Aussie workers bypassing IT organisations for BYOD: survey

Australian organisations recognise the need to secure bring your own device (BYOD) mobile-device policies, but are continuing to use insufficient security measures as power users bypass IT controls with impunity, new research from Unisys and Forrester Research has found.

Unisys' third annual Consumerisation of IT study (downloadable here) involved surveys of 2609 information workers (referred to as 'iWorkers') and 590 business and IT decision makers from organisations with more than 500 employees, in nine countries. The Australian contingent comprised 307 iWorkers and 79 IT and business leaders, predominantly from large organisations.

Forrester identified an iWorker subgroup it calls the 'Mobile Elite' – of which there were 84 in the Australian cohort – who are the most proactive adopters of mobile technology to improve their productivity, work satisfaction, and collaboration with colleagues.

"They are the self-starters who no longer wait for their superiors or senior management to provide solutions," the report describes them. "They are capable of solving problems and enhancing their productivity at the workplace. They look to the consumer world for different ways to solve problems and usually are the first to embrace and evangelise new trends."

That characteristic opens them up to potential security issues, however: for example, the Mobile Elite ere two to three times more likely to use consumer-grade Web conferencing, social-networking or document-sharing tools at work than the other iWorkers.

Fully 81% said they had downloaded unsupported apps or used unsupported Web sites for work purposes. And 69% of respondents said they use unsupported apps to communicate with customers, partners and suppliers. The prevalence of this practice is giving rise to a new moniker – BYOA, or Bring Your Own App – that is seen as posing a significant threat to operational security.

With mobile device and app deployments on the rise, two-thirds of respondents said they had or would soon implement a security policy requiring secure authentication of mobile users with a password; however, only 18% were considering authentication using an ID token. Interestingly, 11% were expecting to authenticate users with face recognition, and 4% using voice-recognition biometric technology.

While organisations were looking towards methods for securing mobile devices, however, the survey suggested that a large proportion of them had inadequate tools for actually providing this security. Fully 26% had policies in place for company-owned tablets – and 22% for company-owned smartphones – but lacked the tools to enforce those policies.

Illustrating the yawning gap between users' perception of BYOD and IT organisations' perception of BYOD, results suggested that users were far more likely to troubleshoot issues themselves than contact the IT organisation.

Just 14% of users said they would contact the IT department in the event of a problem with a personal device being used for business purposes – compared with 52% of IT executives. Similarly, just 37% of IT respondents said that employees would troubleshoot the problem themselves, while 60% of iWorkers said they would do their owntroubleshooting.

These figures suggest IT organisations have far higher appraisal of their role in BYOD policies than users do. This suggests a crisis of confidence in the IT department's support for personal devices, the report says: "employees are concerned about IT having control over their personal information or imposing restrictions on what they can do on personally-owned devices," it warns.

"To alleviate both IT and employees' concerns, IT should compartmentalise data and applications on devices as personal vs corporate to ensure they do not compromise each other." The report also recommends that IT organisations tap into users' self-troubleshooting instincts by providing self-help models such as portals and virtual help desks. – David Braue