Risk
5/30/2008
10:41 AM
Keith Ferrell
Keith Ferrell
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Are Your Employee's Phones Secure? All Of Them? Really?

Can a single unsecured smartphone compromise your business's security? Looks that way -- and that should make you look hard at who's got phones in your company, and how they're using them.

Can a single unsecured smartphone compromise your business's security? Looks that way -- and that should make you look hard at who's got phones in your company, and how they're using them.Here we go again. As we've pointed out often, the explosion of powerful, capable consumer communication/IT devices holds a lot of risk for your company.

A long Informationweek look at the business dangers of rogue smartphones tells you why.

A rogue device is, in this context, one that an employee -- or, for that matter employer -- buys personally and then uses for business purposes.

In the case of smartphones, as the article points out, the devices' convenience, power and declining price makes them all but irresistible to road warriors, would-be road warriors and, increasingly, nearly everybody else.

And as employees lean more heavily on such devices, the devices become more and more filled with company data, company information, even company access codes.

All of which goes with the employee -- until the employee forgets the phone, loses the phone or has the phone stolen.

Or, assuming the person's at least cautious about keeping the phone physically close, holding it tightly when he or she uses it to pump company info through an unsecured public access point.

Time to put into place strict and inflexible security procedures and policies regarding employee use of personal mobile (and other) devices for company business.

Past time, really, and not getting any safer to wait, as Eric Zeman's article points out, with plenty of detail on just how to go about securing rogue devices.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio