Rising Security Risk Posed By Mobile Device Losses

Mobile devices are increasingly becoming a key security risk for enterprises as employees access sensitive company information using smartphones, tablets, laptops and netbooks. However, most employees are not thinking enough about protecting corporate data when using these devices, a recent survey shows.

One in three employees polled kept sensitive work-related information on their mobile devices, according to a report published by McAfee and Carnegie Mellon University. Even though 95 percent of companies have mobile-security policies in place to protect enterprise data, two-thirds of employees were not aware of their organisations’ policies, the survey found.

Employees Do Not Understand

Most of the companies surveyed reported their employees do not understand how permissions and other access settings on their mobile devices work.

The mobile device problem goes both ways. While many employees use their personal devices to handle work-related tasks, such as accessing corporate email and viewing documents, nearly 63 percent of work-issued mobile devices were being used by employees for personal activities, the report found.

“Devices are no longer just consumer devices or business devices. They are both,” said Richard Power, a CyLab Distinguished Fellow at Carnegie Mellon University and the primary author of the report.

The survey found that 72 percent of devices used for work were laptops, and 48 percent were smartphones. Just 10 percent of devices used by the respondents were tablets. Almost half of organisations said they were very reliant on mobile devices and 70 percent claimed to be even more reliant than they were 12 months ago.

BlackBerries are no longer the enterprise standard as businesses now operate in a “heterogeneous mobile environment”, the report said.

The biggest mobile security concern for organisations was the fact that sensitive data was getting compromised when these devices were lost or stolen. About 40 percent of the companies participating in the survey have experienced the loss or theft of mobile devices and nearly half of those devices contained “business-critical data”.

Over 33 percent of those devices had a “financial impact” on the organisation. The exposed sensitive data included user data such as contacts, phone logs, email, documents and text messages, and other data such as customer information, corporate intellectual property, financial documents and employment records.

“Data loss remains a huge problem for both consumers and businesses,” said Todd Gebhart, executive vice president and general manager of the consumer, small business and mobile group at McAfee.

Seeking Geo-Location Technology

The study found that organisations are considering using location-based technology to track down lost devices. “It may provide a loss of privacy to the employee, but the increased recoverability of the device to the user,” CyLab’s Michael Farb said in the report.

Considering that banks can tell when someone is using a credit card in unusual locations and can take steps immediately, researchers were surprised that companies are not using similar location-aware products to protect their data. Behaviour monitoring combined with location can “significantly” strengthen mobile security.

“I find it disturbing that only 22 percent are using location now and that 30 percent are not even considering it,” Martin Griss, director of the CyLab Mobility Research Centre, said in the report.

Risky behaviour and weak security measures are commonplace, said the report. Companies were concerned those mobile devices may introduce malware onto the network or that employees might share sensitive data in unauthorised ways. Fewer than half of users back up their mobile data more than once a week, and nearly half of the users store passwords, pin codes or credit card details on their mobile devices. One in three stored sensitive work-related information on their mobile devices, the report found.

Businesses need to be savvy about the risks involved with enterprise mobile use, set more nuanced policies, and provide increased education for employees so that they understand policies and why they are in place, the researchers concluded.

Over 1,500 individuals from 14 countries were included in the “Mobility and Security: Dazzling Opportunities, Profound Challenges” survey. The report focused on the consumerisation of IT and its impact on security by looking at two perspectives, that of a senior IT executive in companies with more than 100 employees and of the general “end users” with mobile devices in the workplace.