Security is not my responsibility’: Enterprise workers in poll

VANCOUVER, CANADA: Absolute Software Corp. announced the results of the 2013 Mobile Enterprise Risk Survey.

The survey polled workers in companies with 1000 or more employees who use mobile phones for work within diverse industries, including banking, retail, healthcare, and energy. The poll focused on the state of bring-your-own-device (BYOD) policies within these organizations and the current sentiment of workers regarding responsibility and compliance for corporate data contained on mobile devices.

Key US findings of the 2013 Mobile Enterprise Risk Survey include:

It's not my problem

When asked about appropriate penalties if they leak or lose company data, a quarter (25.2 percent) of American enterprise workers surveyed said there should be no punishment since data security is not their responsibility.

It's not a big deal

While 75 percent of respondents felt that they should face some penalty if they lost corporate data, many of those who had lost a device with work data on it said their punishment ranged from ‘nothing' (34 percent) to simply having to replace the device (30 percent) or getting a ‘talking to', but nothing else (21 percent).

I didn't know

About one quarter (23 percent) of respondents indicated that they do not know their company's procedure for dealing with work device loss or theft. Also, 10 percent of respondents indicated that their employer is not looking to introduce a procedure for the loss or theft of work devices.

It can't happen to me again

More than one third (35 percent) of respondents who had lost their mobile phones stated that they did not change their security habits afterwards.

It's just a phone

Nearly two-thirds (59 percent) of enterprise mobile users estimated their corporate data to be worth less than $500.

As the use of mobile devices continues to increase in the enterprise, these survey results indicate IT is still facing many challenges implementing and enforcing mobile-use guidelines. Although employees may feel the data on their device is only worth $500, when you consider that most data breach penalties can range into the millions of dollars, there's an obvious disconnect between an employee's perception and the risk to the organization.

"If firms don't set clear policies that reflect the priority of corporate data security, they can't expect employees to make it a priority on their own," said Tim Williams, mobile enterprise data expert and director, Product Management at Absolute Software.

The lax attitude of workers towards securing mobile devices and the data they contain, even after device loss or theft, places enterprises and their sensitive data in a vulnerable position.

"The data may be carried around in the employee's pocket, but the half million dollar fines we've seen levied due to data loss come out of the company's pocket," said Williams. "Clear policies, properly articulated to employees, will ensure that the entire company, not just IT, unites against mobile data loss."