When companies institute bring your own device (BYOD) programs to let employees use personal gadgets for work, it’s important to help them avoid unknowingly loading mobile malware onto their devices. Those viruses can leak sensitive data or end up infecting the company’s network.
But it isn’t only mobile viruses that create security and privacy concerns. Many mobile apps have access to the data held on a device, and can upload it back to the software developer for marketing or other purposes. Once that happens, the data could be at risk of being stolen during a data breach or misused by the developer itself.
Many mobile apps can access sensitive information on a device, especially popular free software. In fact, 96% of iOS apps and 84% of Android apps can access a device’s address book, calendar, geographic location or other data, according to a recent study of mobile apps from security firm Appthourity. And apps of all kinds were found to access sensitive information, with business apps almost as likely as games to have that access.
Consider banning these mobile apps
Of course, some software needs to read or save data, and it’s impossible to block all apps that may access information. But to protect mobile security, IT departments may consider blacklisting certain apps on company-issued phones or personal devices brought in under a BYOD program. Here are some popular apps IT may consider banning on those devices:
- Angry birds – In addition to its potential as a productivity killer, this popular mobile game also records a lot of data from users’ devices, including usernames and passwords, contact lists and location.
- Facebook – Another app that can waste a lot of users’ time, Facebook’s mobile client can also upload a device’s location data.
- Dropbox – Simple cloud storage applications like this make it easy for users to upload documents and access them anywhere. Unfortunately, they can also make it easy for criminals to get those documents, as shown by a recent Dropbox data breach.
- Evernote – The cloud-based note taking application is designed to help users record notes, keep to-do lists and perform other organizational tasks across all their devices, making Evernote sound like a great tool for business users. However, putting all that information in the Cloud may put it at risk of being breached.
- App stores – Some companies control the software that gets installed on users’ devices by setting up their own portals for downloading apps – and blocking access to Google Play, the iOS App Store, and other places users go to download apps.
Should any apps be blacklisted?
Despite the security risks introduced by certain mobile apps, IT pros often disagree on whether it’s a good idea to block access to any software. The situation is especially tricky with BYOD programs, when users are working with their own smartphones that they also use for personal tasks.
As more companies allow BYOD, more of them are starting to block access to mobile apps, according to a May report from mobile device management (MDM) vendor Zenprise. The vendor’s customers had blacklisted three times as many apps in the first quarter of 2012 than they had in the fourth quarter of 2011.
However, some experts argue that IT crosses a line when it tries to exert tight control over the software installed on a user’s personal device. Those observers say IT should put more focus into securing the data itself and training users in best practices for mobile security.
What do you think? Does your company blacklist mobile apps for smartphone and tablet users? Tell us about your thoughts and experiences in the comments section below.