Risk
7/26/2011
04:06 PM
Eric Zeman
Eric Zeman
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Personal Mobile Devices Still Vex IT

Two thirds of large enterprises surveyed by Courion say that employees are causing security breaches by connecting personal mobile devices to the corporate network.

There's no denying that mobile devices, whether they be smartphones, tablets, or laptops, are necessary business tools. Not all of them are provisioned by IT, though, and employees are often bringing their own gear to the office to access corporate data.

Courion, which specializes in access control management, recently polled 988 IT decision makers at large enterprises (73% of which have more than 1,000 employees) around the world about their security concerns. It appears that IT is mostly confident it can keep employee devices out of their corporate network, but not 100% so.

More than one-fifth of respondents said their business had no plan to block employee devices from accessing the network. Some respondents didn't even know if they had a network access policy in place, and 10% admitted to facing data breaches after the loss of a mobile device that had accessed their network.

It only takes one lost device to really screw things up.

The results of the study indicated that 57% of IT organizations believe they can effectively control access to their corporate network on the campus. That figure drops to 34%, however, when it comes to cloud access, and to 40% when it comes to employee access via smartphones and laptops. That's not a great level of confidence coming from IT.

Here's the scary part: 69% of enterprises say their employees are using personally-owned mobile devices (not company-issued) to connect to the corporate network.

That's a huge percentage, but not surprising at all given the meteoric rise in smartphone adoption over the course of the last few years. Apple's iPhone and Google's Android platform have encouraged large portions of the consumer population to jump onto the smartphone bandwagon. In its most recent quarter, AT&T revealed that 49% of its postpaid customers are using smartphones.

"Mobile devices are now accepted as necessary tools for productivity in the enterprise, regardless of how they affect data security. That is the new reality," Dave Fowler, senior vice president of product and marketing for Courion, said in a statement. "Companies are scrambling to keep up with the information access vulnerabilities and compliance violations created by mobile devices that access and store confidential information. The right solution can bring the same strength of protection to mobile devices that companies have deployed internally."

The number of employee-owned smartphones and tablets in the work place is only going to go up, and IT needs to make sure it is prepared.

Put a policy in place, remind employees that the policy is there, and enforce it when the policy is broken. Require network authentication before devices can hop into the data stores.

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.