04:06 PM
Eric Zeman
Eric Zeman

Personal Mobile Devices Still Vex IT

Two thirds of large enterprises surveyed by Courion say that employees are causing security breaches by connecting personal mobile devices to the corporate network.

There's no denying that mobile devices, whether they be smartphones, tablets, or laptops, are necessary business tools. Not all of them are provisioned by IT, though, and employees are often bringing their own gear to the office to access corporate data.

Courion, which specializes in access control management, recently polled 988 IT decision makers at large enterprises (73% of which have more than 1,000 employees) around the world about their security concerns. It appears that IT is mostly confident it can keep employee devices out of their corporate network, but not 100% so.

More than one-fifth of respondents said their business had no plan to block employee devices from accessing the network. Some respondents didn't even know if they had a network access policy in place, and 10% admitted to facing data breaches after the loss of a mobile device that had accessed their network.

It only takes one lost device to really screw things up.

The results of the study indicated that 57% of IT organizations believe they can effectively control access to their corporate network on the campus. That figure drops to 34%, however, when it comes to cloud access, and to 40% when it comes to employee access via smartphones and laptops. That's not a great level of confidence coming from IT.

Here's the scary part: 69% of enterprises say their employees are using personally-owned mobile devices (not company-issued) to connect to the corporate network.

That's a huge percentage, but not surprising at all given the meteoric rise in smartphone adoption over the course of the last few years. Apple's iPhone and Google's Android platform have encouraged large portions of the consumer population to jump onto the smartphone bandwagon. In its most recent quarter, AT&T revealed that 49% of its postpaid customers are using smartphones.

"Mobile devices are now accepted as necessary tools for productivity in the enterprise, regardless of how they affect data security. That is the new reality," Dave Fowler, senior vice president of product and marketing for Courion, said in a statement. "Companies are scrambling to keep up with the information access vulnerabilities and compliance violations created by mobile devices that access and store confidential information. The right solution can bring the same strength of protection to mobile devices that companies have deployed internally."

The number of employee-owned smartphones and tablets in the work place is only going to go up, and IT needs to make sure it is prepared.

Put a policy in place, remind employees that the policy is there, and enforce it when the policy is broken. Require network authentication before devices can hop into the data stores.

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-02
Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet.

Published: 2015-10-02
Cisco NX-OS 6.0(2)U6(0.46) on N3K devices allows remote authenticated users to cause a denial of service (temporary SNMP outage) via an SNMP request for an OID that does not exist, aka Bug ID CSCuw36684.

Published: 2015-10-02
Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.

Published: 2015-10-01
lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.

Published: 2015-10-01
kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.