Many Companies Fail With BYOD Security: Champion

According to Champion’s Real-World Mobile Device Security Practices study – a survey of 447 IT decision-makers – more than one-half of organizations don’t have a formal BYOD policy and more than three-quarters aren’t requiring multi-factor authentication for mobile devices connecting to their applications and network resources.

“This research we conducted is very important and relevant in today’s mobile workforce,” said Chris Pyle, president and CEO of Champion and MessageOps, its Microsoft Cloud business unit.

“Our goal is to present businesses both large and small with the facts uncovered in the report to assist them with developing policies around enterprise mobility services. Many of our customers would like to know if their policies are too constraining or too loose, and this gives them the ability to compare to their peers in the same industries and size of business.”

While businesses may not be taking a formal enough approach to mobile device management, Champion found that businesses do practice some good mobile-security fundamentals. Eight out of 10 organizations, for example, require lengthy, mixed alphanumeric passwords. Nearly three-quarters don’t allow for the re-use of a recent password when requiring updates. In addition, one-half of businesses require password resets at least every 90 days, while 25 percent require resets every 45 to 60 days.

Yet the existence of mobile-security best practices in many organizations doesn’t necessarily result in good data protection. From the study results, one can infer that many organizations apply mobile security inconsistently, which leads to gaps and vulnerabilities. Even larger, heavily regulated businesses don’t implement the best practices, despite their resources, the study found.

“The results are very interesting,”

“What you’d expect from a larger organization is not necessarily in line with what all of the results show, and the same [is true] for some smaller companies,” said  Jason Milgram, director of software development at Champion and MessageOps. ” I definitely encourage businesses to review the information, look at the policies they have or do not have in place, and use the research as they update their mobile-device security strategy.”

Champion said that businesses need to exercise more diligence in their mobile-security strategies and operations and recommended that firms formalize BYOD usage policies, requiring strong passwords on all mobile devices, institute access-control provisions, including automated lockouts for failed log-in attempts, and requiring regular password resets.