Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/14/2017
10:40 AM
100%
0%

Companies Blindly Believe They've Locked Down Users' Mobile Use

IT security teams may be in for a surprise about their mobile exposure as the GDPR compliance deadline approaches, according to a new survey.

Despite 61% of security and IT executives believing they have limited their users' access to company resources on their mobile devices, some 64% of employees acknowledge they can access enterprise customer, partner, and employee data from those devices, new data shows.

Some 58% of employees say they can retrieve customers' personally identifiable information (PII) from their mobile devices as well, according to a new report released today from Lookout.

The "Finding GDPR Noncompliance in a Mobile First World" report queried 2,062 US and UK respondents to assess where they stood as the May 25 deadline approaches for compliance of the European Union's General Data Protection Regulation (GDPR).

GDPR requires that organizations with European citizen PII must adhere to new rules on the way they handle this information and inform citizens affected by data breaches or face a hefty fine of 4% of a company's annual revenue.

"It was really surprising how companies thought they had locked their employees from accessing this data on their phones, but 64% of employees said they could access it. This awareness gap is significant," says Aaron Cockerill, Lookout's chief strategy officer.

With the majority of security and IT executives believing they have limited their employees' mobile access to PII, it may explain why only 16% plan to expand their compliance strategy to include mobile devices, Cockerill surmises.

It's also interesting to note that while a minority of executives plan to increase their mobile device compliance strategies, a whopping 84% of executives agree any personal data accessed via employees' mobile devices could put their organization at risk of falling out of GDPR compliance.

The survey found that 73% of employees use the same mobile phone for both work and personal use.

Another risk to PII data may also stem from employees accessing such data connecting to potentially risky Wi-Fi networks, which could result in a man-in-the-middle attack and put data at risk of being stolen, notes Cockerill. The survey results show that 68% of US employees connect to such networks on the go, he says.

Additionally, 48% of US employees acknowledge they download applications from sources other than app stores Google Play and Apple's App Store, which runs counter to advice security experts give users to steer clear of risky, unofficial app stores or sources.

Overall, 63% of survey respondents note they download apps outside of what their companies offer, in order to aid them in doing their jobs.

According to the survey, employees via their mobile devices actually have access to:

  • corporate contacts (80%)
  • work calendar (88%)
  • enterprise apps (85%)
  • corporate messaging (81%)
  • MFA/stored credentials (77%)
  • administrative tools (66%)

"Employees are just trying to do their jobs. This is not malicious," Cockerill says. "The reason for this study is to show companies they have this problem. Technology does exist to find out what their employees have installed and where the information is going."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
11/14/2017 | 2:26:19 PM
Pardon me but ......
Companies have not even locked down servers and networks.  How can they be so naive as to think that these devices are somehow SECURE???  
keith1mathew
100%
0%
keith1mathew,
User Rank: Apprentice
11/15/2017 | 7:18:36 AM
Re: Pardon me but ......
Hello 

Interesting post. Thank you for providing the information. 

Thanks 
nathandwyer
50%
50%
nathandwyer,
User Rank: Apprentice
11/17/2017 | 1:34:29 AM
Re: Pardon me but ......
Yea...thats really a informative post. I'm new blogger it would be sure helpful information for me i always keep in mind Thanks for sharing.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/19/2017 | 5:12:21 PM
"limited"
Perhaps I need to more carefully review the study itself in context, but it seems that "limited" is the key word here. It's entirely possible that it's not as easy or readily accessible for employees to access these data -- but that they can still do it. So, to be fair, every little bit helps, I would tend to think.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/21/2017 | 7:51:19 AM
Re: Pardon me but ......
A very fair point. That said, the fundamental problem I see is that there is no holistic data-protection design going into this. "Locked down" should not be the way to think about this issue because in this context (the way I see it) we're not talking about locking data down so much as regulating its flow.

To be certain, cybersecurity, data privacy, and compliance all do fall within the grander bucket of "data stewardship," but they also need to be thought of separately. Trying to achieve compliance and privacy goals while wearing a security hat is inevitably going to lead to failure.
carlm21
50%
50%
carlm21,
User Rank: Apprentice
4/9/2018 | 1:35:04 AM
Re: Pardon me but ......
good one
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13897
PUBLISHED: 2020-06-07
HESK before 3.1.10 allows reflected XSS.
CVE-2020-13894
PUBLISHED: 2020-06-07
handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field.
CVE-2020-13895
PUBLISHED: 2020-06-07
Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes...
CVE-2020-13890
PUBLISHED: 2020-06-06
The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.
CVE-2020-13889
PUBLISHED: 2020-06-06
showAlert() in the administration panel in Bludit 3.12.0 allows XSS.