Guidance from MBIM IT for labs and individuals using personal devices for university business in Microbiology and Immunology.
For labs that allow personal devices for university business, there are important considerations and risk assessments required to ensure this remains a safe and practical strategy.
Requirements for BYOD systems
- Use up-to-date antivirus protection. See Antivirus (Malware) Protection.
- Perform daily or weekly backups. See Backups.
- Ensure your personal device is encrypted using BitLocker (Windows), FileVault (macOS), or another full-disk encryption method such as VeraCrypt or LUKS. See Encryption and ISS U5 Requirement.
- Allow automatic updates and keep your operating system and applications current. See Updates (Applications and Operating System | ISS M5 Requirement).
- Use strong password complexity for local login and account access. See Strong Account Passwords | ISS U2 Requirement.
- When working remotely, use the UBC VPN. See Cisco AnyConnect VPN.
Important considerations
- Limited support scope — personal computers receive limited support from MBIM IT because they are not managed within the department’s full device management scope.
- Hardware responsibility — troubleshooting hardware issues is the owner’s responsibility, and users are encouraged to contact the device vendor directly.
- Research software support — MBIM IT can assist with research-related software setup when the application is licensed by the lab, department, or university.
- Licensing limits — some software packages are unavailable on BYOD devices because licensing terms depend on device ownership.
Compliance responsibility. Because UBC cannot directly enforce CIO Security Standards and UBC Policy requirements on unmanaged personal devices, responsibility is shared by the individual using the device and their supervisor. Supervisors should make sure the risks of using personal computers for work are actively reviewed and managed.
Supervisor and lab planning
Supervisors of individuals using personal computers for work should ensure the following steps are covered as part of ongoing risk management:
- Allocate additional time for the employee and manager to address risks introduced by using personal devices instead of UBC-owned computers.
- Review the CIO Security Standards and policy resources, including user and management standards.
- Pay particular attention to User Account Management (M2), Vulnerability Management (M5), and Cryptographic Controls (M7).
- Understand the classifications of data that will be stored on the personal device.
- Have a plan to remove UBC data from those computers at the end of employment or role changes.
- Periodically track operating system updates, encryption status, and endpoint detection / response tools.
- Ask members to provide dated proof of encryption status so there is evidence available if a device is lost or stolen.
Policy, standards, and resources
UBC’s Information Security Standards were revised in January 2021, including a new user standard for securing Internet of Things (IoT) devices. Security standards review and summary of changes
You may also want to review the UBC Privacy Matters COVID-19 guidance for work-related privacy considerations: COVID-19 privacy resources.