Teaser:
As consumers continue to purchase smart phones and other portable devices at a rapid clip, they are increasingly bringing these devices inside organizational networks, according to a study by Cisco Systems.
As consumers continue to purchase smart phones and other portable devices at a rapid clip, they are increasingly bringing these devices inside organizational networks, according to a study by Cisco Systems. This trend is creating data loss and other security risks, it states.
About 40 percent of organizations have detected unsupported devices on their networks, according to the study, which was conducted by InsightExpress and surveyed about 500 IT managers in the United States, Germany, China, India, and Japan. Approximately the same percentage of respondents also said they had experienced data loss because of such devices.
(For more on the incredible power of smart phones for good and ill, see "DHS Wants to Turn Cell Phones Into Chemical Sensors " and "BlackBerry App Can Spy on You, US CERT Warns .")
Many IT managers reported having security policies and controls in place. Seventy-five percent of respondents said they had written policies that included consequences for noncompliance. Forty percent said they employed technical measures to block unauthorized devices from the network.
But such safeguards are unevenly applied and enforced, according to John Girard, a Gartner Research vice president, speaking at a recent Gartner conference in Washington.
Many organizations could significantly reduce risks by implementing and enforcing a key set of measures, he said. These include requiring the use of encryption and some form of authentication, he said. They also include setting devices to “time out” after about 20 minutes as well as employing some form of remote data wiping technology. Employees should also be accountable for noncompliance.
Many organizations should also consider security software, he said, which can help ensure that devices connect in a safe manner, use certain security features, and receive regular security updates, for example.
Seventy-five percent of Cisco respondents said IT departments should hold principal responsibility for writing, communicating, and enforcing security policies. Security is most effective, according to Girard, when IT executives work with other departments, such as human resources, to craft and enforce policy.
♦ Photo by Gonzalo Baeza Hernandez/Flickr
Powered by: Phase2 Technology
Comments