Why shadow BYOD is your next big problem

Shutterstock image: mobile device security, continuous monitoring concept.

It's nearly impossible to find a recent article about federal cybersecurity that doesn't mention the Office of Personnel Management hack — and for good reason: It has raised some very serious questions about our nation's cybersecurity practices or, more accurately, the lack thereof.

Without question, there is massive room for improvement. Yet recent discussions have all but overlooked one critical piece of the federal security puzzle: mobile devices.

Some might ask, "Why focus on mobile when in many areas of government, smartphones aren't even allowed?" After all, there's no reason to believe the OPM hack involved a mobile component. Yet for that very reason, mobile devices remain sitting ducks as entry points for similar attacks in the future.

In fact, after analyzing 20 federal agencies, Lookout recently discovered 14,622 personal devices associated with government networks. That means people, permitted or not, are connecting their smartphones and tablets to federal systems. In this sample, those devices encountered an astounding 1,781 app-based threats such as spyware or Trojans.

So government employees are not only using their smartphones to regularly access potentially sensitive government data and their agencies' Wi-Fi networks, but those devices are encountering threats that could put the devices and the data they access at risk.

Adding more fuel to the fire, a recent survey of more than 1,000 federal government employees (also commissioned by Lookout) revealed a sobering set of statistics:

  • 58 percent of federal employees are aware of the security consequences of using their personal mobile phones for work, yet 85 percent will use their phones for potentially risky activities anyway.
  • 50 percent of federal employees access work email on their personal devices, and another 49 percent use their personal devices to download work documents.
  • 7 percent of federal employees claim they jailbreak or root a device they bring to or use at work. Those practices introduce vulnerabilities that attackers can exploit, and they make it easier to download apps from third-party marketplaces that tend to have a higher number of malicious apps.
  • 18 percent of employees claim to have encountered malware on their mobile devices, including both personal and government-issued devices.

Clearly, all federal agencies have some level of bring-your-own-device activity taking place, whether officially sanctioned or not. And this shadow BYOD introduces countless risks for sensitive data leakage. This is not to say that more traditional entry points no longer pose risks or that mobile is a greater threat — but mobile is being completely overlooked.

So how do you address shadow BYOD and minimize potential risks? For many government agencies, the answer is to institute more policies. But policies alone won't address the underlying issues of why shadow BYOD is happening in the first place.

In the aforementioned survey, nearly 40 percent of employees who work at agencies that have rules prohibiting personal smartphone use at work said those rules have little or no impact on their behavior. Employees want access to mobile technology to do their jobs, but the government is not moving at the speed of technology.

The answer lies in embracing BYOD programs wholeheartedly, which involves having the tools and technologies in place that provide visibility into what's really happening on federal networks and offer protection against potential harm. If we wait for a mobile attack to cause a devastating government data breach before we start considering how to tackle the significant mobile security challenge, it will already be too late.

About the Author

Bob Stevens is vice president of public sector at Lookout.


  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.