Mobile

6/27/2014
12:00 PM
Vijay Basani
Vijay Basani
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Mobile Security Tips For SMBs

Everyone in an organization has to work together to combat intrusions and data loss, but this is especially true for small businesses.

Mobile technologies have introduced a completely new world of risks to organizations that use them. While many larger enterprises have the resources to mount comprehensive campaigns, the era of mobile computing has placed smaller companies smack in the middle of a widespread and proliferating security crisis.

Here are three steps to help SMBs develop smarter mobile security policies in this ever-changing landscape.

First step: policy
Map out a security and mobile device policy that clearly separates personal and corporate data commingled on devices. Employees need to know specifically what they can and can't do on their mobile phones. You should write a user-focused rules of behavior document that every employee must understand and sign before they are granted access to your network.

Second step: education, access controls, and audits
It’s important to educate users on both the risks the devices present to the organization and your expectations of conduct. But strong, clearly stated company policy should also be consistently enforced through access permissions, published audit reports, and other sanctions. Frequent reminders that are integrated into general company-wide communications can make it clear what is expected and create a culture of good stewardship of digital devices and network resources.

Users should also be taught about the  many basic precautions they can take to mitigate risks associated with lost or stolen devices -- and how to keep both personal and corporate resources significantly safer. These steps include:

  • Setting lock screens with strong passwords of 8- to 10-character minimum length
  • Installing anti-virus/anti-malware apps
  • Implementing data encryption
  • Securely backing up all data
  • Installing device locator and remote wiping capabilities
  • Keeping operating systems and apps updated

Third step: ongoing monitoring
Continuous monitoring and measurement will be essential to address known and emerging threats. This effort requires focus, discipline, leadership, and innovation involving:

  • People -- trained, skilled information workers
  • Culture -- a true concern for protecting employee data
  • Leadership -- for the big picture, and priority setting
  • Process -- You can't improve what you don't measure. What are you doing with the technology once you buy it?
  • Technology -- Is it implemented properly? Are you monitoring it? Is it integrated across your entire enterprise?

Strategies to monitor and assess devices and their data should include identification of all mobile devices accessing your network of IT assets, real-time monitoring and correlation of all activity, and both alerting and reporting on violations of security policy, user privacy, and compliance.

For companies of any size -- but especially SMBs --  the most essential and urgent task at hand is to build a culture of good stewardship of devices and data through a robust and detailed company policy and consistent enforcement at all levels, from entry-level employees to CEOs. Everyone in a company has to work together to combat intrusions and data loss.

Vijay Basani is CEO and President of EiQ Networks. He is a serial entrepreneur with a track record of building successful businesses delivering enterprise-class solutions. Before starting EiQ Networks, he founded AppIQ, an application storage resource management provider ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/30/2014 | 3:50:18 PM
Re: Policy
I think many enterprises put more faith in procedural documentation. ie, What should be done, who should perform the tasks, how they should be performed. I think its because these components are quantifiable to some extent and can show great value. And most importantly represent actionable items. However, I think it is important to map out WHY as well. Which is what policies provide. 

As you stated policy establishes the base. For example, we are performing these procedures because our policy dictates that standard accounts should not contain admin privileges. Our policy is such because it helps to protect our environment from watering hole events. There are many reasons as to why policy should be established and I am perplexed as to any who would be opposed to having one.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/30/2014 | 10:11:19 AM
Re: Policy
Ryan, it seems to me that policy is a bottom line basic for an enterprise, large or small. Why do you think organizations drag their feet about establishing them? 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/27/2014 | 10:24:49 PM
Re: Policy
Good SANS reference. I recently took the SANS GSEC and many of the questions stemmed around corporate policy and how it very muchs integrates with security intiative. Very interesting on how laying a policy out logically can extend and enhance the technical aspect of what you are trying to accomplish.
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/27/2014 | 10:13:49 PM
Re: Policy
Good point. I agree that policy is a key issue. It can be complicated, but there a lot of good templates and best practices out there that can give people a headstart: http://www.sans.org/reading-room/whitepapers/leadership/managing-implementation-byod-policy-34217

BP
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/27/2014 | 6:18:53 PM
Policy
Great article. A well defined policy can put your organization to advance initiatives such as mobile device management and EMM. I have many conversations with Gartner about Mobile Devices and they always implore the establishment of policy. Policy can set the baseline to refer to during deployment and can be very effective if future events leave configuration ambiguous. Without proper documentation there isn't anything to compare a healthy config against. 
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
Hyatt Hit With Another Credit Card Breach
Dark Reading Staff 10/13/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.