Mobile
11/14/2017
10:40 AM
100%
0%

Companies Blindly Believe They've Locked Down Users' Mobile Use

IT security teams may be in for a surprise about their mobile exposure as the GDPR compliance deadline approaches, according to a new survey.

Despite 61% of security and IT executives believing they have limited their users' access to company resources on their mobile devices, some 64% of employees acknowledge they can access enterprise customer, partner, and employee data from those devices, new data shows.

Some 58% of employees say they can retrieve customers' personally identifiable information (PII) from their mobile devices as well, according to a new report released today from Lookout.

The "Finding GDPR Noncompliance in a Mobile First World" report queried 2,062 US and UK respondents to assess where they stood as the May 25 deadline approaches for compliance of the European Union's General Data Protection Regulation (GDPR).

GDPR requires that organizations with European citizen PII must adhere to new rules on the way they handle this information and inform citizens affected by data breaches or face a hefty fine of 4% of a company's annual revenue.

"It was really surprising how companies thought they had locked their employees from accessing this data on their phones, but 64% of employees said they could access it. This awareness gap is significant," says Aaron Cockerill, Lookout's chief strategy officer.

With the majority of security and IT executives believing they have limited their employees' mobile access to PII, it may explain why only 16% plan to expand their compliance strategy to include mobile devices, Cockerill surmises.

It's also interesting to note that while a minority of executives plan to increase their mobile device compliance strategies, a whopping 84% of executives agree any personal data accessed via employees' mobile devices could put their organization at risk of falling out of GDPR compliance.

The survey found that 73% of employees use the same mobile phone for both work and personal use.

Another risk to PII data may also stem from employees accessing such data connecting to potentially risky Wi-Fi networks, which could result in a man-in-the-middle attack and put data at risk of being stolen, notes Cockerill. The survey results show that 68% of US employees connect to such networks on the go, he says.

Additionally, 48% of US employees acknowledge they download applications from sources other than app stores Google Play and Apple's App Store, which runs counter to advice security experts give users to steer clear of risky, unofficial app stores or sources.

Overall, 63% of survey respondents note they download apps outside of what their companies offer, in order to aid them in doing their jobs.

According to the survey, employees via their mobile devices actually have access to:

  • corporate contacts (80%)
  • work calendar (88%)
  • enterprise apps (85%)
  • corporate messaging (81%)
  • MFA/stored credentials (77%)
  • administrative tools (66%)

"Employees are just trying to do their jobs. This is not malicious," Cockerill says. "The reason for this study is to show companies they have this problem. Technology does exist to find out what their employees have installed and where the information is going."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/19/2017 | 5:12:21 PM
"limited"
Perhaps I need to more carefully review the study itself in context, but it seems that "limited" is the key word here. It's entirely possible that it's not as easy or readily accessible for employees to access these data -- but that they can still do it. So, to be fair, every little bit helps, I would tend to think.
nathandwyer
50%
50%
nathandwyer,
User Rank: Apprentice
11/17/2017 | 1:34:29 AM
Re: Pardon me but ......
Yea...thats really a informative post. I'm new blogger it would be sure helpful information for me i always keep in mind Thanks for sharing.
keith1mathew
100%
0%
keith1mathew,
User Rank: Apprentice
11/15/2017 | 7:18:36 AM
Re: Pardon me but ......
Hello 

Interesting post. Thank you for providing the information. 

Thanks 
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
11/14/2017 | 2:26:19 PM
Pardon me but ......
Companies have not even locked down servers and networks.  How can they be so naive as to think that these devices are somehow SECURE???  
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.