Other cyber shoe waiting to drop on BYOD
Connecting state and local government leaders
Lax security could soon threaten the gains agencies have made by letting employees use their own mobile devices for work, a new study says. There are basic protective steps agencies can take now.
Government employees using mobile devices for work are realizing billions of dollars a year in increased productivity, a new study found, but those gains could be threatened by a lack of security for the devices.
The vast majority of employees use devices such as laptops, tablets and smart phones outside the office, and most smart phone and tablet users are using personal devices rather than those issued by their agencies, according to the study by the Telework Exchange. But there is a general lack of policies for how bring-your-own devices — BYOD — can be used and how they should be protected.
“Even basic measures like passwords are not highly used,” said Kyle Keller, director of the federal cloud business division of EMC, a sponsor of the report. “Whether or not an agency has a BYOD policy, the devices are coming. This is something we have to address in the short term.”
Keller identified initial steps to address the situation:
- Recognize that personal devices are being used for work.
- Develop and enforce policies for their use and protection.
- Identify options for available technology that can easily help protect the devices.
The Telework Exchange is an advocacy group for telework in the government workplace. The study, sponsored by EMC, VMware, Cisco Systems and Carahsoft Technology, was based on an online survey of 314 federal employees who use mobile devices and claims a margin of error of 5.49 percent with a 95 percent confidence level.
Respondents claim an average of nine hours saved each week through improved communications and collaboration with colleagues and better customer service. The study extrapolates this to an annual savings of $28.4 billion.
Despite security concerns, those savings are unlikely to have been compromised yet through security breaches of mobile devices. The study cites a Government Accountability Office report showing a 185 percent increase in mobile malware between July 2011 and May 2012, but to date most mobile malware targets foreign users, often Chinese. In this country, mobile devices typically are not used for financial transactions or to access and store sensitive data, and exploits for them have tended to be less sophisticated.
But the growing functionality of the devices and their use in the workplace could make them attractive targets for espionage in the near future.
Keller said he believes mobile security can be improved without hurting productivity. “You don’t want to take productivity gains in lieu of security protections,” he said. “We should be able to maintain productivity while improving security.”
But heavy-handed security practices on mobile devices that are provided and managed by agencies have driven some workers to use personal devices instead, according to some respondents in the survey. “Because of the multi-layer security on my work device, it is sometimes easier to get work done by e-mailing it to my much faster personal device which has less security,” one respondent is quoted as saying.
Some security requirements are challenging. Federal workers and contractors are supposed to use digital certificates contained in Personal Identity Verification cards for accessing government IT resources. This is far from universally implemented on desktop and laptops, and rarely required for smart phones and tablets because they usually do not have built-in card readers. Enforcing the requirement on personal mobile devices would mean retrofitting them with card readers, which could be expensive, cumbersome and unpopular.
But there are some basic security precautions that can be taken relatively easily, Keller said. Requiring the use of strong passwords is one step that should be taken, and it is possible to enable some forms of two-factor authentication and protections such as remote data wiping with software.
Agencies “have to decide what applications to deliver to devices based on what is available,” he said.