Enterprises Understand But Ignore the Risks of BYOD

A poll of 4,500 IT personnel across 83 countries indicates that businesses and organizations understand the inherent security risks that come with Bring Your Own Device (BYOD) initiatives, but only a few were doing something to address those risks. Moreover, the survey results revealed that only a few companies have the resources to address BYOD risks.

Carried out by ISACA, an organization of global IT professionals, the Risk/Reward Barometer 2012 study surveyed management-level (and above) IT professionals in October 2012. The global survey results showed, among other things, the percentage of companies that have yet to include BYOD in their security policies and have switched to private, public, or hybrid cloud-based models.

A large percentage of the respondents knew, for instance, that the practice of storing passwords in a file saved in an employee's personal device places the company's security at risk. Other findings uncovered from the study included the fact that many businesses view the individual behavior of an employee as a potentially high-risk factor and that BYOD issues are still yet to be resolved.

Other high-risk events and activities identified by enterprises include the loss of a company-supplied smartphone or computer, the use of online file-sharing services for work-related files, and travelling with mobile devices that store company or business-related data.

In addition to acknowledging and understanding BYOD risks, less than half of the respondents admitted to encrypting data stored in personal devices, using password management systems, or enabling remote wipe capability.

Moreover, most respondents do not restrict or ban location-based apps that can be readily used to track a staff member. The reason given was the lack of resources and management support.

Ramsés Gallego, ISACA's international vice president and security strategist for Dell Quest Software, said that the Risk/Reward Barometer 2012 study confirmed that enterprises are, indeed, making an effort to keep up with BYOD and manage the risks associated with it.

"Organizations must embrace BYOD, as it's the way people want to work," Gallego said. "And, while BYOD sounds like an invitation to bring a personal device [to work], the truth is people are using their devices whether the organization wants them to or not."

"The bottom line is protecting data, and ultimately the brand. For many, this may mean the capability to remote wipe devices - regardless of ownership - when a serious risk is inevitable," Gallego added. (KOM) Link.