Years after the widespread adoption of workplace smartphones, more than half of U.S. companies said they have no formal BYOD (bring your own device) policy to safeguard their enterprises, according to a survey.
The survey of 447 businesses of all sizes was conducted over the summer by systems integrator Champion Solutions Group. It found that 53% of those businesses haven't implemented a formal BYOD policy, while more than one-fourth confessed they have no systematic security approach, much less a formal policy.
The survey findings are "ridiculous … surprising," said Champion CEO Chris Pyle, in an interview. Mobile security best practices have been promulgated by analysts and security firms for more than a decade to protect sensitive corporate data, but there is apparently widespread variation about how companies implement security for BYOD workers.
"The evidence is indisputable that a growing need exists for more stringent application of security policies and procedures in modern businesses," Champion wrote in an 18-page white paper describing the survey's findings.
The value of allowing workers to use their personal smartphones and tablets while at work is now well understood by companies, and has been tied to greater productivity because workers find and use applications and services for their phones that they personalize to become more efficient.
But Pyle said there can be a downside. "You need to have workplace freedom, but you need to have a framework as well," he said.
In addition to the lack of formal BYOD policies, the survey found that only 21% of businesses are using multifactor authentication (MFA) to verify a user's identity when granting access to critical enterprise applications and data. MFA covers a wide category of techniques to require two or more methods of authentication from independent categories of credentials when a person logs in from a device.
MFA techniques deployed by U.S. businesses rarely include biometric authentication, where a fingerprint or iris scan is used to support a user name and password to authenticate a user's access to corporate data, Pyle said. Sometimes, instead, a unique code, or token, is sent to a smartphone for each entry into a company's applications or other data.
More often, companies rely on enterprise rights management software to grant a group of users — such as sales managers — access to a certain set of data from their phones — such as sales in a certain district. But that approach doesn't guarantee that every instance of access is from the authorized user. It could be from someone else who may have stolen a phone or used it temporarily, unbeknownst to the owner.
Sign up for CIO Asia eNewsletters.