As Mobile Devices Catch On with Businesses, Data Breach Risks Grow

The rise of mobile devices has created uncertainties regarding what authority a company has over an employee’s personal device if it is also used for work-related activities, and what actions a company must take if a device is lost or stolen, according to experts.

Mobile devices are vulnerable to cyber attacks just like desktop computers and laptops are, according to Larry Collins, vice president, e-solutions, risk engineering at Zurich NA. Speaking today during Advisen’s webinar, “Cyber Security: The Growing Liability of Handheld & Mobile Devices,” Collins explained that these devices are essentially mini or micro computers, and he added that any computer system that has a networked connection or software system can be broken into and hacked.

Additionally, because devices such as smartphones and tablets are small and portable, they are easily misplaced. John Mullen, a partner with Nelson, Levine, de Luca & Hamilton, said during the webinar that the TSA had to lease a new warehouse just to store devices misplaced and left behind at airports.

If a mobile device is misplaced by a high-ranking employee connected to sensitive data, and that employee does not immediately report the device as lost, the company could be facing a large problem by the time the issue comes to light, Mullen said.

Even if a lower-ranking employee loses a device, problems can arise, Mullen noted. That employee may have information stored on the device including contacts, photos, call history, and notes and personal information about contacts. 

If the employee works in the healthcare field, theft of such information could trigger Health Insurance Portability and Accountability Act (HIPAA) violations, Mullen said. 

Mullen pointed to another emerging risk tied to mobile devices: a “bring your own device” philosophy developing at many companies. He says there are some advantages to such a policy, such as cost savings if employees are spending their own money on smartphones and tablets that are constantly evolving and being updated. 

However, he said such a policy can raise questions regarding who owns the data on the phone when company data is mixed with personal data. For example, Mullen asked if the company would have the authority to wipe the information from the phone when the employee leaves the company.

Mullen said that if an employee connects a personal device to a company network, the company just inherited responsibility for that device.

Despite the risks, though, Catherine Mulligan, senior vice president, Zurich NA, said that in an age where employees take advantage of 24/7 connectivity, a mix of personal and company information on personal devices “feels pretty inevitable.”

In order to address the risks around mobile devices, the webinar panel said companies must enact comprehensive risk-management plans that include training employees on how to respond if a device is lost or stolen.

Mulligan said c-suite executives and risk managers cannot assume that IT departments will be responsible for all security measures. Plans have to be enterprise-wide, she said. Risk management, she explained, starts with IT controls such as VPN (virtual private network) usage, encryption, and having a plan to track down lost devices and react.

But beyond the IT department, employees should know who to call if a device is lost or stolen, and the person the employee calls should know what to do once notified, said Mulligan. She said companies should provide regular training in which all employees using personal devices must participate on annual basis. 

Mullen added that response to a lost device can become “surprisingly simple” if a company has the proper procedures in place. 

Mulligan said insurance for devices is also available. Coverage, she said, is not much different for mobile devices than for any other type of data breach. She said there is liability coverage that deals with legal costs and third-party expertise such as forensics firms to analyze a breach and call centers to provide information and public relations. Coverage also may include services, such as access to tools to estimate costs, a checklist for a company’s planned response, and access to experts who can answer questions and review a company’s policies and procedures. 

Comments

Resource Center

View All »

Contractors General Liability Coverage 102

What is a prior work exclusion? Which option is right for my client? Why do...

Sign up today to get a 50% matching credit -...

Insurance marketing sometimes seems like it's a game of swings and misses, but we're here...

Guide: 5 Steps to Selling Cyber

Cyber risk and data security is on the agenda of every business owner and executive....

Citation Correlation

Do rigger and signalperson qualifications correlate with the cause of crane and rigging accidents? ...

Complete Guide to Electronic Signatures in Property & Casualty Insurance...

In property and casualty insurance, closing new business quickly is key. Learn how to leverage...

INSTANT ACCESS: Complimentary Sales Closer Questionnaires

Help property owners or managers compare your commercial residential property insurance coverage vs. the competition....

Determining Vacant Property Perils and Valuations

Are your clients fully covered for Vacant Properties? In this economic climate, your insureds may...

Risk Management for Law Firms

This package of 3 concise risk management articles offers straightforward content and practical suggestions law...

Guide: Top 15 E&O Risks-And How To Avoid Them

Accidents happen. But when it's an errors and omissions oversight, that accident can open your...

We'll Show You How to Reach Your Sales Goals

Whether you work alone or have a team of agents working for you, we can...

Risk Management Report eNewsletter

Identify problems involving emerging risks, reinsurance, and business interruption with help from Risk Management Report - FREE. Sign Up Now!

Advertisement. Closing in 15 seconds.