BYOD resistance loosening but security practices lacking