BYOD Led to Big Mobile Device Security Lapses in U.S. Army

While many end users are aware of potential dangers associated with not securing a device properly, that doesn’t mean they secure it. Many choose to ignore advice from IT professionals about locking their devices. Sure, we may expect this from the end user, which is why managed services providers (MSPs) try to place themselves between businesses and end users, but what about the U.S. military? Shouldn’t they have higher standards for bring your own device (BYOD) and mobile device management (MDM)? Apparently they do not. Sophos Senior Threat Researcher Beth Jones (pictured) recently highlighted the alarming vulnerabilities left open in the U.S. Military and its implementation of mobile devices in her  Naked Security blog. Here are the details.

Jones pulled the following facts from the report by the Inspector General (which since appears to have been pulled – but now has been reposted – to the government’s web site.) They show how standard BYOD security procedures were neglected by the CIO of the U.S. Army including:

Jones further said the findings from the report matter to the IT channel because they demonstrate that even the U.S. military is struggling with the security ramifications of BYOD. It’s not surprising that  small to mid-sized businesses are, too. MSPs should take note.

Data loss matters

Jones cited the case of the U.S. Secret Service contractor who left two tapes of sensitive data on DC Metro train as a prime example of what could happen to any employee at any level. Data is power and criminals are always looking to get their hands on sensitive material.

Jones recommended that any CIO grappling with BYOD security issues consider Sophos CTO Gerhard Eschelbeck’s seven-step BYOD security plan: