10 Tips For Protecting Mobile UsersMobile employees, devices, and data need protecting. Here are 10 tips to make it happen.
These days, every user is mobile. Laptops, smartphones, tablets, and constant connectivity have unshackled all of us from our desks. And thanks to the ready availability of apps and cloud services that blur the line between consumer and business tools, we're also unshackled from controls over company data. Many IT departments are having a hard time keeping up--mainly because they've failed to adapt as quickly as their users to the new reality.
TIP 1: Allow Device Freedom Within Certain Bounds
"BYOD does not mean bring every device. If you have a reasonably restricted universe of devices to choose from, the right tools in place to manage them, and the right policies, BYOD can be imminently successful."
--Craig Mathias, analyst, Farpoint Group
Most companies have some form of mobile security policy in place. Sixty-two percent of respondents to InformationWeek's 2012 Mobile Security Survey have policies that lets employees use personal mobile devices for work. However, many of these policies are far from fully fleshed out. And often businesses lack the means to monitor mobile use of data across all devices and applications, which limits IT's ability to enforce those policies.
To enable users to get the most out of their mobile technology and protect them in the process, companies must consider several factors, including device selection, data security, device management, net- work security support for mobile devices, and application controls. We spoke with a number of experts on these matters concerning the challenges involved and to get tips on how to develop a solid mobile security program.
TIP 2: Strong Data Security Means Strong Mobile Security
"Until we can control mobility at the data level, rather than protecting the systems or devices, we're going to continue to have all kinds of security issues."
--John Nicholson, attorney who specializes in IT compliance issues
The increasing diversity of device types, operating systems, and applications is complicating attempts to secure mobile infrastructure. In the past, IT could be reasonably confident that most employees would use a Windows-based computer and a BlackBerry. Companies could standardize around a few endpoint configurations, which simplified tasks for managing and securing the infrastructure. "All that's flying out the window now," says Dave Frymier, chief information security officer at Unisys, an IT services provider. "You can't treat everybody the same anymore."
TIP 3: Fold Mobile Strategies Into Overall Security Framework
"You can't just create a mobile security policy or a BYOD policy. You should really be doing this as part of your overall company security policy."
--Jim Kunick, intellectual property attorney
But that doesn't mean anything goes. IT needs to strike a balance in the size of its device ecosystem to enable user freedom while maintaining the manageability of the IT environment, says Craig Mathias, an analyst with Farpoint Group. It may not be as structured as the standardized endpoint configurations of yesteryear, but some kind of enforceable policy on the devices allowed to connect to the network should be drafted to draw bounds on the scope of IT's mobile concerns, he says.
TIP 4: Don't Forget Basic Laptop Management
"You need to do the basic blocking and tackling of handling a PC. Those aren't particularly sexy things, but they are very important."
--Dave Frymier, CISO, Unisys
Many IT shops do just that, according to InformationWeek's Mobile Security Survey, which found that 42% of respondents who have or are developing a policy for mobile devices allow any device as long as the user agrees to certain policies. Another 40% allow a limited range of devices, and users must run mobile device management software. By contrast, just 10% allow user-supplied devices with no restrictions.
All About The Data
While most mobile security planning discussions begin (and often end) with talk about mobile device management technology, that's putting the cart before the horse. "We don't recommend purchasing a single piece of MDM software until you've thought through what information you have, who needs to access it, under what circumstance, when, where, and with what degree of security," Mathias says. "That implies that you have policies available in advance of making any purchasing, strategy, or deployment decisions. Not doing that is a mistake people make all the time."
TIP 5: Look For MDM That Allows For Maximum Endpoint Management Consolidation
"It doesn't make sense to have five different management consoles to run your wired and wireless network, laptops, smartphones, laptops, etc. You want to roll it all up in one place if you can."
Policies should emphasize data protection, not just device protection, and that includes data in motion and at rest, says Howard Creed, a solutions consultant for IT security value-added reseller MCPc.
To establish that data-first mentality, you must know exactly what data you have. Jim Kunick, an intellectual property attorney at Chicago law firm Much Shelist, recommends clients put data into three categories: non-confidential data, confidential data, and highly sensitive data such as financial information and other types that fall under compliance or regulation requirements. He says the next steps are to determine who gets access to each category and codify that into your mobile policies.
Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio
1 of 2