Why shadow BYOD is your next big problem

It's nearly impossible to find a recent article about federal cybersecurity that doesn't mention the Office of Personnel Management hack — and for good reason: It has raised some very serious questions about our nation's cybersecurity practices or, more accurately, the lack thereof.

Without question, there is massive room for improvement. Yet recent discussions have all but overlooked one critical piece of the federal security puzzle: mobile devices.

Some might ask, "Why focus on mobile when in many areas of government, smartphones aren't even allowed?" After all, there's no reason to believe the OPM hack involved a mobile component. Yet for that very reason, mobile devices remain sitting ducks as entry points for similar attacks in the future.

In fact, after analyzing 20 federal agencies, Lookout recently discovered 14,622 personal devices associated with government networks. That means people, permitted or not, are connecting their smartphones and tablets to federal systems. In this sample, those devices encountered an astounding 1,781 app-based threats such as spyware or Trojans.

So government employees are not only using their smartphones to regularly access potentially sensitive government data and their agencies' Wi-Fi networks, but those devices are encountering threats that could put the devices and the data they access at risk.

Adding more fuel to the fire, a recent survey of more than 1,000 federal government employees (also commissioned by Lookout) revealed a sobering set of statistics:

• 58 percent of federal employees are aware of the security consequences of using their personal mobile phones for work, yet 85 percent will use their phones for potentially risky activities anyway.
• 50 percent of federal employees access work email on their personal devices, and another 49 percent use their personal devices to download work documents.
• 7 percent of federal employees claim they jailbreak or root a device they bring to or use at work. Those practices introduce vulnerabilities that attackers can exploit, and they make it easier to download apps from third-party marketplaces that tend to have a higher number of malicious apps.
• 18 percent of employees claim to have encountered malware on their mobile devices, including both personal and government-issued devices.

Clearly, all federal agencies have some level of bring-your-own-device activity taking place, whether officially sanctioned or not. And this shadow BYOD introduces countless risks for sensitive data leakage. This is not to say that more traditional entry points no longer pose risks or that mobile is a greater threat — but mobile is being completely overlooked.

So how do you address shadow BYOD and minimize potential risks? For many government agencies, the answer is to institute more policies. But policies alone won't address the underlying issues of why shadow BYOD is happening in the first place.

In the aforementioned survey, nearly 40 percent of employees who work at agencies that have rules prohibiting personal smartphone use at work said those rules have little or no impact on their behavior. Employees want access to mobile technology to do their jobs, but the government is not moving at the speed of technology.

The answer lies in embracing BYOD programs wholeheartedly, which involves having the tools and technologies in place that provide visibility into what's really happening on federal networks and offer protection against potential harm. If we wait for a mobile attack to cause a devastating government data breach before we start considering how to tackle the significant mobile security challenge, it will already be too late.