Security Practices Needed As BYOD Use Grows

The impact of bring-your-own-device (BYOD) on organizations has been surveyed by SANS, and of 650 information and security professionals questioned, one in four forbade use of personal devices on the workplace network.

The survey titled, "SANS Survey on Mobility/ BYOD Security Policies and Practices," authored by consultancy Secure Ideas' Kevin Johnson and Tony DeLaGrange, found that one-third of those questioned noted a lack of meaningful BYOD security policies in their workplace.

The products and services utilized for mobile devices incorporated a mixture of data protection or services utilized for mobile devices, and around half suggested a combination of encrypted data protection and secure access to corporate resources. Under half of those surveyed used anti-malware or data-loss prevention, but 67 percent anticipate an introduction of cloud-based provisioning in the next 12 months.

This is the second SANS survey on BYOD; in March of this year, 37 percent of 650 survey participants noted that personal devices were forbidden on the network and 58 percent did not have policies relating to BYOD. Since the last survey, the BYOD trend has continued to grow and is increasingly being adopted in the workplace. There has certainly been an "improvement" with regard to the expansion of BYOD security and management, but there also remains much dependence on simply trusting the BYOD user to do what they promise, and this needs to change.

This new SANS survey illustrates that a growing number of workplaces are implementing BYOD policies, and are favoring the use of more familiar technologies, for example, authentication, access controls, firewalls and VPNs, in addition to incorporating them into mobile devices.

The SANS BYOD report states, "Interestingly, mobile-specific solutions, such as mobile-device management (MDM), are not as high on the list as many would have thought. This is not surprising considering some of the confusion around agent, agentless and best-of-breed issues in a constantly changing market."

Both the March and present SANS surveys note that employers remain reluctant to make direct changes to the controls of employee-owned devices because they are not owned by the organization. It is highlighted in the report that "Many seem to rely heavily on employee agreements and education."

To mention finally, 32 percent of organizations rely upon users to ensure their devices are protected and to remove data when they are finished using it. It is unclear what results these efforts produce, and the SANS report ends, "Such an approach has failed in almost every other technology operated by end users." One thing is clear, however: the growth of BYOD use needs to be met with balanced security precautions. (CY) Link