Expect conflict in 2012 as consumerisation raises security alarm bells for CIOs

End users everywhere are demanding that IT executives figure out how to let them bring their own smartphones and laptops to work. Yet even as consumerisation tops lists of IT priorities for 2012, vendors are taking new approaches to security as a majority of CIOs worry that the BYO pendulum has swung too far and will, through the normalisation of off-net mobility, create new business risks due to unaddressed shortcomings in management and security strategies.

Recently released research, conducted for Compuware by research firm Vanson Bourne, surveyed 520 CIOs across the US, UK, France, Germany, Italy, Belgium, the Netherlands, Luxembourg, Australia and Japan, showed that fears around the spread of mobility were common amongst CIOs.

Among the most interesting findings: 67 per cent of business mobility projects were proceeding without the "full involvement" of the IT organisation, while 64 per cent believe the lack of transparency into cloud/software-as-a-service (SaaS) deployments is rolling back the maturity of IT; an equal percentage said it is "almost impossible" to deliver IT support for mobility initiatives.

As a result, 77 per cent of CIOs said consumerisation of IT is creating unacceptable business risk – and this is unlikely to change until controls over mobile initiatives allow better management of security risks and improved governance overall.

That concern is likely to create conflict between users' expectations and CIOs' warmth towards BYO – especially with vendors expecting mobile malware to become an even bigger threat and the likes of M86 Security Labs expecting that in 2012 cybercriminals will target increasingly complex attacks at social networking users, third-party software, cloud-based services, compromised Web sites and the use of spam to distribute malware.

Security vendor Trend Micro's own 2012 predictions (PDF) warn that those that jump into BYO without moderating their exposure, it seems, do so at their own risk.

Recognising a new market opportunity, security vendors are rushing to offer tools for enterprises to identify and address these security deficiencies. Bitdefender, for example, recently launched a holistic defence it calls Bitdefender Sphere, a "unified security solution" that the company says protects Windows, Mac and Android smartphones and tablets using an overarching security perimeter.

Symantec is also moving to help CIOs improve their decision-making, with its recently-released Mobile Security Assessment Suite that lets CIOs and CSOs evaluate their exposure to external attackers, malicious internal users, and employee attacks. Its scope includes enterprise policies and processes around mobility, with pen testing considered essential to ferret out potential vulnerabilities in a range of use cases.