INSIGHTS CUPP COMPUTING MOBILE SECURITY MULTINATIONAL DECISIONMAKERS STUDY 2015

Transcription

1 INSIGHTS CUPP COMPUTING MOBILE SECURITY MULTINATIONAL DECISIONMAKERS STUDY 2015 CHERYL HARRIS, PH.D. DECISIVE ANALYTICS LLC 575 MADISON AVENUE, 10 TH FL NEW YORK, NY January 2015

2 TABLE OF CONTENTS Contents Executive Summary 1 Findings 2 Methodology & Sampling 17 Decisive Analytics LLC 21

3 Executive Summary 1. While mobile security decision makers are well aware of the need to prevent or mitigate targeted attacks, achieving/maintaining regulatory compliance is a close second in terms of priorities. Since many companies are managing multiple compliance standards, ranging from HIPAA, to EU Data Protection, PCI and more, regulatory compliance concerns could well be a primary driver for mobile security adoption in the workplace. 2. Many of the providers of mobile security software were mentioned as among the current vendors being used by managers, including McAfee, Symantec and TrendMicro. Smaller or more specialized vendors mentioned included Good Technology/Bostone, Fiberlink, Airwatch, Samsung KNOX and Zenprise Citrix. While almost a third of smaller companies did not have a provider, most larger companies did. Two-thirds said they were satisfied overall with their current mobile security solution. However, some described several problems with their current solution, and said they were waiting for a "more reliable" and responsive solution that would also provide a cost advantage over current options. 3. Android is targeted as the platform of highest concern, in terms of security threat. All of the major mobile platforms were still seen as worthy of some concern from a security standpoint, and all are in use at most of the companies we included in the study. 4. Interest in the CUPP Computing mobile security solution is high overall, but particularly so among US-based managers. 5. Managers are open to a variety of deployment and procurement options. Larger companies are more likely to prefer self-hosted software in place at their own location, and a centralized procurement option. Still, two-thirds were interested in a "consumerization" model in which direct end-user procurement was enabled. 6. While hopeful that mobile security will become more robust, cost control is still viewed as a primary challenge. Managers are also concerned about convincing their stakeholders that mobile security is a risk or liability that needs to be aggressively addressed. There is also worry that "back doors" to benefit government and/or other commercial interests will compromise mobile security in the future. Page 1

4 Findings Mobile security decisionmakers responding to the survey were reminded that Mobile devices include smartphones and tablets that regularly connect to corporate resources such as , calendar, corporate directory, corporate applications and corporate data in general. Based on this definition, we then asked managers to rate the current priority of several security- related items within their own organization: PRIORITY Achieve and maintain regulatory compliance Prevent and/or mitigate targeted attacks Secure mobile access to corporate applications in the cloud Prevent corporate data loss from mobile devices Deploy mobile anti-malware software % RATING VERY HIGH OR URGENT While all of these issues were a high priority for most of the surveyed managers, preventing or mitigating targeted attacks (68% said it was very high/urgent priority) was ranked the most urgent, followed by achieving and maintaining regulatory compliance (66%.) Managers in US and German companies were significantly more likely to rate both of these issues as a higher priority than were managers in the other countries. Managers within larger companies (1,000 employees or more) were also more concerned than were managers in the smaller organizations. Page 2

5 Compliance requirements related to security differ due to regulations or legal statutes in place in different countries, as well as by industry. Managers reported being subject to multiple compliance requirements, including EU Data Protection, HIPAA, PCI, FISMA, SOX 404 and others. However, nearly two- thirds of the Japanese company managers (64%) said they were subject to none of these, while the US, UK and EU managers reported being required to comply with one or more. Most smaller organizations (<100 employees) did say that they were not required to comply with the mentioned regulatory compliance measures. Page 3

6 Page 4

7 Among the current security software in place at the organizations we surveyed, the most commonly mentioned was McAfee (22%), followed by Symantec (16%.) Interestingly, a third (32%) of the smaller companies (< 100 employees) said they were currently without a security software solution. Page 5

8 Page 6

9 When asked to rank several mobile platforms in order of security concerns, Android was consistently mentioned as the top concern, with almost half (47%) placing it first, followed by Windows phones in second place, then Apple ios and Blackberry. Page 7

10 Page 8

11 We asked a series of questions about how valuable each of four mobile security features were seen to be in the organization. Interestingly, managers varied significantly in terms of their perceptions, depending on the country in which they were working. Mobile security, defined as including Anti- malware, Web Reputation, Firewall, and IPS/IDS features, was seen as highly valuable by most of the managers surveyed (84%.) Nearly as many agreed that Data Protection and Baseline Mobile Device Management was also valuable. While the majority of managers in all countries agreed that all four mobile security features were valuable, French and Japanese managers lagged behind in their agreement. For example, only 70% of the Japanese or French managers said that Mobile Security: Anti malware, web reputation, Firewall, IPS/IDS was quite valuable or extremely valuable, while nearly all German managers (90%), US managers (89%), and UK managers (87%) said so. Larger companies (over 1000 employees) also valued the features more highly than did those from smaller companies. Page 9

12 Extremely/Quite Valuable Mobile Security Feature (Top %) Mobile Security: Anti-malware, Web reputation, Firewall, IPS/IDS 84 Baseline Mobile Device Management: Policy enforcement and compliance 79 Data Protection: Mobile Container, Application Wrapping, Data Loss Prevention 80 About two- thirds of managers said they were satisfied with their current mobile security solution, although French and Japanese managers were the least satisfied. Larger companies (1000 employees and above) were more satisfied with their current solution, and they were also more likely to say they had one in place, than were the smaller organizations. Page 10

13 MOBILE SECURITY FEATURE Mobile Security: Anti-malware, Web reputation, Firewall, IPS/IDS Baseline Mobile Device Management: Policy enforcement and compliance Data Protection: Mobile Container, Application Wrapping, Data Loss Prevention EXTREMELY/QUITE SATISFIED (TOP %) Page 11

14 EVALUTING THE CUPP COMPUTING MOBILE SECURITY SOLUTION We presented respondents with a statement describing a new mobile security solution, followed by a series of evaluative questions: The first hardware security engine for mobile devices is being developed by CUPP Computing. This is a unique hardware-based solution providing mobile security, data encryption, secure communications, anti-malware, web reputation and app behavior analysis for consumer and enterprise. Unlike traditional security software, this is completely independent from the host system as it relies on its own CPU, memory and hardened kernel embedded in a micro-sd module. Patented Technology: The CUPP mobile security engine is a complete self-contained subsystem. It includes a high performance embedded CPU, hardened Linux-based OS, 8 GB of flash and 512 MB of RAM in a micro SD package. It provides a complete stack of security services including firewall, proxy server, DNS filtering, network intrusion detection and prevention, OS integrity monitoring, and remote management. Patented The Technology: statement The was CUPP accompanied mobile by security a prototype engine image is of the CUPP a complete micro- SD self- contained module, subsystem. and we immediately It includes asked a high how interested the respondent would be in the solution, for each of the key mobile security performance embedded CPU, hardened Linux- based OS, 8 areas. GB of flash and 512 MB of RAM in a micro SD package. It provides a complete stack of security services including firewall, proxy server, DNS filtering, network intrusion detection and prevention, OS integrity monitoring, and remote management. Page 12

15 CUPP SOLUTION: MOBILE SECURITY FEATURE Mobile Security: Anti-malware, Web reputation, Firewall, IPS/IDS Baseline Mobile Device Management: Policy enforcement and compliance Data Protection: Mobile Container, Application Wrapping, Loss EXTREMELY/QUITE INTERESTED (TOP %) Interest in the CUPP Computing solution was consistently much higher among US- based managers than in the other four countries, although more than half expressed high interest, and overall, the majority of managers said they were highly interested. Page 13

16 In considering the CUPP Computing mobile security solution, different deployment and procurement options could be available. We assessed interest in several of these: DEPLOYMENT OPTION FOR CUPP SOLUTION Server-side software in the cloud hosted by CUPP Server-side software hosted at your location Server-side software at your location on your appliance Server-side software at your location, as a virtual appliance Other deployment option VERY HIGH/HIGH INTEREST (TOP %) US Managers were the most keenly interested in the option of server- side software hosted at their own location, and the larger companies in the sample also indicated they were most likely to prefer this deployment option. Interest in various procurement options was also assessed: PROCUREMENT OPTION FOR CUPP SOLUTION End-user orders and pays online, then expenses it. Item is shipped to end-user address. Centralized corporate procurement. Item is shipped to company address. Decentralized corporate procurement. Item is shipped to enduser address. Other procurement option VERY HIGH/HIGH INTEREST (TOP %) The most popular procurement option was centralized corporate procurement in which the item is shipped to company locations. Several managers expressed concern about a decentralized corporate procurement option, which was a more common view among larger companies than smaller ones. However, just over two- thirds said they were highly interested in procurement Page 14

17 scenario in which an end- user could purchase the solution and expense it, opening up a consumerization model for companies in which BYOD has become commonplace. CHALLENGES In closing, we asked managers to share their views of the primary challenges for their company or industry in terms of implementing mobile security solutions. Additionally, we asked them to reflect on where they see mobile security technology headed in the future. Cost was frequently mentioned as a key management challenge, particularly in view of tightening resources: I think controlling costs is the primary challenge. I see mobile security becoming more robust in the future.. At the same time, it was recognized that allocating more resources to mobile security was an inevitable step for most companies. Still, a few mentioned that the level of penetration of mobile device usage in their workplace was still relatively low: We do not have this type of concern our critical data does not move across mobile networks; furthermore, our critical data has very low commercial value. Recent revelations concerning government intrusion into computing systems and devices also was an ongoing concern for some. In Europe, one manager noted that: The question will be if these products will really be secure or leave open back doors for government institutions Another said that the data security guidelines are the biggest challenges. In some companies, there is a sense that mobile security software is still not reliable, or able to handle a zero day vulnerability and that sometimes, upper management does not understand the risk presented by mobile device security gaps. Selected Comments: Waiting for new reliable offerings Clouds will be huge in the future, it will differentiate one company from another, device types will increase and security for all will become even more of a challenge That there are constantly new threats, so you need to work with a company that is on top of them. The different devices and OSs and versions. The biggest threat is from advertisers so I'm not sure how security can tie in with huge corporations that steal data when they own the security companies. Preventing all foreign penetration. Mobile security technology will definitely evolve toward a concentration of protections that are essential for proper system function. The lack of time and resources Having an effective system at a low price Page 15

18 Increasingly strict standards in this area will be put in place to fight computer pirates. Complete data security is becoming increasingly important in mobile devices! Each employee can be a risk for the security. It will be difficult to ensure complete security! Regarding cost increases, I think it would be very difficult at this time to get upper management to understand. Little proof of ongoing success; it will have to become much more efficient, less costly and prove- able. It will need to take place by device; there is no way around that. It needs to be more embedded into the phones. Integrating different servers with different operating systems Must be operable and user friendly. Can't be sabotaged and be 100 % reliable. My concern is that these need to be upgradable so that if there is a zero day vulnerability it can be patched. This is a good solution now and I expect more of these in the future. That employees comply with standards and that we properly educate them, supply the tools and also monitor for compliance. Finding a single comprehensive solution that addresses the major issues concerned with mobile security technology like confidentiality or information validity. I think controlling costs is the primary challenge. I see mobile security becoming more robust in the future. Page 16

19 Methodology & Sampling Decisive Analytics LLC was commissioned in 2014 to conduct a series of surveys among IT Decisionmakers in 5 countries: the US, UK, France, Germany and Japan. Decisionmakers working in US- based companies were interviewed in May- June 2014, and the European and Asian interviews were completed in November- December, The purpose of the study was to explore response to CUPP Computing s mobile security solutions, as well as the customer s preferred feature set, likely purchase intent, and other concerns related to mobile security in a diverse range of organizations. The survey was conducted online in partnership with Authentic Response, a specialized IT panel company now owned by international sampling firm Critical Mix. A total of 159 interviews were completed across the five countries, with nearly half (n=76) conducted with US participants, and the rest distributed across the UK, French, German and Japanese participants. Interviews were conducted in English in the US and the UK, but were translated into French (France), German (Germany) and Japanese (Japan) for those phases of the study. Sample was drawn based on the following criteria: Participant must be working in the US, UK, France, Germany or Japan Job Title must be within the Senior Management band (Director or Managing Director, Senior Manager, VP/SVP, CIO, CTO, CSO..) with influence in the area of IT, tech security, and/or selecting appropriate technology for the business unit or corporation. Page 17

20 We sought distribution among a wide range of industry verticals, along with a mix of participant age, location, and company size. The most common primary vertical among companies interviewed was manufacturing, although respondents were drawn from numerous other industries. Page 18

21 Job titles varied among the IT Decisionmakers we recruited, but about a fifth were CIOs (19%), while others said they were Senior Managers (13%), VP- level (13%), held another similar senior management title (13%.) All participants were required to be influential in either making recommendations concerning mobile security solutions in the company or business unit, or primarily or jointly responsible for making decisions about mobile security solutions in the business. Page 19

22 None of the participants were younger than 24, and on average, said they were between 25 and 54 years of age, although a few were older than 55. Page 20

23 Contact Information Cheryl Harris, Ph.D. Chief Research Officer Tel Decisive Analytics LLC 575 Madison Avenue, 10 th Floor, NY NY USA Tel decisiveanalytics.com Page 21