Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

5/21/2012
05:28 PM
50%
50%

Revamp Mobile Policy To Secure The Cloud

A majority of employees bring their own devices into work and connect out to the cloud -- now it's time to gain greater control over the security of these devices

There are benefits to allowing workers to bring their own devices and connect them to the corporate network, but businesses must take action to counter the risks user-owned devices can bring.

While more than eight out of 10 IT managers believe that a bring-your-own-device (BYOD) policy boosts productivity, more than 60 percent say employees connecting out to cloud services is a risk, according to a survey conducted by telecommunications and consulting firm BT.

"Organizations have to be aware of where their data is now -- in order to control access to it and protect it," says Jeff Schmidt, global head of business continuity, security, and governance at BT Global Services. "CIOs need to have a strategy for how they deal with data at rest and data in motion."

Cloud and the BYOD movement are two trends that are converging to create security problems for companies. Consumer technology could play host to malicious software, which could come from a cloud service or social network, allowing it to enter a business' network unhindered. Devices could also allow an insider to easily exfiltrate data.

"BYOD is a good trend, but there is a negative from a security perspective," says Michael Sutton, vice president of security research for Zscaler. "Where I see most companies migrating to is that they need some degree of control."

To blunt the danger of the always-accessible cloud, companies need to take a trio measures:

1. Employ policy tools from cloud providers.
Take service provider YouSendIt, for example. The company's service originally gave workers an easy way to send large files through e-mail -- the file was stored in the cloud and workers could send a link to the file in e-mail, reducing the bandwidth. Now the company's service works through any mobile device, as well. Users can upload large files or view the files from any mobile device.

[ An increasing amount of corporate data will be accessed through the cloud from anywhere in the world. Great for productivity? Yes, but it's also a security threat. See Cloud's Future Security Depends On Mobile. ]

To help customers deal with compliance requirements, the company has a number of ways of tracking data and limiting access. A company can, for example, bar the sending of corporate data to Gmail accounts. The reason for the controls are to help companies get a handle on where their data is going, says Mihir Nanavati, vice president of product management and user experience for YouSendIt.

"All bets are off in terms of security in the enterprise when users bring in their own devices," he says. "It is hard to manage all this complexity."

2. Institute tight control.
To create an appropriate policy, companies should first identify their important information assets, assigning a monetary value to each, BT's Schmidt says. By knowing the value of its data, a company can prioritize its defensive measures, including data encryption, digital rights management, and data-loss prevention solutions.  A variety of monitoring and log management should be done as well, he says.

Data can leak, not just through smartphones, but also thumb drives, laptops, and other portable storage devices, Schmidt says. Given that, companies should not expect a single technological fix.

"The industry is littered with good technology solutions looking for a problem," Schmidt says. "The important point here is that this isn’t solved with just one application or technical solution, but rather with an approach and direction that reflects your organization's risk appetite and culture."

3. Provide easy-to-use content.
When implementing policies and restrictions and mixing in new technology, companies need to remember that the entire BYOD movement is driven by ease-of-use. It is easier for a worker to bring his smartphone, while at the same time being less expensive for the company.

If security restrictions are too onerous, however, then employees will work around them, weakening security, Nanavati says.

"Administrators should be able to set policy -- absolutely," he says. "But you don't want administrators to be able to set policies that break the end-user experience. The users need to be able to access content when they need it."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/30/2012 | 6:51:03 PM
re: Revamp Mobile Policy To Secure The Cloud
There is a balancing act at work whenever it comes to security policies and making sure they don't hurt productivity. But enterprises should take a long look at whether adopting a BYOD approach is truly even worthwhile for them once they factor in risk and compliance requirements.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.