Risk
7/26/2011
04:06 PM
Eric Zeman
Eric Zeman
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Personal Mobile Devices Still Vex IT

Two thirds of large enterprises surveyed by Courion say that employees are causing security breaches by connecting personal mobile devices to the corporate network.

There's no denying that mobile devices, whether they be smartphones, tablets, or laptops, are necessary business tools. Not all of them are provisioned by IT, though, and employees are often bringing their own gear to the office to access corporate data.

Courion, which specializes in access control management, recently polled 988 IT decision makers at large enterprises (73% of which have more than 1,000 employees) around the world about their security concerns. It appears that IT is mostly confident it can keep employee devices out of their corporate network, but not 100% so.

More than one-fifth of respondents said their business had no plan to block employee devices from accessing the network. Some respondents didn't even know if they had a network access policy in place, and 10% admitted to facing data breaches after the loss of a mobile device that had accessed their network.

It only takes one lost device to really screw things up.

The results of the study indicated that 57% of IT organizations believe they can effectively control access to their corporate network on the campus. That figure drops to 34%, however, when it comes to cloud access, and to 40% when it comes to employee access via smartphones and laptops. That's not a great level of confidence coming from IT.

Here's the scary part: 69% of enterprises say their employees are using personally-owned mobile devices (not company-issued) to connect to the corporate network.

That's a huge percentage, but not surprising at all given the meteoric rise in smartphone adoption over the course of the last few years. Apple's iPhone and Google's Android platform have encouraged large portions of the consumer population to jump onto the smartphone bandwagon. In its most recent quarter, AT&T revealed that 49% of its postpaid customers are using smartphones.

"Mobile devices are now accepted as necessary tools for productivity in the enterprise, regardless of how they affect data security. That is the new reality," Dave Fowler, senior vice president of product and marketing for Courion, said in a statement. "Companies are scrambling to keep up with the information access vulnerabilities and compliance violations created by mobile devices that access and store confidential information. The right solution can bring the same strength of protection to mobile devices that companies have deployed internally."

The number of employee-owned smartphones and tablets in the work place is only going to go up, and IT needs to make sure it is prepared.

Put a policy in place, remind employees that the policy is there, and enforce it when the policy is broken. Require network authentication before devices can hop into the data stores.

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.