With the rise of virtualisation, mobilisation and consumerisation, shoring a company’s security defences has never been more challenging. If we look at one area – the trend towards bring-your-own device (BYOD) - it is easy to understand the concern. Employees are increasingly using their personal devices to access corporate resources which is putting the corporate network at risk. It has also become exponentially difficult to protect against mobile malware threats – IT and security managers simply don’t have the visibility or the control to ensure their environment is adequately protected.
Unfortunately, the problem is set to get worse. According to the top 10 technologies and trends for 2013 released by Gartner, mobile phones will overtake PCs next year as the most common web access device worldwide and by 2015 over 80 percent of the handsets sold in mature markets will be smartphones. By 2015, media tablet shipments are expected to reach around 50 percent of laptop shipments. Enterprises won’t be able to force users to give up their mobile devices anytime soon so will be open to everything from users loading data onto unauthorised devices, to malicious applications wreaking havoc on the network.
Moreover, the InformationWeek 2012 Mobile Security Survey suggests that 86% of organisations support or plan to support BYOD. The survey also showed that only 20% of organisations say they have systems to detect malware on all their device platforms. Despite having up-to-date network security and up-to-date endpoint security, they are still finding that advanced malware threats are bypassing these layers. This is because detection rates for endpoint security generally only hover around 50%. Introduce more personal devices into this equation and the risk goes up.
As attacks become ever more sophisticated and combine with the rise of mobilisation, consumerisation and virtualisation, it is easy to see how difficult it is for organisations to on the one hand implement security for the real world and on the other maintain a satisfactory level of visibility and control. What is needed is an approach to security that is agile enough to reflect these changing needs while providing better detection, prevention and intelligent analysis of these dynamic attacks, wherever they originate. With the BYOD movement gaining momentum, the sooner organisations get this under control the better.