Spikes Mobile Security Research Report. Deployed to Spiceworks Voice of IT panel April, 2015

Transcription

1 Spikes Mobile Security Research Report Deployed to Spiceworks Voice of IT panel April, 2015

2 Table of Contents IN THIS REPORT Background & Methodology 3 Executive Summary 4 Detailed Findings 5-17 Mobile Device Support Practices 5-11 Mobile Device Security Concerns & Practices

3 Background & Methodology Research Objectives Profile mobile device support and security practices / pain points. Identify key features and use cases for mobile browser security product. Methodology Spiceworks Voice of IT surveyed IT pros in an online survey. Data was collected in April, A total of 160 completed surveys were collected. Geographic Representation The IT pros are located in the US. Respondent Profile Respondents were required to work in companies with 100 or more employees, be involved in securing mobile devices, and have influence over mobile security decisions for their organizations. Organizations were required to support mobile devices/byod. IT service providers/ consultants were excluded. All other industries were allowed to fallout naturally. 16% Company Size (# of employees) 11% % 39% ,000+ Top Industries Healthcare 24% Government 14% Finance 11% Education 1 Manufacturing 9% Non profit 8% Title CIO/CISO 3% VP IT 2% IT Dir./Security Dir. 19% IT Mgr./Security Mgr. 14% IT/Security Arch./Eng. 4% Network/Sys Admin 46% Other IT/ Security 9% Involvement in Mobile Security Evaluate solutions Deploy solutions Manage solutions Determine need Set strategy Make final decisions Approve purchases 28% 39% 65% 83% 82% 81% 78% About Spiceworks Voice of IT The Spiceworks Voice of IT market insights program publishes stats, trends and opinions collected from small and medium business technology professionals who are among the more than 6M users of Spiceworks. Survey panelists opt-in to answer questions on technology trends important to them. To use data from this report, visit: 3

4 Summary of Findings Mobile Device Support Practices Among the mobile devices tested, organizations primarily support laptops/convertibles (96%). Most also support smartphones (89%) and/or tablets (86%). Nearly all of the organizations (9) reported supporting at least one mobile device per employee, most commonly one or two devices per employee. Approximately one-third of the organizations do not have a clear preference or standard platform for the mobile devices they support. Of those who do, 33% prefer ios, 17% prefer Windows, and 16% prefer Android. Nearly half of the participating organizations only allow company-owned devices to access the corporate network, and only 16% allow both company-owned and employee-owned devices to access the corporate network. The most common types of applications organizations allow mobile devices to access are Internet web apps (84%), followed by intranet corporate apps (61%) and extranet partner apps (). Most organizations (84%) allow mobile users to access corporate systems through an on premise LAN. Access to corporate assets is primarily limited to /calendar/contacts. Mobile Device Security Concerns & Practices Concern about mobile security threats is nearly universal with 99% of respondents reporting at least some level of concern. The attack vectors of greatest concern include malicious file downloads (57%), malicious apps (5), leakage of sensitive data (49%) and (48%). Only 29% of the respondents are concerned with browser attacks, suggesting more education may be needed on browser risk factors. The most common mobile device security challenge experienced, or expected, is limited end-user knowledge regarding risk (52%). Other key challenges include enforcing end-user policies (38%) and enforcement of BYOD policies (36%). This suggests that control is a key challenge for mobile device security. Organizations primarily secure the mobile devices they support with firewalls (56%), antivirus/malware software (47%), end-user education (46%), Internet filtering (46%), authentication policies (44%) and MDM (). The most important factors organizations consider for their mobile device security solutions are data protection (76%), central management (67%), and malware isolation (). 4

5 Detailed Findings: Mobile Device Support Practices

6 Mobile Device Support Among the mobile devices tested, organizations primarily support laptops/convertibles (96%). Most also support smartphones (89%) and/or tablets (86%). Nearly all of the organizations (9) reported supporting at least one mobile device per employee, most commonly one or two devices per employee. Which of the following mobile devices are currently used at your organization? (Multiple selections permitted.) 96% Approximately how many mobile devices per employee does your organization support? 3% 4% 89% 36% 86% Support at least 1 mobile device per employee = 9 4+ per employee 3 per employee 2 per employee 1 per employee None 48% Don't know Laptops/ Convertibles Smartphones Tablets 4% 6% 6

7 Preferred Mobile Device Platform Approximately one-third of the organizations do not have a clear preference or standard platform for the mobile devices they support. Of those who do, 33% prefer ios, 17% prefer Windows, and 16% prefer Android. Which of the following mobile device platforms does your organization standardize on or prefer? 10 33% Most Other mentions are a combination of ios, Windows, Android and Chrome 28% 17% 16% ios Windows Android Blackberry Other None- no preference/ standard 1% 6% 7

8 Mobile Device Corporate Network Policy Nearly half of the participating organizations only allow company-owned devices to access the corporate network, and only 16% allow both company-owned and employee-owned devices to access the corporate network. Which of the following best describes your organization s policy regarding mobile devices on the corporate network? 10 47% 23% 16% 15% We allow company-owned devices only on the corporate network We allow employee-owned (BYOD) devices to connect to a separate guest network We allow employee and company-owned/subsidized devices on the corporate network We don t have a formal policy 8

9 Applications Accessed by Mobile Devices The most common types of applications organizations allow mobile devices to access are Internet web apps (84%), followed by intranet corporate apps (61%) and extranet partner apps (). What types of applications does your organization allow mobile devices to access? (Multiple selections permitted.) 10 84% 61% Internet web applications Intranet corporate applications Extranet partner/ supplier applications 4% None 9

10 Mobile Device Access Methods Most organizations (84%) allow mobile users to access corporate systems through an on premise LAN. Nearly two-thirds allow users to access these systems through an off premise VPN, and just over half allow access through an off premise 3G/4G. Which of the following methods are used by mobile users to access corporate systems? (Multiple selections permitted.) 10 84% 63% 52% 4% 3% On-premise LAN Off-premise VPN Off-premise 3G/4G Other Don't know 10

11 Corporate Assets Accessed by Mobile Devices Access to corporate assets is primarily limited to /calendar/contacts. Approximately half of the organizations surveyed allow access to corporate mobile apps and/or secure network resources, and about one-third allow access to corporate file-sharing accounts. What types of corporate assets does your organization allow mobile devices to access? (Multiple selections permitted.) 10 96% 52% 48% 37% 4% / calendar/ contacts Corporate mobile apps/ software Secure network resources Corporate file-sharing accounts Other 11

12 Mobile Device Security Concerns & Practices

13 Concern about Mobile Security Threats Concern about mobile security threats is nearly universal with 99% of respondents reporting at least some level of concern. How concerned are you about mobile device security threats? Not at all concerned Somewhat concerned Concerned Very concerned Extremely concerned Concerned Net = 99% Highly Concerned Net = 34% 1% 33% 32% 24% 1 13

14 Concerns about Attack Vectors The attack vectors of greatest concern include malicious file downloads (57%), malicious apps (5), leakage of sensitive data (49%) and (48%). Only 29% of the respondents are concerned with browser attacks, suggesting more education may be needed on browser risk factors. Which of the following attack vectors are you most concerned about? (Up to three selections permitted.) 10 57% 5 49% 48% 29% 26% Malicious file downloads Malicious apps Data leakage of sensitive data Browser Physical device exploit 14

15 Mobile Device Security Challenges Most organizations have experienced, or expect to experience, at least some challenges when securing mobile devices. The most common challenge experienced or expected is limited end-user knowledge regarding risk (52%). Other key challenges include enforcing end-user policies (38%) and enforcement of BYOD policies (36%). This suggests that control is a key challenge for mobile device security. 10 What are the biggest challenges your organization has experienced, or would expect to experience, when securing mobile devices? (Up to five selections permitted.) 52% 38% 36% 33% 33% 32% 29% 10 Limited end-user knowledge regarding risk/ security practices Enforcement of end-user policies 29% 29% 24% Remote endpoint control/ visibility Security breaches/ threats Enforcement of BYOD policies Operational costs Increased management/ operational complexity Time/ resources required to secure devices Security compliance/ requirements 18% 14% 9% 9% Lack of data protection Providing selective access to data Reduction in battery life from continuously running processes Overall reduction in device performance Increased help desk calls/ support time 4% None- haven t experienced any challenges 15

16 Mobile Device Security Solutions Organizations primarily secure the mobile devices they support with firewalls (56%), antivirus/malware software (47%), end-user education (46%), Internet filtering (46%), authentication policies (44%) and MDM (). What types of mobile device security solutions or practices does your organization currently use? (Up to five selections permitted.) 10 56% 47% 46% 46% 44% 28% 19% 19% 10 16% 13% Central management Application control 8% 8% 6% 4% 2% 3% Data protection Data loss prevention (DLP) Device/port control Enterprise mobility management tools (EMM) Other None 16

17 Mobile Security Solution Consideration Factors The most important factors organizations consider for their mobile device security solutions are data protection (76%), central management (67%), and malware isolation (). Other important factors include cost (57%), ease of management (54%) and OS compatibility (54%). 10 How important are the following factors when considering mobile device security solutions? (Top 2 reported: Critical and Nice to have) 32% 36% 45% 43% 76% 67% 57% 54% 54% Nice to have Critical Data protection Central management Malware isolation Cost Ease of management OS compatibility 10 48% 47% 53% 51% 46% 44% Ease of deployment End-user experience Network performance 56% 59% 36% 34% 54% 26% Scalability Application control Resource consumption Nice to have Critical 17

18 Copyright Notice The contents of this report are a result of primary research performed by Spiceworks. Unless otherwise noted, the entire contents distributed as part of this report are copyrighted by Spiceworks. As such any information made available by any means in this report may not be copied, reproduced, duplicated, published, displayed, transmitted, distributed, given, sold, traded, resold, marketed, offered for sale, modified to create derivative works or otherwise exploited for valuable consideration without prior written consent by Spiceworks. For information about using data from this report visit, go to This report contains information of fact relating to parties other than Spiceworks. Although the information have been obtained from, and are based on sources that Spiceworks believes to be reliable, Spiceworks does not guarantee the accuracy, and any such information might be incomplete or condensed. Any estimates included in this report constitute Spiceworks judgment as of the date of compilation, and are subject to change without notice. This report is for information purposes only. All responsibility for any interpretations or actions based on the information or commentary contained within this report lies solely with the recipient. All rights reserved