place to start the conversation.

Introducing a new BYOD policy to campus requires a lot of consideration and support from various departments and campus leadership. A poorly constructed policy can have a negative impact on campus services, student experience, and may reflect poorly on the reputation of the school. However, with proper planning and buy-in from all levels and areas of campus, a BYOD policy can ensure the needs of students are successfully met without placing an undue burden on campus personnel. It has even been shown to reduce software delivery workloads, particularly when it comes to support.

First, consider the viewpoint of students. Most are unwise to the behind-the-scenes nature of provisioning IT services to a campus. Many come from the standpoint that “my computer is fine and should just work”. Thus, a solid communication plan is necessary and should include some explanations behind the different sections of the policy.

Second, build into your policy as much leeway as possible. For example, segment your WiFi network to permit any device to connect without jeopardizing campus resources. In most cases, this is all students are seeking anyway and with a limited liability or self-support clause in the policy, the IT department is under no obligation to make older or rogue devices work.

Third, communication is key. With the introduction of any new service or policy, your campus should expect and plan to over-communicate the change. Today’s students are notorious for ignoring all communications, so flooding their channels with the change will increase the likelihood of it being seen and hopefully read. In addition, try to distill the most important or wide-reaching parts of the policy to a few bullet points leading into the full text of the policy. Also, communicate a summary by video and post to all channels.

Finally, during the development phase, try to include constituents from all areas of campus to ensure their needs are being considered. These can include faculty committees, student government, and staff advocates.

Schools that implement a successful BYOD policy will likely enjoy higher numbers of incoming student applications and better retention rates of returning students.

Having a well-thought-out and comprehensive BYOD policy in place should be a cornerstone for all campuses. No longer is the expectation that the school will provide computers, but rather the expectation is now that ‘my own device will work.’ Schools that implement a successful BYOD policy will likely enjoy higher numbers of incoming student applications and better retention rates of returning students.

In addition, the successful BYOD policy will put the IT department at ease with well-defined boundaries on what support and access they need to provide.

Finally, establishing the correct level of service through policies, procedures, and technology solutions means that students will enjoy the levels of access needed to be successful during their careers at the school. It also means that the IT budget will be used in an effective and appropriate way to provide those services.

One of the most common points of fear around permitting BYOD use is that of maintaining security at all levels around campus resources. This includes protection against viruses, corruption and loss of data, theft or compromise of credentials, and all other forms of hacking. When a campus permits un-managed devices to connect to campus resources, it is viewed as a very high-risk activity, which is not entirely untrue. However, there are preventative measures and systems that can be deployed to mitigate the risk and still allow BYOD use. For example:

• Require or provide anti-virus protection software
• Implement an intrusion prevention system (IPS)
• Require IT approval prior to BYOD device use
• Segment WiFi networks
• Deploy a split-VPN solution
• Offer a lease-back program for campus-managed laptops
• Deploy a mobile device management (MDM) solution
• Front-end common campus services (ie. Printing) with web-based access solutions instead of permitting direct access

On any campus, the security and integrity of all campus-owned assets (including data) is the responsibility of the IT department. Thus, any BYOD policy should conform to existing IT policies and procedures and be approved by all levels of IT while keeping risk points at a minimum.

What is BYOD policy?

A BYOD policy is a formal definition and agreement between the BYOD provider (universities) and the BYOD users (students). It is similar to an SLA (Service Level Agreement) between service-providers and outlines how users can expect to interact with their university's BYOD program, as well as any limitations, usage conditions, and compatibility information.

What is in a BYOD policy?

To put it concisely, a BYOD policy should include any or all of the following:

• Device type
• Operating system
• Available resources
• Security
• Usage conditions

This is covered in more detail above >

Why have a BYOD policy?

A formal BYOD policy helps to ensure a high chance of success and adoption as well as communicating practical information to users on how to interact with and use software on their BYO devices.