Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

8/23/2012
05:55 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

10 Tips For Protecting Mobile Users

Mobile employees, devices, and data need protecting. Here are 10 tips to make it happen.

These days, every user is mobile. Laptops, smartphones, tablets, and constant connectivity have unshackled all of us from our desks. And thanks to the ready availability of apps and cloud services that blur the line between consumer and business tools, we're also unshackled from controls over company data. Many IT departments are having a hard time keeping up--mainly because they've failed to adapt as quickly as their users to the new reality.

TIP 1: Allow Device Freedom Within Certain Bounds
"BYOD does not mean bring every device. If you have a reasonably restricted universe of devices to choose from, the right tools in place to manage them, and the right policies, BYOD can be imminently successful."
--Craig Mathias, analyst, Farpoint Group

Most companies have some form of mobile security policy in place. Sixty-two percent of respondents to InformationWeek's 2012 Mobile Security Survey have policies that lets employees use personal mobile devices for work. However, many of these policies are far from fully fleshed out. And often businesses lack the means to monitor mobile use of data across all devices and applications, which limits IT's ability to enforce those policies.

To enable users to get the most out of their mobile technology and protect them in the process, companies must consider several factors, including device selection, data security, device management, net- work security support for mobile devices, and application controls. We spoke with a number of experts on these matters concerning the challenges involved and to get tips on how to develop a solid mobile security program.

TIP 2: Strong Data Security Means Strong Mobile Security
"Until we can control mobility at the data level, rather than protecting the systems or devices, we're going to continue to have all kinds of security issues."
--John Nicholson, attorney who specializes in IT compliance issues

Device Selection

The increasing diversity of device types, operating systems, and applications is complicating attempts to secure mobile infrastructure. In the past, IT could be reasonably confident that most employees would use a Windows-based computer and a BlackBerry. Companies could standardize around a few endpoint configurations, which simplified tasks for managing and securing the infrastructure. "All that's flying out the window now," says Dave Frymier, chief information security officer at Unisys, an IT services provider. "You can't treat everybody the same anymore."

TIP 3: Fold Mobile Strategies Into Overall Security Framework
"You can't just create a mobile security policy or a BYOD policy. You should really be doing this as part of your overall company security policy."
--Jim Kunick, intellectual property attorney

But that doesn't mean anything goes. IT needs to strike a balance in the size of its device ecosystem to enable user freedom while maintaining the manageability of the IT environment, says Craig Mathias, an analyst with Farpoint Group. It may not be as structured as the standardized endpoint configurations of yesteryear, but some kind of enforceable policy on the devices allowed to connect to the network should be drafted to draw bounds on the scope of IT's mobile concerns, he says.

TIP 4: Don't Forget Basic Laptop Management
"You need to do the basic blocking and tackling of handling a PC. Those aren't particularly sexy things, but they are very important."
--Dave Frymier, CISO, Unisys

Many IT shops do just that, according to InformationWeek's Mobile Security Survey, which found that 42% of respondents who have or are developing a policy for mobile devices allow any device as long as the user agrees to certain policies. Another 40% allow a limited range of devices, and users must run mobile device management software. By contrast, just 10% allow user-supplied devices with no restrictions.

All About The Data

While most mobile security planning discussions begin (and often end) with talk about mobile device management technology, that's putting the cart before the horse. "We don't recommend purchasing a single piece of MDM software until you've thought through what information you have, who needs to access it, under what circumstance, when, where, and with what degree of security," Mathias says. "That implies that you have policies available in advance of making any purchasing, strategy, or deployment decisions. Not doing that is a mistake people make all the time."

TIP 5: Look For MDM That Allows For Maximum Endpoint Management Consolidation
"It doesn't make sense to have five different management consoles to run your wired and wireless network, laptops, smartphones, laptops, etc. You want to roll it all up in one place if you can."
--Craig Mathias

Policies should emphasize data protection, not just device protection, and that includes data in motion and at rest, says Howard Creed, a solutions consultant for IT security value-added reseller MCPc.

To establish that data-first mentality, you must know exactly what data you have. Jim Kunick, an intellectual property attorney at Chicago law firm Much Shelist, recommends clients put data into three categories: non-confidential data, confidential data, and highly sensitive data such as financial information and other types that fall under compliance or regulation requirements. He says the next steps are to determine who gets access to each category and codify that into your mobile policies.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15150
PUBLISHED: 2019-08-19
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
CVE-2017-18550
PUBLISHED: 2019-08-19
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
CVE-2017-18551
PUBLISHED: 2019-08-19
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
CVE-2017-18552
PUBLISHED: 2019-08-19
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
CVE-2018-20976
PUBLISHED: 2019-08-19
An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.