50% of US Businesses Have No Formal BYOD Policy

Years after the widespread adoption of workplace smartphones, more than half of US companies said they have no formal BYOD (bring your own device) policy to safeguard their enterprises, according to a survey.        

The survey of 447 businesses of all sizes was conducted over the summer by systems integrator Champion Solutions Group. It found that 53% of those businesses haven't implemented a formal BYOD policy, while more than one-fourth confessed they have no systematic security approach, much less a formal policy.

The survey findings are "ridiculous … surprising," said Champion CEO Chris Pyle, in an interview. Mobile security and best practices have been promulgated by analysts and security firms for more than a decade to protect sensitive corporate data, but there is apparently widespread variation about how companies implement security for BYOD workers.
"The evidence is indisputable that a growing need exists for more stringent application of security policies and procedures in modern businesses," Champion wrote in an 18-page white paper describing the survey's findings.

The value of allowing workers to use their personal smartphones and tablets while at work is now well understood by companies, and has been tied to greater productivity because workers find and use applications and services for their phones that they personalize to become more efficient. But Pyle said there can be a downside. "You need to have workplace freedom, but you need to have a framework as well," he said.

In addition to the lack of formal BYOD policies, the survey found that only 21% of businesses are using multifactor authentication (MFA) to verify a user's identity when granting access to critical enterprise applications and data. MFA covers a wide category of techniques to require two or more methods of authentication from independent categories of credentials when a person logs in from a device.
MFA techniques deployed by US businesses rarely include biometric authentication, where a fingerprint or iris scan is used to support a user name and password to authenticate a user's access to corporate data, Pyle said. Sometimes, instead, a unique code, or token, is sent to a smartphone for each entry into a company's applications or other data.

More often, companies rely on enterprise rights management software to grant a group of users — such as sales managers — access to a certain set of data from their phones — such as sales in a certain district. But that approach doesn't guarantee that every instance of access is from the authorized user. It could be from someone else who may have stolen a phone or used it temporarily, unbeknownst to the owner.
"Right now, there's some confusion and trepidation in the market about MFA," said Jason Milgram, director of software development for Champion. "None of our customers are incorporating biometric authorization into their security plan, even though they will eventually. Many are focused on enterprise content rights management and all of them are working out their strategy. When we bring up the subject of biometrics, people know about it and ask us, 'Can you show us or tell us.' "
While newer iPhones and many Android phones, like Samsung Galaxy smartphones, use fingerprint scanners for a user to access the phone itself, companies are only just beginning to consider using the fingerprint scanner to access enterprise apps or data, Milgram said. Some companies are relying on partitioning of personal from work data within the operating system of some newer phones, but even that approach may not be secure enough, depending on the level of risk that a company can tolerate.

Champion has 2,300 business customers, primarily in health care, distribution and finance. It operates a business unit called MessageOps that helps companies deploy Microsoft Cloud Services, including Office 365, Enterprise Mobility and Azure services. Champion also works as a system integrator to help companies deploy other enterprise mobility management products such as VMware's AirWatch and IBM's Maas360.

The low adoption of MFA for mobile security noted in the survey doesn't surprise Pyle. "There's a lot of good talk by companies about what's coming and what's going to be available, but people aren't implementing what's available today, let alone what's coming tomorrow," he said.
As an example, the survey noted that 23% of companies don't lock out mobile access after a repeated number of sign-in failures. "That's a large percentage, too large," Milgram said. "Someone could launch a brute force attack if nothing is turned off."

The survey also found that 30% of companies don't even require alphanumeric passwords (those using both the alphabet and numbers). "That's a pretty basic precaution," Pyle added.
Champion plans to repeat the survey next year and expects to see a greater focus on security, he said.

Computerworld

« Cyber War Games: ‘Too Little Too Late’
'Jihadi John' Strike: US Says 'We Got Him' »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

PFP Cybersecurity

PFP Cybersecurity

PFP provides a SaaS solution for life-cycle protection based on our IoT security platform and power usage analytics.

Commissum

Commissum

Commissum specialise in information assurance and security testing services.

Acalvio Technologies

Acalvio Technologies

Acalvio provides Advanced Threat Defense (ATD) solutions to detect, engage and respond to malicious activity inside the perimeter.

CSL Group

CSL Group

CSL solutions provide complete end-to-end connectivity services for Security, Fire, Telecare and other mission critical M2M/IoT applications.

Yelbridges

Yelbridges

Yelbridges is your reliable partner in all fields of IT-Security, from developing of Security Policies and Guidelines to the design and implementation of secure processes.

SHIELD

SHIELD

SHIELD is an established end-to-end fraud management solution that blocks fraudulent activities such as account takeovers, fake accounts creation, fraudulent payments, loyalty fraud and more.

Irish National Accreditation Board (INAB)

Irish National Accreditation Board (INAB)

INAB is the national accreditation body for Ireland. The directory of members provides details of organisations offering certification services for ISO 27001.

Civic Technologies

Civic Technologies

Civic’s Secure Identity Platform (SIP) uses a verified identity for multi-factor authentication on web and mobile apps without the need for usernames or passwords.

Swarmnetics

Swarmnetics

Swarmnetics helps customers discover hard-to-find software vulnerabilities by hacking your system before the bad guys do.

Clone Systems

Clone Systems

Clone Systems is an award winning global cloud based managed security as a service provider.

Kainos

Kainos

Kainos is a leading provider of Digital Services and Platforms. Our services include Digital Transformation, Cyber Security, Cloud, AI, IoT and more.

Brookcourt Solutions

Brookcourt Solutions

Brookcourt Solutions delivers cyber security, network monitoring technologies and managed security services to help secure and protect your organisation’s critical infrastructure.

Dynamic Quest

Dynamic Quest

Dynamic Quest is a managed IT, cloud and security services companies, providing a comprehensive range of technology services including cybersecurity, backup and disaster recovery.

ClearHub

ClearHub

The aim of ClearHub is simple: to give businesses like yours access to the best talent, all screened and technically tested by Clearvision’s expert team.

Omega Systems

Omega Systems

Omega Systems is a leading managed service provider (MSP) and managed security service provider (MSSP) to mid-market organizations.

Acclaim Technical Services (ATS)

Acclaim Technical Services (ATS)

ATS provide operational products, services and solutions to the defense and intelligence communities for all types of critical mission needs.