How secure are your mobile devices?
Information Week has published an interesting report, 2012 State of Mobility Security. Their study showed that 90% thought mobile devices were a threat to their network. The top concern by far was loss or infection of a device (see page 9 for other risks).
The report sounds an alarm, concluding that while 86% either permit (62%) the use of personal devices or are moving that way, most (69%) have issues with their mobile security policies and practices. For example:
- 80% only require passwords
- Just 14% require hardware encryption
- Only 40% both limit the range of devices user can have and require that they be connected to a mobile device management system (such as Sybase’s Afaria)
- 42% will allow any device, asking only that employees agree to company policies
- Only 20% has systems to detect malware on all their mobile devices
- Just 29% have an internal ‘app store’
- 24% companies are still using WEP technology, shown to be weak by the TJ Maxx disaster, where the company paid $50m to settle with those affected by the compromise of some 45 million debit and credit card numbers.
The report should be required reading for all those responsible for IT security. It includes discussions of the technical issues together with a number of essential recommendations.
You may also want to see my review of an earlier, in-depth study by the Ponemon Institute. That identified some additional issues that require attention.
I welcome your views.
PS – if you are interested in SOX compliance, please check out my book on optimizing your program.
Recent Posts on this Blog
- Risk in the Fourth Dimension January 15, 2017
- How much cyber risk should an organization take? January 7, 2017
- The real risks: the ones not in the typical list of top risks December 31, 2016
- An expert shares his views on the future of risk management December 18, 2016
- Selecting software to help manage user access risk December 17, 2016
- User access risk and SOX compliance December 12, 2016
- Risk and Culture December 9, 2016
- New guidance on operational risk December 3, 2016
- Why do so many practitioners misunderstand risk? November 26, 2016
- A new front opens in the SOX battle November 20, 2016
- Internal audit reports do the function a great disservice November 12, 2016
- My new book on Auditing that Matters is available November 9, 2016
- Time for a leap change in risk management guidance November 5, 2016
- Cyber security and the board October 29, 2016
- The biggest obstacle to effective risk management October 28, 2016
- An Important Cyberrisk Framework January 16, 2017
- Deloitte Shares a List of "Risk" Trends to Watch in 2017 and Beyond January 9, 2017
- What Does the New Year Hold for Internal Audit? January 5, 2017
- The Decision-maker's View of Risk December 19, 2016
- How Much Cyberrisk Should We Take? January 4, 2017
- Do We Know How to Audit Technology-related Risks? December 5, 2016
- The State of Information or Cybersecurity November 28, 2016
- Back to the Future for Internal Audit November 21, 2016
- How Do You Change the Culture of the Organization? November 15, 2016
- Why Does ERM Fail So Often? November 7, 2016