Four in 10 Kiwis unaware of mobile security policies

Kiwi organisations are unaware of company security policies despite acknowledging mobile security as a top priority.

According to findings from research group Unisys, while most Kiwi firms are implementing security measures related to smartphones and tablets in the workplace, many are not enforcing them consistently.

The 2012 New Zealand "Consumerisation of IT" research into enterprise mobility found that 80% of companies believe security to be of great concern when allowing employees to access business data via a smartphone or tablets.

Despite coming in considerably higher than the global average of 56%, fewer firms are taking sophisticated security measures with only 37% considering token-based authentication and 10% biometric-based authentication.

"Most organisations are relying on passwords, a relatively primitive solution, to secure their mobile devices and applications," says John Kendall, security program director, Unisys Asia Pacific.

"A truly effective security approach requires a combination of strong policy and technology as well as the means to enforce both.

"The risk of a data breach via compromised passwords is higher in a mobile environment because mobile devices can be easily lost or stolen.

"Unisys recommends that organisations consider multifactor authentication, where the employee is identified not only by 'what they know' (a PIN or password) but also by 'who they are' (a biometric such as a fingerprint or face scan) to protect sensitive assets."

The report says 73% of surveyed New Zealand organisations cite implementing or improving mobile security as being a top priority in the next year as 67% aim to deploy password-based authentication for mobile users by 2013.

"BYO apps bring a two-fold security risk, sometimes easily downloadable apps can be malicious vehicles for network breaches and data theft," Kendall says.

"To avoid negative consequences of employees' using unauthorised software, organisations can create a company 'app store' that contains approved, secure software – either developed internally or purchased from a third party – to safely provide employees with the capabilities they need to do their work productively.

"The good news is that today's mobile world is necessitating – and enabling – sophisticated new approaches to security.

"For example, attribute-based access control is an emerging technology that grants access based not only on the nature of the data and the individual requesting access.

"It also factors in the location from which access is being requested and the method used to authenticate identity – for example, requiring a fingerprint rather than a password for access to more sensitive information.

"Attribute-based access control also identifies anything about the access request outside the employee's normal pattern, such as attempts to access information they don't normally access or at hours outside their normal work schedule.

"Such approaches help stop data breaches before they happen by automatically enforcing appropriate security measures."

Is your company doing enough to improve security? Tell us your thoughts below