BROOMFIELD, Colo., Nov. 13, 2012
A new mobile security study finds that the vast majority of organizations that allow employees to BYOD (bring your own device) are experiencing high rates of mobile threats, including lost or stolen devices, malware, and compromised company data. Conducted by Webroot, a leader in delivering Internet security as a service, the study exposes that the popular trend of allowing employees to use their smartphones and tablets at work is causing a significant drain on IT resources while at the same time putting corporate data at risk. The full report is available at www.webroot.com/shared/pdf/byod-mobile-security-study.pdf.
The study, which focused on mobile security decision-makers in the United States, United Kingdom and Australia, found an overwhelming 82 percent of respondents believe that mobile devices create a high security risk within the corporate environment. Results show that mobile security is a high priority for half of the companies supporting BYOD, equating to increased help desk support and consumption of valuable IT resources. In addition, 45 percent reported lost or stolen devices in the past year and 24 percent experienced mobile malware infections, crippling productivity and potentially compromising company and customer data.
However, larger organizations, those with 500 or more employees, are at even higher risk. According to the study, 67 percent had dealt with lost or stolen mobile devices and 32 percent had experienced mobile malware infections, creating widespread concern about the business impact of employee-owned devices within the enterprise.
"Supporting BYOD is now a reality for many companies. Contrary to conventional wisdom, we believe that BYOD does not really decrease operational costs. Rather, allowing employees to use personal mobile devices is actually increasing corporate risk and IT costs," said Christian Christiansen, Program Vice President, Security Products and Services, IDC. "Finding a balance between providing employees corporate access and ensuring corporate information security requires analysis, controls, monitoring, and granular policy-based enforcement."
Top-level corporate study findings:
What Can Organizations Do?
Webroot advises that companies take the following steps to reduce the risks associated with BYOD.
"Cyber criminals are increasingly targeting employees as access portals to a company's infrastructure, intensifying the need for controls and layered defenses that can identify and mitigate attacks," said Jacques Erasmus, chief information security officer at Webroot. "As the popularity of employee-owned devices in the workplace continues to grow, this defense needs to be supplemented with a coherent but simple BYOD management strategy, underpinned by three elements: device control policies, device-level security and mobile workforce security training."
About the Research
Between July 30 and August 1, 2012 Webroot commissioned a study of endpoint and mobile security decision-makers in companies with 10 or more employees in the US, UK, and Australia. The scope of the research included both BYOD and company-owned mobile devices. Research Now provided respondents from their online panel of IT and business executives. A total of 741 people responded to an online survey hosted by Qualtrics. The margin of error for the study is +/- 3.6 percentage points at the 95 percent level of confidence. 553 of the respondents were from BYOD (Bring Your Own Device) companies, organizations that allow employee-owned smartphones or tablets to access the company network for work purposes. The margin of error for the BYOD subsegment is ±4.2 percentage points.