The study, which focused on mobile security decision-makers in the United States, United Kingdom and Australia, found an overwhelming 82% of respondents believe that mobile devices create a high security risk within the corporate environment. Results show that mobile security is a high priority for half of the companies supporting BYOD, equating to increased help desk support and consumption of valuable IT resources. In addition, 45% reported lost or stolen devices in the past year and 24% experienced mobile malware infections, crippling productivity and potentially compromising company and customer data.
However, larger organizations, those with 500 or more employees, are at even higher risk. According to the study, 67% had dealt with lost or stolen mobile devices and 32% had experienced mobile malware infections, creating widespread concern about the business impact of employee-owned devices within the enterprise.
Top-level corporate study findings:
-- 63% of companies reported significant increases in demand for
help desk support to repair, replace or manage the security of
smartphones and tablets in the company, consuming as much as 36%
of one help desk technician's time resolving these issues each month.
-- 61% required additional IT resources to manage mobile security,
resulting in higher costs.
-- More than half reported mobile threats reduced employee productivity and
disrupted business activities.
-- Two-thirds of companies (67 percent) agree that the management of mobile
device security is a great burden on IT resources.
-- 46% of BYOD companies have implemented mobile security, but only
40% of companies with fewer than 100 employees have mobile
What Can Organizations Do?
Webroot advises that companies take the following steps to reduce the risks associated with BYOD:
-- Establish device control policies: Create a policy that governs how your
corporate IT staff can gain control over a personal device while
maintaining your network security. Include information about how to keep
personal information private (e.g., via a mobile device backup strategy
such as containerization that doesn't touch personal data) and define
corporate ownership over data and applications.
-- Enforce device-level security: Both corporate-owned and personal devices
should have secure passwords and screen locks; document this requirement
in your mobile device policies. In addition, require that personal and
corporate mobile devices maintain up-to-date, corporate-approved (and
preferably corporate-managed) security software installed to guard
against malware and other security risks.
-- Develop and deliver mobile workforce security training: Security
training will keep your mobile workforce productive and prepared to be
the first line of defense against malware and other security threats to
their mobile devices. Spell out your corporate policies and include a
participant sign-off stating that they understand and will abide by the
-- Let your business drive mobile device security policies and training:
Business requirements and culture drive the policies, training and other
upfront work you do to support your mobile workforce security needs.
"Cyber criminals are increasingly targeting employees as access portals to a company's infrastructure, intensifying the need for controls and layered defenses that can identify and mitigate attacks," said Jacques Erasmus, chief information security officer at Webroot. "As the popularity of employee-owned devices in the workplace continues to grow, this defense needs to be supplemented with a coherent but simple BYOD management strategy, underpinned by three elements: device control policies, device-level security and mobile workforce security training."
About the Research
Between July 30 and August 1, 2012 Webroot commissioned a study of endpoint and mobile security decision-makers in companies with 10 or more employees in the US, UK, and Australia. The scope of the research included both BYOD and company-owned mobile devices. Research Now provided respondents from their online panel of IT and business executives. A total of 741 people responded to an online survey hosted by Qualtrics. The margin of error for the study is +/-