10 Tips For Protecting Mobile Users
Mobile employees, devices, and data need protecting. Here are 10 tips to make it happen.
These days, every user is mobile. Laptops, smartphones, tablets, and constant connectivity have unshackled all of us from our desks. And thanks to the ready availability of apps and cloud services that blur the line between consumer and business tools, we're also unshackled from controls over company data. Many IT departments are having a hard time keeping up--mainly because they've failed to adapt as quickly as their users to the new reality.
More Security Insights
- 10 Steps to Cleaning up Active Directory
- The Active Directory Management and Security You've Always Dreamed of
- Innovations in Integration: Achieving Holistic Rapid Detection and Response
- COBOL in the Big Data Era: A Guide
Most companies have some form of mobile security policy in place. Sixty-two percent of respondents to InformationWeek's 2012 Mobile Security Survey have policies that lets employees use personal mobile devices for work. However, many of these policies are far from fully fleshed out. And often businesses lack the means to monitor mobile use of data across all devices and applications, which limits IT's ability to enforce those policies.
To enable users to get the most out of their mobile technology and protect them in the process, companies must consider several factors, including device selection, data security, device management, net- work security support for mobile devices, and application controls. We spoke with a number of experts on these matters concerning the challenges involved and to get tips on how to develop a solid mobile security program.
The increasing diversity of device types, operating systems, and applications is complicating attempts to secure mobile infrastructure. In the past, IT could be reasonably confident that most employees would use a Windows-based computer and a BlackBerry. Companies could standardize around a few endpoint configurations, which simplified tasks for managing and securing the infrastructure. "All that's flying out the window now," says Dave Frymier, chief information security officer at Unisys, an IT services provider. "You can't treat everybody the same anymore."
But that doesn't mean anything goes. IT needs to strike a balance in the size of its device ecosystem to enable user freedom while maintaining the manageability of the IT environment, says Craig Mathias, an analyst with Farpoint Group. It may not be as structured as the standardized endpoint configurations of yesteryear, but some kind of enforceable policy on the devices allowed to connect to the network should be drafted to draw bounds on the scope of IT's mobile concerns, he says.
Many IT shops do just that, according to InformationWeek's Mobile Security Survey, which found that 42% of respondents who have or are developing a policy for mobile devices allow any device as long as the user agrees to certain policies. Another 40% allow a limited range of devices, and users must run mobile device management software. By contrast, just 10% allow user-supplied devices with no restrictions.
All About The Data
While most mobile security planning discussions begin (and often end) with talk about mobile device management technology, that's putting the cart before the horse. "We don't recommend purchasing a single piece of MDM software until you've thought through what information you have, who needs to access it, under what circumstance, when, where, and with what degree of security," Mathias says. "That implies that you have policies available in advance of making any purchasing, strategy, or deployment decisions. Not doing that is a mistake people make all the time."
Policies should emphasize data protection, not just device protection, and that includes data in motion and at rest, says Howard Creed, a solutions consultant for IT security value-added reseller MCPc.
To establish that data-first mentality, you must know exactly what data you have. Jim Kunick, an intellectual property attorney at Chicago law firm Much Shelist, recommends clients put data into three categories: non-confidential data, confidential data, and highly sensitive data such as financial information and other types that fall under compliance or regulation requirements. He says the next steps are to determine who gets access to each category and codify that into your mobile policies.