BYOD resistance loosening but security practices lacking
The "SANS Survey on Mobility/BYOD Security Policies and Practices" found about one-third acknowledging they lack meaningful BYOD security policies. When asked what kind of products or services they're utilizing for mobile devices, roughly half indicated a mix of data protection via encryption, secure access to corporate resources, while less than half used anti-malware or data-loss prevention, for example. However, 67 percent expects to implement cloud-based provisioning in the next 12 months.
This is the second time SANS has conducted its survey on BYOD, and in March, 37 percent of the 650 respondents didn't allow personal devices on the network and 58 percent didn't have BYOD-related policies -- indicating BYOD is increasingly being adopted as a practice. The SANS report on BYOD, authored by Kevin Johnson and Tony DeLaGrange, both with consultancy Secure Ideas, claims there's been "improvement" in addressing BYOD security and management -- but that there's still too much reliance on just hoping the BYOD user does what he or she promised.
The SANS survey this time around shows those who do have policies are mainly turning to technologies they're familiar with, such as authentication, access controls, firewall and VPNs, and applying them to mobile devices.
"Interestingly, mobile-specific solutions, such as mobile-device management (MDM), are not as high on the list as many would have thought," the SANS BYOD report states. "This is not surprising considering some of the confusion around agent, agentless and best-of-breed issues in a constantly changing market."
SANS also said it appears that, just as in the first survey last spring, employers are reluctant to add controls directly onto employee-owned devices because the devices don't belong to the organisation. "Many seem to relying heavily on employee agreements and education," it's pointed out.
The survey notes that 32 percent of organisations count on the user to protect the device and remove data when they're finished with it. The results of that effort are dubious. "Such an approach has failed in almost every other technology operated by end users," the SANS report concludes.
Follow CIO on
Download CIO for your tablet here.
Click here to subscribe to CIO.
Sign up to receive free CIO newsletters.
Send news tips to firstname.lastname@example.org
Chief flexibility officer: The next CIO role?
The world is changing so quickly, and every company's business model has to change as well, says V.C. Gopalratnam, vice president, IT at Cisco. 'You really have to build an organisation that is as flexible as hell.'
IPv6: A new headache or huge opportunity?
IPv6 is here, it's real and it's growing, according to local industry bodies. Deploying IPv6 may not be high on your list of priorities at the moment, but if you start planning now you could avoid escalating costs.
CONNECT WITH @ CIO NZ
CIO is bringing together the best of MIS NZ and CIO, the new look CIO is the only magazine that focuses on the unique management needs of senior IT professionals.
Get the latest news from CIO delivered via email.
MIS 100 REPORT
The definitive guide to New Zealand's largest and most significant ICT users.
READ NOW »