BYOD resistance loosening but security practices lacking

A survey of 650 information and security professionals about how the "bring your own device" (BYOD) trend is impacting their organisations finds one-quarter of them forbid use of personally owned devices such as smartphones and tablets on the network. However, the majority that do often lack meaningful policies or security controls related to these devices.

The "SANS Survey on Mobility/BYOD Security Policies and Practices" found about one-third acknowledging they lack meaningful BYOD security policies. When asked what kind of products or services they're utilizing for mobile devices, roughly half indicated a mix of data protection via encryption, secure access to corporate resources, while less than half used anti-malware or data-loss prevention, for example. However, 67 percent expects to implement cloud-based provisioning in the next 12 months.

This is the second time SANS has conducted its survey on BYOD, and in March, 37 percent of the 650 respondents didn't allow personal devices on the network and 58 percent didn't have BYOD-related policies -- indicating BYOD is increasingly being adopted as a practice. The SANS report on BYOD, authored by Kevin Johnson and Tony DeLaGrange, both with consultancy Secure Ideas, claims there's been "improvement" in addressing BYOD security and management -- but that there's still too much reliance on just hoping the BYOD user does what he or she promised.

The SANS survey this time around shows those who do have policies are mainly turning to technologies they're familiar with, such as authentication, access controls, firewall and VPNs, and applying them to mobile devices.

"Interestingly, mobile-specific solutions, such as mobile-device management (MDM), are not as high on the list as many would have thought," the SANS BYOD report states. "This is not surprising considering some of the confusion around agent, agentless and best-of-breed issues in a constantly changing market."

SANS also said it appears that, just as in the first survey last spring, employers are reluctant to add controls directly onto employee-owned devices because the devices don't belong to the organisation. "Many seem to relying heavily on employee agreements and education," it's pointed out.

The survey notes that 32 percent of organisations count on the user to protect the device and remove data when they're finished with it. The results of that effort are dubious. "Such an approach has failed in almost every other technology operated by end users," the SANS report concludes.

Follow CIO on
Twitter @cio_nz
Facebook
LinkedIn

Download CIO for your tablet here.

Click here to subscribe to CIO.

Sign up to receive free CIO newsletters.

Send news tips to divina@cio.co.nz