Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

8/23/2012
05:55 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

10 Tips For Protecting Mobile Users

Mobile employees, devices, and data need protecting. Here are 10 tips to make it happen.

These days, every user is mobile. Laptops, smartphones, tablets, and constant connectivity have unshackled all of us from our desks. And thanks to the ready availability of apps and cloud services that blur the line between consumer and business tools, we're also unshackled from controls over company data. Many IT departments are having a hard time keeping up--mainly because they've failed to adapt as quickly as their users to the new reality.

TIP 1: Allow Device Freedom Within Certain Bounds
"BYOD does not mean bring every device. If you have a reasonably restricted universe of devices to choose from, the right tools in place to manage them, and the right policies, BYOD can be imminently successful."
--Craig Mathias, analyst, Farpoint Group

Most companies have some form of mobile security policy in place. Sixty-two percent of respondents to InformationWeek's 2012 Mobile Security Survey have policies that lets employees use personal mobile devices for work. However, many of these policies are far from fully fleshed out. And often businesses lack the means to monitor mobile use of data across all devices and applications, which limits IT's ability to enforce those policies.

To enable users to get the most out of their mobile technology and protect them in the process, companies must consider several factors, including device selection, data security, device management, net- work security support for mobile devices, and application controls. We spoke with a number of experts on these matters concerning the challenges involved and to get tips on how to develop a solid mobile security program.

TIP 2: Strong Data Security Means Strong Mobile Security
"Until we can control mobility at the data level, rather than protecting the systems or devices, we're going to continue to have all kinds of security issues."
--John Nicholson, attorney who specializes in IT compliance issues

Device Selection

The increasing diversity of device types, operating systems, and applications is complicating attempts to secure mobile infrastructure. In the past, IT could be reasonably confident that most employees would use a Windows-based computer and a BlackBerry. Companies could standardize around a few endpoint configurations, which simplified tasks for managing and securing the infrastructure. "All that's flying out the window now," says Dave Frymier, chief information security officer at Unisys, an IT services provider. "You can't treat everybody the same anymore."

TIP 3: Fold Mobile Strategies Into Overall Security Framework
"You can't just create a mobile security policy or a BYOD policy. You should really be doing this as part of your overall company security policy."
--Jim Kunick, intellectual property attorney

But that doesn't mean anything goes. IT needs to strike a balance in the size of its device ecosystem to enable user freedom while maintaining the manageability of the IT environment, says Craig Mathias, an analyst with Farpoint Group. It may not be as structured as the standardized endpoint configurations of yesteryear, but some kind of enforceable policy on the devices allowed to connect to the network should be drafted to draw bounds on the scope of IT's mobile concerns, he says.

TIP 4: Don't Forget Basic Laptop Management
"You need to do the basic blocking and tackling of handling a PC. Those aren't particularly sexy things, but they are very important."
--Dave Frymier, CISO, Unisys

Many IT shops do just that, according to InformationWeek's Mobile Security Survey, which found that 42% of respondents who have or are developing a policy for mobile devices allow any device as long as the user agrees to certain policies. Another 40% allow a limited range of devices, and users must run mobile device management software. By contrast, just 10% allow user-supplied devices with no restrictions.

All About The Data

While most mobile security planning discussions begin (and often end) with talk about mobile device management technology, that's putting the cart before the horse. "We don't recommend purchasing a single piece of MDM software until you've thought through what information you have, who needs to access it, under what circumstance, when, where, and with what degree of security," Mathias says. "That implies that you have policies available in advance of making any purchasing, strategy, or deployment decisions. Not doing that is a mistake people make all the time."

TIP 5: Look For MDM That Allows For Maximum Endpoint Management Consolidation
"It doesn't make sense to have five different management consoles to run your wired and wireless network, laptops, smartphones, laptops, etc. You want to roll it all up in one place if you can."
--Craig Mathias

Policies should emphasize data protection, not just device protection, and that includes data in motion and at rest, says Howard Creed, a solutions consultant for IT security value-added reseller MCPc.

To establish that data-first mentality, you must know exactly what data you have. Jim Kunick, an intellectual property attorney at Chicago law firm Much Shelist, recommends clients put data into three categories: non-confidential data, confidential data, and highly sensitive data such as financial information and other types that fall under compliance or regulation requirements. He says the next steps are to determine who gets access to each category and codify that into your mobile policies.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19719
PUBLISHED: 2019-12-11
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
CVE-2019-19720
PUBLISHED: 2019-12-11
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
CVE-2019-19707
PUBLISHED: 2019-12-11
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
CVE-2019-19708
PUBLISHED: 2019-12-11
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
CVE-2019-19709
PUBLISHED: 2019-12-11
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.