Mobile
2/3/2014
02:35 PM
Marilyn Cohodas
Marilyn Cohodas
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Infographic: Mobile Security Run Amok

Where is your organization in the battle over mobile device management and security?

2014 marks the 10th anniversary of the world's first mobile malware, Cabir. In the decade since, the incidents of mobile malware have increased dramatically. Yet, according to InformationWeek's 2013 enterprise security survey, the majority of security pros still don't have a clue about what devices are accessing their networks.

Where is your organization in the battle over mobile device management and security? Check out the graphical depiction of the research below, then let's chat in the comments about the challenges you face.

Marilyn has been covering technology for business, government, and consumer audiences for over 20 years. Prior to joining UBM, Marilyn worked for nine years as editorial director at TechTarget Inc., where she launched six Websites for IT managers and administrators supporting ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/3/2014 | 2:55:29 PM
No Clue? The 45 percent
Can it be true that nearly half of respondents allow all users on to the network if they agree to policies that no one enforces? How typical is that? 
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
2/3/2014 | 3:16:15 PM
Re: No Clue? The 45 percent
Marilyn, In my discussions with practitioners, it's more common that you'd think. The usual justification is that HR requires employees to sign a form where they promise to observe some set of rules and policies. However, as we saw with Edward Snowden, those forms aren't worth the paper they're printed on if the employee decides to misuse mobility. There's also the problem of well-meaning but clueless users who use "0000" as a passcode or stick a post-it note to the back of their tablets with email and SaaS passwords.

Wny not put enforcement in place? Usual reasons are the business won't stand for it (or pay for it)and/or the MDM/MAM market is still too fragmented given that they support multiple platforms.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/3/2014 | 3:19:37 PM
Re: No Clue? The 45 percent
I certainly understand that trying to stay on top of mobile security is like shooting a moving target. Yet it seems to me that it  is equally absurd to spend the time developing policies if you know you can't enforce them. 
WKash
50%
50%
WKash,
User Rank: Apprentice
2/3/2014 | 4:44:13 PM
Re: No Clue? The 45 percent
It does seem that some of these respondents' companies are inviting trouble. For those trying to figure out what baseline to use to improve their BYOD policy, here's what the US CIO issued to agencies nearly 18 months ago:
A Toolkit to Support Federal Agencies Implementing Bring Your Own Device (BYOD) Programs

Contents http://www.whitehouse.gov/digitalgov/bring-your-own-device#key-considerations
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
2/3/2014 | 8:13:53 PM
Re: No Clue? The 45 percent
BYOD brings significant benefits to business and improves the efficiency at least one fold. But the security threat is always a headache of IT department. Last month my company pushed the installation of new security software on our BYOD device so that the security is enhanced when accessing company network to download email. The installation process is rather tedious and time-consuming. Furthmore, I do doubt its effectiveness. The stringent policy is good for security but if you cannot enforce it easily, then it's really something of vain.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/4/2014 | 6:33:00 AM
Re: No Clue? The 45 percent
"The installation process is rather tedious and time-consuming. Furthermore, I do doubt its effectiveness."

That's a killer assessment, especially from someone who is tech-savvy and not your typical end-user/employee. If a tough, unenforceable BYOD policy turns off even the "believers," then mobile security has truly run amok. There must be a better way.
IMjustinkern
50%
50%
IMjustinkern,
User Rank: Strategist
2/7/2014 | 4:03:27 PM
Re: No Clue? The 45 percent
The encryption portion of this is the most astounding part to me ... We've had encryption for email for how long, but it seems too alien a process when the device is in the palm of our hand. Easy encryption on mobile devices lets people use their devices (that they're using anyway) and keeps IT managers from stabbing themselves in the eyes.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/10/2014 | 8:45:13 AM
Re: No Clue? The 45 percent-- encryption
The data point about encryption is kind of misleading. If 13 percent of respondents say they don't enforce encryption on mobile devices, that means 87 percent do. That seems to me like a pretty good statistic.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
2/3/2014 | 4:28:01 PM
Re: No Clue? The 45 percent
Surely, there must be some MDM vendors out there that support the big three: Android, iOS, and Windows Phone.
PeteJW
100%
0%
PeteJW,
User Rank: Apprentice
2/4/2014 | 4:16:32 AM
Re: No Clue? The 45 percent
Part of the issue is also understanding that users too are sensitive to heavy handed IT policies and controls that potentially effect their own privacy. That's why businesses are supplementing standard devuce controls with app and contatent management - especially techniques to isolate and secure business and personal content -at rest and in-flight. If they don't do this effectively (across multiple devices and silos) without adding more burden on IT and a usability tax on the user, then the device will be left at home, become an office paperweight, or as research indicates compromise a business. Whatever the case everyone loses.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/4/2014 | 6:35:53 AM
Re: No Clue? The 45 percent
Thanks, PeterJW. What are the  "techniques you've seen that are effective in controlling BYOD. Are you speaking of policies or technologies or a combination of the two. 
PeteJW
50%
50%
PeteJW,
User Rank: Apprentice
2/4/2014 | 7:43:10 AM
Re: No Clue? The 45 percent
Hi Marilyn - Definitely a combination - What I personally consider key is having the management flexibility in  the tools and tech to not only ensure a policy is enforced, but actually deliver the flexibility needed to guide its development -- especially if policies start off too rigid/control-centric and are being ignored.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/4/2014 | 11:57:18 AM
Mobility fallout -- encryption
Anyone surprised that 13 percent of respondents don't enforce encryption on mobile devices that contain enterprise data? 
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
2/4/2014 | 7:55:07 PM
Re: Mobility fallout -- encryption
Marilyn, this is not a suprise to me. People are eager to get email access, etc. working on their mobile device. As long as it works, they will not bother to enforce the security rules. I think the best approach for the enterprise would be configuring the system so that no unencrypted/unprotected access is allowed.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/5/2014 | 1:43:57 PM
Re: Mobility fallout -- encryption
If 13 percent don't enforce encryption on mobile devices using my massive abilities in arithmetic, that means 87 percent of enterprises do enforce encryption. I guess that puts you in the majority, Li.  

 
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
2/5/2014 | 8:23:09 PM
dirty words
MDM seems to be dirty words to IT. Mobile devices have been around for some time now and security is still a big issue. Companies adopt BYOD in some form but have no means to manage it correctly.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/6/2014 | 8:04:20 AM
Re: dirty words
Paul -- Why do you think MDM is so underutilized? Cost, effectiveness, technology issues, users?
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If you’re still focused on securing endpoints, you’ve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-0889
Published: 2014-07-29
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote atta...

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3020
Published: 2014-07-29
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

Best of the Web
Dark Reading Radio