Risk
7/26/2011
04:06 PM
Eric Zeman
Eric Zeman
Commentary
50%
50%

Personal Mobile Devices Still Vex IT

Two thirds of large enterprises surveyed by Courion say that employees are causing security breaches by connecting personal mobile devices to the corporate network.

There's no denying that mobile devices, whether they be smartphones, tablets, or laptops, are necessary business tools. Not all of them are provisioned by IT, though, and employees are often bringing their own gear to the office to access corporate data.

Courion, which specializes in access control management, recently polled 988 IT decision makers at large enterprises (73% of which have more than 1,000 employees) around the world about their security concerns. It appears that IT is mostly confident it can keep employee devices out of their corporate network, but not 100% so.

More than one-fifth of respondents said their business had no plan to block employee devices from accessing the network. Some respondents didn't even know if they had a network access policy in place, and 10% admitted to facing data breaches after the loss of a mobile device that had accessed their network.

It only takes one lost device to really screw things up.

The results of the study indicated that 57% of IT organizations believe they can effectively control access to their corporate network on the campus. That figure drops to 34%, however, when it comes to cloud access, and to 40% when it comes to employee access via smartphones and laptops. That's not a great level of confidence coming from IT.

Here's the scary part: 69% of enterprises say their employees are using personally-owned mobile devices (not company-issued) to connect to the corporate network.

That's a huge percentage, but not surprising at all given the meteoric rise in smartphone adoption over the course of the last few years. Apple's iPhone and Google's Android platform have encouraged large portions of the consumer population to jump onto the smartphone bandwagon. In its most recent quarter, AT&T revealed that 49% of its postpaid customers are using smartphones.

"Mobile devices are now accepted as necessary tools for productivity in the enterprise, regardless of how they affect data security. That is the new reality," Dave Fowler, senior vice president of product and marketing for Courion, said in a statement. "Companies are scrambling to keep up with the information access vulnerabilities and compliance violations created by mobile devices that access and store confidential information. The right solution can bring the same strength of protection to mobile devices that companies have deployed internally."

The number of employee-owned smartphones and tablets in the work place is only going to go up, and IT needs to make sure it is prepared.

Put a policy in place, remind employees that the policy is there, and enforce it when the policy is broken. Require network authentication before devices can hop into the data stores.

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0174
Published: 2015-04-27
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2015-0175
Published: 2015-04-27
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.