Risk
3/25/2011
01:45 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Consumerization Of IT: Security Is No Excuse

At most companies, you can't just say "no" to consumer devices. Here's a plan to take the lead on information security issues.

InformationWeek Green - Apr. 4, 2011 InformationWeek Green
Download the entire Apr. 4, 2011 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Consumerization Of IT: Security Is No Excuse

Sorry to break this to you, but if you're looking to use security as the reason to keep consumer technologies out of your company, you'll have quite an uphill battle. Not because the security risks aren't real (they are), and not because you can guarantee the data security on the devices (you can't). It's because, as with virtualization, the business benefits significantly outweigh the security risks. As I heard one CIO say recently: "Consumerization is a parade. You can either get out in front of it to stop it and get trampled, or you can grab the baton and lead the parade."

Consumer devices are taking hold quickly in enterprises in part because it's easy to access company data without having to get IT involved. Any employee with ActiveSync access to corporate email can get that email on their personal smartphone or tablet in less than a minute.

The first challenge in securing personal smartphones and tablets is knowing when those devices are being added and removed from the company network, and knowing if they adhere to company policy. Bob the engineer could connect with to his corporate email with a BlackBerry today and a brand new Android phone tomorrow. The problem is your company's email server most likely can only push a security policy to BlackBerry or Windows Mobile devices. Without proper management, you don't even know that Bob is no longer adhering to company policy.

Don't despair. Securing the unknown starts with a tried-and-true technique: default deny. Through the use of mobile device management tools such as MobileIron, you can prevent devices your IT team hasn't researched or approved from connecting to company resources. Heck, you can even make it so that any device needs your mobile application installed on it before it can receive a single corporate email. These mobile device management applications can prevent unwanted applications from being installed, can force removal of certain apps, and can even remotely wipe devices, even if your email platform doesn't support security policies on those devices. If a device is rooted or jail broken, you can prevent it from connecting to your infrastructure altogether.

Oh, great, you're thinking: This guy thinks I'm going to default deny and then spend my life managing a whitelist of every single Android smartphone variation and every firmware variation.

To read the rest of the article,
Download the Apr. 4, 2011 issue of InformationWeek

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?