Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/14/2017
10:40 AM
100%
0%

Companies Blindly Believe They've Locked Down Users' Mobile Use

IT security teams may be in for a surprise about their mobile exposure as the GDPR compliance deadline approaches, according to a new survey.

Despite 61% of security and IT executives believing they have limited their users' access to company resources on their mobile devices, some 64% of employees acknowledge they can access enterprise customer, partner, and employee data from those devices, new data shows.

Some 58% of employees say they can retrieve customers' personally identifiable information (PII) from their mobile devices as well, according to a new report released today from Lookout.

The "Finding GDPR Noncompliance in a Mobile First World" report queried 2,062 US and UK respondents to assess where they stood as the May 25 deadline approaches for compliance of the European Union's General Data Protection Regulation (GDPR).

GDPR requires that organizations with European citizen PII must adhere to new rules on the way they handle this information and inform citizens affected by data breaches or face a hefty fine of 4% of a company's annual revenue.

"It was really surprising how companies thought they had locked their employees from accessing this data on their phones, but 64% of employees said they could access it. This awareness gap is significant," says Aaron Cockerill, Lookout's chief strategy officer.

With the majority of security and IT executives believing they have limited their employees' mobile access to PII, it may explain why only 16% plan to expand their compliance strategy to include mobile devices, Cockerill surmises.

It's also interesting to note that while a minority of executives plan to increase their mobile device compliance strategies, a whopping 84% of executives agree any personal data accessed via employees' mobile devices could put their organization at risk of falling out of GDPR compliance.

The survey found that 73% of employees use the same mobile phone for both work and personal use.

Another risk to PII data may also stem from employees accessing such data connecting to potentially risky Wi-Fi networks, which could result in a man-in-the-middle attack and put data at risk of being stolen, notes Cockerill. The survey results show that 68% of US employees connect to such networks on the go, he says.

Additionally, 48% of US employees acknowledge they download applications from sources other than app stores Google Play and Apple's App Store, which runs counter to advice security experts give users to steer clear of risky, unofficial app stores or sources.

Overall, 63% of survey respondents note they download apps outside of what their companies offer, in order to aid them in doing their jobs.

According to the survey, employees via their mobile devices actually have access to:

  • corporate contacts (80%)
  • work calendar (88%)
  • enterprise apps (85%)
  • corporate messaging (81%)
  • MFA/stored credentials (77%)
  • administrative tools (66%)

"Employees are just trying to do their jobs. This is not malicious," Cockerill says. "The reason for this study is to show companies they have this problem. Technology does exist to find out what their employees have installed and where the information is going."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
carlm21
50%
50%
carlm21,
User Rank: Apprentice
4/9/2018 | 1:35:04 AM
Re: Pardon me but ......
good one
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/21/2017 | 7:51:19 AM
Re: Pardon me but ......
A very fair point. That said, the fundamental problem I see is that there is no holistic data-protection design going into this. "Locked down" should not be the way to think about this issue because in this context (the way I see it) we're not talking about locking data down so much as regulating its flow.

To be certain, cybersecurity, data privacy, and compliance all do fall within the grander bucket of "data stewardship," but they also need to be thought of separately. Trying to achieve compliance and privacy goals while wearing a security hat is inevitably going to lead to failure.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/19/2017 | 5:12:21 PM
"limited"
Perhaps I need to more carefully review the study itself in context, but it seems that "limited" is the key word here. It's entirely possible that it's not as easy or readily accessible for employees to access these data -- but that they can still do it. So, to be fair, every little bit helps, I would tend to think.
nathandwyer
50%
50%
nathandwyer,
User Rank: Apprentice
11/17/2017 | 1:34:29 AM
Re: Pardon me but ......
Yea...thats really a informative post. I'm new blogger it would be sure helpful information for me i always keep in mind Thanks for sharing.
keith1mathew
100%
0%
keith1mathew,
User Rank: Apprentice
11/15/2017 | 7:18:36 AM
Re: Pardon me but ......
Hello 

Interesting post. Thank you for providing the information. 

Thanks 
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
11/14/2017 | 2:26:19 PM
Pardon me but ......
Companies have not even locked down servers and networks.  How can they be so naive as to think that these devices are somehow SECURE???  
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17537
PUBLISHED: 2019-10-13
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring.
CVE-2019-17538
PUBLISHED: 2019-10-13
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring.
CVE-2019-17535
PUBLISHED: 2019-10-13
Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.
CVE-2019-17536
PUBLISHED: 2019-10-13
Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.
CVE-2019-17533
PUBLISHED: 2019-10-13
Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.