Smartphones causing IT security headaches

Corporate IT teams are increasingly concerned about the consumerisation of mobile IT, as around half of employees now use personal mobiles to connect to corporate systems, according to the latest research from analyst firm Ovum.

The study, Corporate Mobile Device Use and Security, was carried out in association with independent non-profit organisation the European Association for e-Identity and Security.

Ovum found that nine out of 10 organisations either provide, or will soon provide, mobile devices for employee use, while nearly three-quarters of employees are allowed to use corporate devices for personal activities.

The cross-over between corporate and personal use continues, with 48 per cent able to connect to the corporate network with a personal device.

Eighty per cent of respondents believe that smartphones expose their business to attack, citing data leakage as a top security concern.

"It is unrealistic to delineate between these uses for employees who are mobile and working out of the office for a large part of the time," said Ovum analyst Graham Titterington.

"That means organisations must establish an holistic security strategy that addresses the consumerisation of this fast-growing channel into corporate networks and data."

However, the report found that security provision is patchy. Only 18 per cent use Public Key Infrastructure certificates, for example, and just nine per cent have two-factor authentication featuring one-time passwords.

Christian Brindley, European regional manager at Symantec's VeriSign Authentication division, warned that employees using a corporate device to access personal web-based applications or email accounts could inadvertently download a virus to their work device or put sensitive corporate information at risk.

"It is unrealistic for organisations to ban employees from using their corporate devices to access personal applications, and vice versa," he said.

"Instead, companies need to have comprehensive mobile security policies in place and a layered security strategy."

IT departments could also use technologies like Managed Public Key Infrastructure to encrypt and decrypt confidential information and generate and verify digital signatures, Brindley explained.