Mobile
6/27/2014
12:00 PM
Vijay Basani
Vijay Basani
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail
50%
50%

3 Mobile Security Tips For SMBs

Everyone in an organization has to work together to combat intrusions and data loss, but this is especially true for small businesses.

Mobile technologies have introduced a completely new world of risks to organizations that use them. While many larger enterprises have the resources to mount comprehensive campaigns, the era of mobile computing has placed smaller companies smack in the middle of a widespread and proliferating security crisis.

Here are three steps to help SMBs develop smarter mobile security policies in this ever-changing landscape.

First step: policy
Map out a security and mobile device policy that clearly separates personal and corporate data commingled on devices. Employees need to know specifically what they can and can't do on their mobile phones. You should write a user-focused rules of behavior document that every employee must understand and sign before they are granted access to your network.

Second step: education, access controls, and audits
It’s important to educate users on both the risks the devices present to the organization and your expectations of conduct. But strong, clearly stated company policy should also be consistently enforced through access permissions, published audit reports, and other sanctions. Frequent reminders that are integrated into general company-wide communications can make it clear what is expected and create a culture of good stewardship of digital devices and network resources.

Users should also be taught about the  many basic precautions they can take to mitigate risks associated with lost or stolen devices -- and how to keep both personal and corporate resources significantly safer. These steps include:

  • Setting lock screens with strong passwords of 8- to 10-character minimum length
  • Installing anti-virus/anti-malware apps
  • Implementing data encryption
  • Securely backing up all data
  • Installing device locator and remote wiping capabilities
  • Keeping operating systems and apps updated

Third step: ongoing monitoring
Continuous monitoring and measurement will be essential to address known and emerging threats. This effort requires focus, discipline, leadership, and innovation involving:

  • People -- trained, skilled information workers
  • Culture -- a true concern for protecting employee data
  • Leadership -- for the big picture, and priority setting
  • Process -- You can't improve what you don't measure. What are you doing with the technology once you buy it?
  • Technology -- Is it implemented properly? Are you monitoring it? Is it integrated across your entire enterprise?

Strategies to monitor and assess devices and their data should include identification of all mobile devices accessing your network of IT assets, real-time monitoring and correlation of all activity, and both alerting and reporting on violations of security policy, user privacy, and compliance.

For companies of any size -- but especially SMBs --  the most essential and urgent task at hand is to build a culture of good stewardship of devices and data through a robust and detailed company policy and consistent enforcement at all levels, from entry-level employees to CEOs. Everyone in a company has to work together to combat intrusions and data loss.

Vijay Basani is CEO and President of EiQ Networks. He is a serial entrepreneur with a track record of building successful businesses delivering enterprise-class solutions. Before starting EiQ Networks, he founded AppIQ, an application storage resource management provider ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/30/2014 | 3:50:18 PM
Re: Policy
I think many enterprises put more faith in procedural documentation. ie, What should be done, who should perform the tasks, how they should be performed. I think its because these components are quantifiable to some extent and can show great value. And most importantly represent actionable items. However, I think it is important to map out WHY as well. Which is what policies provide. 

As you stated policy establishes the base. For example, we are performing these procedures because our policy dictates that standard accounts should not contain admin privileges. Our policy is such because it helps to protect our environment from watering hole events. There are many reasons as to why policy should be established and I am perplexed as to any who would be opposed to having one.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/30/2014 | 10:11:19 AM
Re: Policy
Ryan, it seems to me that policy is a bottom line basic for an enterprise, large or small. Why do you think organizations drag their feet about establishing them? 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/27/2014 | 10:24:49 PM
Re: Policy
Good SANS reference. I recently took the SANS GSEC and many of the questions stemmed around corporate policy and how it very muchs integrates with security intiative. Very interesting on how laying a policy out logically can extend and enhance the technical aspect of what you are trying to accomplish.
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/27/2014 | 10:13:49 PM
Re: Policy
Good point. I agree that policy is a key issue. It can be complicated, but there a lot of good templates and best practices out there that can give people a headstart: http://www.sans.org/reading-room/whitepapers/leadership/managing-implementation-byod-policy-34217

BP
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/27/2014 | 6:18:53 PM
Policy
Great article. A well defined policy can put your organization to advance initiatives such as mobile device management and EMM. I have many conversations with Gartner about Mobile Devices and they always implore the establishment of policy. Policy can set the baseline to refer to during deployment and can be very effective if future events leave configuration ambiguous. Without proper documentation there isn't anything to compare a healthy config against. 
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If youre still focused on securing endpoints, youve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas and her guest, David Shearer, (ISC)2 Chief Executive Officer, as they discuss issues that keep IT security professionals up at night, including results from the recent 2016 Black Hat Attendee Survey.