I am a software engineer. My company is switching their VPN setup to a new provider that uses a two-factor authentication system. Part of this new setup involves a mobile app -- I have been asked by my corporate IT department to install this app on my personal cell phone for when I use the VPN.
The VPN is required for all remote work; I cannot access anything related to my company without first connecting to the VPN unless I am physically at the office. I do not want to install anything related to my company on my personal cell phone. I don't even have a corporate email client installed.
How do I communicate to management that I do not feel comfortable with -- or am willing to -- install corporate software on my personal phone? What alternative solutions can I offer, and how should I go about approaching management or the IT Security team about this?
Some additional information:
- The reason I avoid having anything work-related on my phone is because I work in healthcare in the US. Everything I do is very strictly controlled by HIPAA and HITECH, with severe penalties. I've never accessed anything work related from a personal device and don't want to start doing so now.
- I use the VPN to work remotely (I'm allowed to work from home within reason.) I am willing to give up this privilege.
- I also use the VPN when I'm called after hours. We have an on-call rota; if called, we have 30 minutes to respond to the emergency. Unfortunately I live more than 30 minutes from the office, so the VPN is necessary for me to respond to these situations.
- The current version of the VPN, which does not include the two-factor authentication, is being phased out so staying on the older application isn't an option.
- I told my manager that I did not want to install any work/corporate software on my personal cell phone. He brushed me off. (Me: "Hello manager. I'm being transitioned to the new VPN, but it looks like it requires some software be installed on my phone. I do not wish to install this VPN software on my personal phone." / Him: "Yeah, I thought it looked like a pain.")
This question is somewhat related, but specific to Germany and being asked to actually use the personal device for work. For two-factor authentication, the way it works is that when you sign in, the mobile app receives a counter sign and its proximity to the laptop (or other primary sign-in device) will unlock access to the VPN.