Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

8/23/2012
05:55 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

10 Tips For Protecting Mobile Users

Mobile employees, devices, and data need protecting. Here are 10 tips to make it happen.

These days, every user is mobile. Laptops, smartphones, tablets, and constant connectivity have unshackled all of us from our desks. And thanks to the ready availability of apps and cloud services that blur the line between consumer and business tools, we're also unshackled from controls over company data. Many IT departments are having a hard time keeping up--mainly because they've failed to adapt as quickly as their users to the new reality.

TIP 1: Allow Device Freedom Within Certain Bounds
"BYOD does not mean bring every device. If you have a reasonably restricted universe of devices to choose from, the right tools in place to manage them, and the right policies, BYOD can be imminently successful."
--Craig Mathias, analyst, Farpoint Group

Most companies have some form of mobile security policy in place. Sixty-two percent of respondents to InformationWeek's 2012 Mobile Security Survey have policies that lets employees use personal mobile devices for work. However, many of these policies are far from fully fleshed out. And often businesses lack the means to monitor mobile use of data across all devices and applications, which limits IT's ability to enforce those policies.

To enable users to get the most out of their mobile technology and protect them in the process, companies must consider several factors, including device selection, data security, device management, net- work security support for mobile devices, and application controls. We spoke with a number of experts on these matters concerning the challenges involved and to get tips on how to develop a solid mobile security program.

TIP 2: Strong Data Security Means Strong Mobile Security
"Until we can control mobility at the data level, rather than protecting the systems or devices, we're going to continue to have all kinds of security issues."
--John Nicholson, attorney who specializes in IT compliance issues

Device Selection

The increasing diversity of device types, operating systems, and applications is complicating attempts to secure mobile infrastructure. In the past, IT could be reasonably confident that most employees would use a Windows-based computer and a BlackBerry. Companies could standardize around a few endpoint configurations, which simplified tasks for managing and securing the infrastructure. "All that's flying out the window now," says Dave Frymier, chief information security officer at Unisys, an IT services provider. "You can't treat everybody the same anymore."

TIP 3: Fold Mobile Strategies Into Overall Security Framework
"You can't just create a mobile security policy or a BYOD policy. You should really be doing this as part of your overall company security policy."
--Jim Kunick, intellectual property attorney

But that doesn't mean anything goes. IT needs to strike a balance in the size of its device ecosystem to enable user freedom while maintaining the manageability of the IT environment, says Craig Mathias, an analyst with Farpoint Group. It may not be as structured as the standardized endpoint configurations of yesteryear, but some kind of enforceable policy on the devices allowed to connect to the network should be drafted to draw bounds on the scope of IT's mobile concerns, he says.

TIP 4: Don't Forget Basic Laptop Management
"You need to do the basic blocking and tackling of handling a PC. Those aren't particularly sexy things, but they are very important."
--Dave Frymier, CISO, Unisys

Many IT shops do just that, according to InformationWeek's Mobile Security Survey, which found that 42% of respondents who have or are developing a policy for mobile devices allow any device as long as the user agrees to certain policies. Another 40% allow a limited range of devices, and users must run mobile device management software. By contrast, just 10% allow user-supplied devices with no restrictions.

All About The Data

While most mobile security planning discussions begin (and often end) with talk about mobile device management technology, that's putting the cart before the horse. "We don't recommend purchasing a single piece of MDM software until you've thought through what information you have, who needs to access it, under what circumstance, when, where, and with what degree of security," Mathias says. "That implies that you have policies available in advance of making any purchasing, strategy, or deployment decisions. Not doing that is a mistake people make all the time."

TIP 5: Look For MDM That Allows For Maximum Endpoint Management Consolidation
"It doesn't make sense to have five different management consoles to run your wired and wireless network, laptops, smartphones, laptops, etc. You want to roll it all up in one place if you can."
--Craig Mathias

Policies should emphasize data protection, not just device protection, and that includes data in motion and at rest, says Howard Creed, a solutions consultant for IT security value-added reseller MCPc.

To establish that data-first mentality, you must know exactly what data you have. Jim Kunick, an intellectual property attorney at Chicago law firm Much Shelist, recommends clients put data into three categories: non-confidential data, confidential data, and highly sensitive data such as financial information and other types that fall under compliance or regulation requirements. He says the next steps are to determine who gets access to each category and codify that into your mobile policies.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26077
PUBLISHED: 2021-05-10
Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring...
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.