Feeds

Lax mobile security leaves UK.biz at risk

An accident waiting to happen, apparently

Security for virtualized datacentres

Confusion and lack of leadership is leaving many UK businesses exposed to mobile security risks, according to a new study.

Four in five (80 per cent) of 2,035 IT pros surveyed by market analyst firm Quocirca, say ordinary workers constitute the main mobile security threat.

But one in five companies that already have a wide deployment of mobile devices (such as wireless PDAs and smartphones) admit they've failed to implement effective security policies.

Even among respondents that have mobile security policies, three in five (60 per cent) admit the policies are not enforced. This raises questions about leadership within organisations and whether senior staff are treating security as a high enough priority, according to mobile telco Orange, which sponsored the online study.

"Responsibility for security is being placed firmly in the hands of the user, but it's essential that attitudes change and security becomes a shared responsibility between the company and the employee," says Alastair MacLeod, vice president of Orange Business Solutions UK. "There are a number of simple ways to encourage responsible behavior and the first obvious step is to set out a sensible security policy and to engage users through consultation, not prescription. Communication is key."

The survey found business managers were content to leave staff - rather than IT managers or the board - responsible for the data security of mobile devices. Staff were often given a choice over what device they wanted, and the use of passwords or PIN protection was often left up to to them. Even firms with a better understanding of mobile workings frequently failed to keep track of devices or take steps to provide access to corporate resources in a controlled manner.

"There is widespread naivety and neglect in handheld device security," said Rob Bamforth, principal analyst at Quocirca. "However, it is important to realise that both employees and employers have to play their part. Organisations have a duty to develop, communicate and enforce an effective security policy which employees should understand and abide by. Since some users will still have a lax attitude, businesses should place a safety net of measures to deal with the most likely eventualities including backup and contingency planning." ®

Internet Security Threat Report 2014

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.