The Bring Your Own Device trend has created a security “Achilles Heel” for a 56% majority of organizations that have no response plan in place to deal with lost, stolen or hacked BYOD notebooks, tablets and smart phones. And 56% of organizations also acknowledge they are not fortifying their existing security measures, taking extra precautions or implementing security training despite recent high profile security attacks against Fortune 1000 firms like Adobe, Reuters, Target, Skype, Snapchat and others.
Equally alarming is that 50% of companies concede their corporate and employee-owned BYOD and mobile devices may have been hacked without their knowledge in the last 12 months, consequently leaving their datacenter servers and mission critical applications vulnerable to internal and external security breaches. Anecdotal evidence obtained from first person customer interviews indicates that 75% of IT and security managers are now lobbying executive management to construct mobile and BYOD-specific security policies to plug potential vulnerabilities.
Those are among the top findings of the ITIC/KnowBe4 “2014 State of Corporate Server, Desktop and BYOD Security Trends Survey.” The joint independent Web-based survey polled 300+ organizations in February 2014 on a wide range of issues including the organization’s approach to security; the biggest security threats and challenges facing their firms and the company’s preparedness to recognize and react to potential breaches.
BYOD and mobile usage offers many advantages for organizations and end users. On the positive side it enables businesses to reduce expenditures and lower the administrative burdens of IT departments as end users manage, maintain and in many cases pay for their own devices. It also provides businesses and their end users with increased productivity because they have flexibility and mobility to access their Emails and corporate data 24 x 7.
THE BYOD & MOBILITY CONUNDRUM
There is also no denying BYOD trend is a two-edged sword.
The potential downside: it is much more difficult for IT to monitor and secure BYOD and mobile devices. Users control their smart phones, notebooks and tablets, making it extremely challenging for IT to prohibit them (or even determine) when they access suspect sites or download infected code. BYOD devices can create undetected entry points into the network and their massive numbers increase the chances of a successful penetration. Another potential risk with mobile devices is the ever-present threat of loss and theft. It is this issue that is presently causing IT and security professionals the most angst.
The proliferation of Bring Your Own Device (BYOD) usage, coupled with the continual increase in remote access and the rising mobile workforce, constitute a potentially pernicious security threat to corporate data and the datacenter.
ITIC/KNOWBE4 2014 STATE OF SECURITY SURVEY HIGHLIGHTS
Among the other survey highlights:
- Over two-thirds – 68% of survey respondents indicated that their servers and mission critical server-based applications had NOT experienced a security breach within the last year.
- An 80% majority of firms consider strong anti-virus, intrusion detection and firewalls the most important/critical element and most effective mechanism to safeguard their networks followed by endpoint security (65%) and physically limiting access to the server room/datacenter (60%).
Some 34% of survey participants acknowledged that they either “have no way of knowing” or “do not require” end users to inform them when there is a security issue with employee-owned BYOD devices. This makes the corporation very vulnerable!
- One-third – three-in-10 respondents are unaware or unable to discern whether or not BYOD security breaches impacted servers, mission critical apps or network operations.
- One-third – 32% – of survey participants indicated their firms have “No BYOD or mobility-specific security in place” or are “Unsure” if they do.
CONCLUSIONS
Individually and collectively, the inability of a significant segment of corporations to track and secure both company and employee-owned mobile and BYOD devices undermines IT and security administrators’ efforts to secure the environment. It also creates a larger attack vector for hackers. And it makes servers and mission critical applications more vulnerable to infection by rogue code, malware or sensitive data that was hijacked when a BYOD device’s security was compromised.
Without the appropriate level of security controls, the adoption of security awareness training and the implementation and enforcement of strong computer security policies and procedures organizations’ data is at increased risk of malware invasions, cyber attacks and litigation.
ITIC and KnowBe4 strongly advise organizations irrespective of size or vertical market to proactively devise a plance to respond to potential BYOD security incidents. Businesses should also invest in security training for their appropriate IT staff and end users and update existing computer security policies and procedures to implement specific mobility and BYOD provisions.
No tags for this post.