Personal Laptops, Corporate Secrets: 70% of Companies Err with BYOD Policies
Personal smartphones and laptops have long been integrated into corporate infrastructure. According to Crosstech experts, up to 90% of employees at Russian organizations use their own devices for work-related tasks. At the same time, approximately 70% of companies implement BYOD programs with critical errors, exposing themselves to data leaks and other cyber incidents.
The concept of Bring Your Own Device appears attractive at first glance: businesses save on hardware purchases while employees work on familiar equipment. Problems arise when organizations choose one of two extremes. The first is a completely permissive approach with no rules, restrictions, or data separation. An employee might download a work contract to a smartphone, edit it at home in the evening, and then leave the device in a taxi the next day. The same gadget could be handed to a child who installs questionable games, potentially compromising corporate data along with it.
The second extreme involves transforming an employee’s personal laptop into an extension of the security department. The company installs monitoring software that tracks user actions, which employees often perceive as surveillance. This frequently produces the opposite effect: documents migrate to personal messengers, unauthorized cloud services, and other unofficial platforms. The result is shadow IT that the organization can no longer control.
Crosstech recommends avoiding full-device monitoring and instead separating work and personal spaces. On smartphones, corporate data can be placed inside an encrypted container that can be wiped independently if needed. For home desktops, companies should provide secure access through isolated virtual desktops without direct connections to the internal network.
“Companies should care only about how their data is processed, not about what a person does in their free time on their own device,” noted Egor Norkin, Information Security Architect at Crosstech.
Related articles
Corporate Wi-Fi Passwords Stored in Plain Text on Every Connected Device
Many organizations continue to rely on a single shared password for corporate and guest Wi-Fi networks, creating long-term access risks after employees leave. On Windows systems, the netsh wlan show profile command reveals the password in clear text without requiring administrative rights. Linux distributions using NetworkManager store the PSK in readable files under /etc/NetworkManager/system-connections unless the keyring option is selected. macOS keeps passwords in the Keychain, which prompts for user confirmation before disclosure. The article explains why shared passwords cannot serve as effective access control and recommends WPA2/WPA3-Enterprise authentication or properly isolated guest networks instead. It also provides concrete commands for administrators to audit their own environments and highlights the consequences of infrequent password rotation.
Costly Mistakes: How Russian Businesses Risk Millions in Fines for Personal Data Violations
A year after stricter Russian personal data protection fines took effect, many entrepreneurs continue to commit violations that could trigger multimillion-ruble penalties from Roskomnadzor. The article details ten common breaches, including the prohibited use of Google Forms for data collection, missing cookie banners, absent or invalid consent forms under forms, and failure to obtain separate consents for publishing reviews. Additional violations cover missing privacy policies, outdated notifications to Roskomnadzor, improper transfer of employee data to third parties without written consent, lack of data processing agreements, and absence of records for paper-based data storage locations. Each violation is explained with direct references to the Law on Personal Data, the Code of Administrative Offenses, and specific government orders, along with exact fine ranges for citizens, individual entrepreneurs, and legal entities. Practical remediation steps are provided, such as replacing foreign services with Yandex Forms, drafting compliant consent texts per Article 9, and submitting updated notifications under Order No. 180. The guidance emphasizes conducting a full site audit and implementing all required documents to avoid penalties throughout 2026.
Rethinking SSO: Centralized User Data Provision and Authorization Processing in Corporate Systems
The article examines Single Sign-On systems not merely as authentication gateways but as architectural hubs for delivering user attributes and executing additional authorization logic. It highlights how SSO can aggregate data from sources like Active Directory, HR systems, and IDM platforms, then deliver it via OIDC claims to downstream applications. The discussion covers the shift from fragmented integrations across dozens of apps to a single trusted enforcement point using standards such as aggregated and distributed claims. It also explores the authorization pipeline where SSO acts as a Policy Enforcement Point querying external Policy Decision Points via the AuthZEN Authorization API 1.0. Practical examples include electronic business cards, role assignment, access routing, and mandatory MFA checks before token issuance. The piece stresses maintaining data ownership with source systems while establishing SSO as the single point of trust for applications.
Bitrix24 Releases Fully On-Premise BI Constructor for Regulated Enterprises
Bitrix24 has introduced a new delivery model for its BI Constructor that allows complete deployment inside a customer's own infrastructure. The update eliminates any requirement for external servers, cloud APIs, or internet connectivity, ensuring that all corporate data remains within the organization's closed perimeter. Previously, even the boxed version of the platform needed access to external infrastructure for updates and auxiliary services, creating conflicts with internal security policies and regulatory demands in highly regulated sectors. The new on-premise variant performs all data processing and storage exclusively on customer servers, giving organizations full control over access rights, backups, updates, and integration with internal protection tools. The solution is compatible with the boxed edition of Bitrix24 running on PostgreSQL and does not connect to external CDNs or cloud services. Bitrix24 expects strong interest from large enterprises and organizations handling restricted-access data that must stay inside the corporate network. Pilot implementations have already been completed, with broader customer pilots planned in the coming months.