Mobile Security Decision-Makers Report BYOD Threats Have Infiltrated Their Organizations
Despite the risk of Bring Your Own Device (BYOD) threats, a new study reveals that fewer than half organizations have implements mobile security.
A new mobile security study finds that the vast majority of organizations that allow employees to BYOD are experiencing high rates of mobile threats, including lost or stolen devices, malware and compromised company data. Conducted by Webroot, a leader in delivering Internet security as a service, the study exposes that the popular trend of allowing employees to use their smartphones and tablets at work is causing a significant drain on IT resources while at the same time putting corporate data at risk.
The study, which focused on mobile security decision-makers in the United States, United Kingdom and Australia, found an overwhelming 82 percent of respondents believe that mobile devices create a high security risk within the corporate environment. Results show that mobile security is a high priority for half of the companies supporting BYOD, equating to increased help desk support and consumption of valuable IT resources. In addition, 45 percent reported lost or stolen devices in the past year and 24 percent experienced mobile malware infections, crippling productivity and potentially compromising company and customer data.
However, larger organizations, those with 500 or more employees, are at even higher risk. According to the study, 67 percent had dealt with lost or stolen mobile devices and 32 percent had experienced mobile malware infections, creating widespread concern about the business impact of employee-owned devices within the enterprise.
Webroot advises that companies take the following steps to reduce the risks associated with BYOD:
1. Establish device control policies: Create a policy that governs how your corporate IT staff can gain control over a personal device while maintaining your network security. Include information about how to keep personal information private (e.g., via a mobile device backup strategy such as containerization that doesn't touch personal data) and define corporate ownership over data and applications.
2. Enforce device-level security: Both corporate-owned and personal devices should have secure passwords and screen locks; document this requirement in your mobile device policies. In addition, require that personal and corporate mobile devices maintain up-to-date, corporate-approved (and preferably corporate-managed) security software installed to guard against malware and other security risks.
3. Develop and deliver mobile workforce security training: Security training will keep your mobile workforce productive and prepared to be the first line of defense against malware and other security threats to their mobile devices. Spell out your corporate policies and include a participant sign-off stating that they understand and will abide by the policies.
4. Let your business drive mobile device security policies and training: Business requirements and culture drive the policies, training and other upfront work you do to support your mobile workforce security needs.