Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:09 PM
Connect Directly

RSA Reports Address Rise In Enterprise Adoption Of Consumer Technologies

Survey of IT and security pros shows most organizations giving end users more leeway and influence in social networking, gadgets

While the majority of IT and security leaders in enterprises believe end-user influence on the adoption of applications and devices is on the rise, few felt they have the proper security in place to handle the addition of these technologies, according to a new report.

RSA, the security division of EMC, today published two reports on the so-called consumerization of IT -- one from a survey it commissioned from IDG and another from the Security for Business Innovation Council (SBIC), which provides recommendations for managing this changing technology landscape.

Sam Curry, CTO for global marketing at RSA, says he was surprised at the high percentage of enterprises in the IDG survey that are embracing consumer-driven tools, such as smartphones, social networking, and iPads. "The big numbers were the first thing that leapt out at me," Curry says. "I had expected more resistance."

Among the IDG survey of about 400 IT and security professionals, 76 percent say they believe end users are increasingly having more influence in device and application purchase decisions in their organizations, more than 60 percent say users have a say in the types of smartphones that are procured, and 20 percent say they let users make the call on the brand. More than half say users get input on netbook purchases, and half say they give them a say in tablet computing decisions.

More than one-fourth of the respondents say their users are allowed to use their own PCs or mobile devices for work, and more than 80 percent permit social networking -- 62 percent of whom use it for business communication.

The catch: Only 11 percent are "very confident" that they have the proper security in place to lock down these consumer devices and apps. And 23 percent admitted having a serious breach occur due to a personal or consumer device on their corporate network.

Curry says it was surprising that even with nearly one-fourth of the organizations suffering security breaches due to these devices, they still supported the technologies. "They are still saying, 'We have to embrace this,'" he says.

Just more than 20 percent of the organizations say they had "thoroughly" assessed the risk of bringing these technologies in-house, while 40 percent say they hadn't calculated their risks at all. Another 38 percent say they had assessed the risks in some cases, but not all.

The SBIC report, meanwhile, recommends that IT security teams shift their thinking from one of command and control to more oversight and business enablement, and leverage users as tech-savvy resources in a two-way dialogue. Other tips: calculate the risks associated with user-driven IT, get up to speed on consumer tools, stay ahead of the curve in new trends, and work more closely with vendors.

"You have to frame the discussion on risk and reward," RSA's Curry says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-26
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
PUBLISHED: 2020-02-26
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
PUBLISHED: 2020-02-26
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a spe...
PUBLISHED: 2020-02-26
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could expl...
PUBLISHED: 2020-02-26
A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input vali...