Corporate employees, and to a lesser extent IT managers, are taking a surprisingly lax approach towards security issues raised by the business use of personally owned smart phones and other mobiles devices, according to two surveys.
The surveys found that most companies have adopted policies governing the use of personally owned mobile devices, though less than one in five companies said they have controls in place for enforcing those policies.
Enterprise users were found to be deeply suspicious of any IT effort to implement security controls on their devices. In fact, many said they would choose not to bring personal devices to the workplace if employers planned to install security software on them.
Security vendor Webroot commissioned Harris Interactive to conduct two surveys.
In one survey, Harris polled over 900 adults working full time or part time at US companies. The second survey included interviews with more than 200 individuals who described themselves as IT decision makers in US companies with more than 500 employees. Both surveys were conducted online earlier this year.
The results of the surveys surprised Mike Malloy, executive vice president of products and strategy at Webroot. Despite the clear risks bring your own device (BYOD) policies pose to enterprise networks and data, many large companies are still struggling to exercise real control over the devices.
The surveys reveal a large disconnect between how employees are using personal mobile devices and the manner in which companies have implemented Bring Your Own Device (BYOD) policies, Malloy said.
For instance, 98% of the IT managers surveyed said their companies had BYOD security policies in place. About a third said their companies required employees to install an IT-mandated security application on their mobile devices while 20% said that personal devices can access their corporate network only if the devices had the requisite security controls in place.
Yet, fewer than 20% of the IT managers surveyed said their companies had yet to create way to enforce the policies, Malloy said.
Despite BYOD policies and controls IT managers say have been implemented at their companies, less than 20% of workers connected to corporate networks said they had installed a full security app on their personal devices.
The survey also revealed a reluctance on the part of workers to allow IT personnel install security software on their devices.
More than half of the employees surveyed feared that the company would gain access to their personal data via corporate security tools. Some 46% of workers said they feared personal data would be lost if they left the company. The same number feared a company-mandated security app installed on personal devices would let managers track their location.
Nearly half of worker said they would stop using personal devices at work if they were required to install a company-mandated security application.
The surveys show the need for better communication between IT organisations and workers on BYOD security, Malloy said.
Many companies let workers access enterprise applications via personally owned devices because of the perceived productivity benefits. But without proper controls, companies will continue face serious security challenges from personally owned devices, he said.
Jaikumar Vijayan, Computerworld
Ltd
