Six tips for mobile device management security

There has been a lot of discussion this year about the increasing influx of consumer devices being used for both professional and personal purposes. Many organisations are feeling a little overwhelmed as they try to work out appropriate security levels and device management boundaries. When you take into consideration all the platform and application updates chewing through corporate bandwidth, plus the potential for rogue applications and malware to gain illicit access to company data, there are many headaches for security managers to deal with.

Here are six tips to help get the efficient and secure management of mobile devices under control:

1. Have a strong mobile policy

This may seem like an obvious tip, but there is often a clear disconnect between employees and employers’ expectations of how consumer devices will be used in the enterprise. Research from IDC found that not only were workers using their devices at twice the rate, they also tended to think employers were far more permissive of the use of consumer devices than they actually were. It is therefore very important to have a mobile use policy clearly defined to avoid these kinds of misunderstandings.

A mobile usage policy is a framework that defines who the users are and what devices, platforms and applications they can and can’t use. Enterprises must clearly define policies around reimbursement for services and what applications users can access via personal devices, along with clear guidance on who controls the data on devices.

2. Create an inventory of assets

How can you be assured of the security of employees’ mobile devices if you don’t know how many are out there and what they are? Implementing a robust and regularly updated inventory management system is a vital part of any mobile device management system. While many businesses do have an inventory of fixed and wireless assets, the majority of them are not updated and validated on a regular basis, leading to the potential for security issues to slip through the cracks via unknown devices or inappropriate usage. Businesses with accurate inventories have much clearer insight into their telecommunication environments and as such, more reliable information on which to base policy decisions.

3. Ensure proper configuration of devices

The sheer number of different devices and platforms out there can make the configuration of devices a challenging process. Factor in entry level handsets, smartphones, tablets with different operating systems and employees working in numerous different locations and the issue becomes even more complex. However, if a device is enrolled with a mobile device management server, a configuration profile defined and managed by IT admin can be implemented, enabling the device to interact with enterprise systems. An appropriate level of encryption can also be added to any commands coming from the server to ensure that settings cannot be altered without proper authorisation.

4. Implement appropriate security

Despite the influx of consumer devices into the workplace, many organisations haven’t implemented stronger security controls in response, leaving them at risk of security breaches or loss of sensitive data. Data encryption is a powerful piece of the mobile security puzzle and yet many businesses do not use it on a regular basis. In addition to implementing data encryption, enterprises need to inform workers about the risks of failing to comply with security protocols – there is a good chance that they are unaware of the risks associated with using their personal devices for professional purposes.

5. Regulate application protocols

Taking into consideration that there are thousands upon thousands of mobile applications out there, strong protocols need to be instituted for the deployment of any new applications and the management of existing applications. Malware is steadily creeping into the app world, so even applications from the app store need to be checked before they are allowed into the enterprise. Such malicious applications can take over the mobile device and operate in the background without the user knowing, searching for sensitive information such as passwords or banking details.

6. Provide training and end-user support

A relatively small percentage of the overall functionality of the average mobile device is used on a regular basis. With devices becoming more and more sophisticated, users could end up massively under-utilising all the functions that are at their disposal. As a result, most enterprises would benefit from providing user training, including how to set up email, device customisation, application selection and usage, understanding browser capabilities, using instant messaging, and mobile data services and understanding device functions and shortcuts. Support and training can increase worker efficiency and also reduce security risks, as employees better understand how their devices work.

Managing employee mobility doesn’t need to be a nightmare. With the right systems put into place, employees and employers alike can reap the benefits of mobility.

Original Publication

Managing the mobile security paradigm

There have been profound changes in recent years in the way that people work. Mobility, virtualisation and globalisation have extensively altered how business is conducted. These changes mean that updated and upgraded security systems are needed to ensure data security.

There are new collaborative methods to help companies manage their information systems, solutions for virtualising information applications and cutting excessive investments are springing up and fresh hardware is delivering more mobility every day. But with these altered usage patterns come new threats and risks to security.

Professional and personal data confusion

Mobility is becoming an increasingly important aspect of business, and workers using devices such as smartphones or tablets to access the corporate network are quickly becoming ubiquitous.

However, there is a trend towards employees bringing their own device to work and using their personal smartphone or tablet for professional as well as personal purposes. This consumerisation of computing, with its permanent connection to the corporate network, increases the potential danger of data leaks if the device is lost or stolen. There is an increased risk of professional/personal data confusion, potentially resulting in legal penalties for the business and serious risk of virus and malware issues, as many personal devices are not properly protected.

Recent technologies such as cloud computing and social networking are helping to create these new usage patterns and ways of sharing information. These changes require a much higher level of transparency. Considering many organisations are increasingly subject to compliance regulations, it is vital to have strong and secure information systems in place. Companies need to identify and protect confidential information and show due care and diligence in protecting this information, not just for their own privacy but also for their customers.

Threats

Threats to companies are proliferating at an exponential rate. On average, there are 2,000 new threats every day adding to the estimated 45 million viruses already in circulation.

Attacks are more targeted and sophisticated than ever before, representing a substantial threat to businesses, government and sensitive infrastructures such as the military, utilities, hospitals and others. This makes having appropriate security defences in place for mobile devices paramount. With so many threats out there, the chance of a breach is just too high.

For internal protection against these clandestine threats, strong security infrastructure is required to protect organisational communication and information systems and ensure that everyday business is not disrupted. Different solutions to consider include firewalls, filters for incoming and outgoing web and mail data, IT infrastructure segregation for extranets, partner networks and strong intrusion detection systems that can identify unusual activities and suspicious behaviour and stop threats from infiltrating the corporate network.

External end-user protection is also crucial and may initially seem like a straightforward issue, but becomes increasingly complex when you factor in the multiple devices in use by many workers, in many locations. There are many security systems to consider, such as user authentication and authorisation, secure communications between users and corporate networks, security monitoring to provide transparency and validation of the compliance process and day-to-day security reports and monitoring.

A balance between protection and freedom

However, it is critical to maintain a balance between protection and freedom, as too much complexity within security systems can overburden the network, slowing down application response times and making it difficult for employees to access the network when needed.

Too many different solutions can also have the undesirable result of creating loopholes and system vulnerabilities, making it easier for cybercriminals to infiltrate the network and exploit confidential information.

Implementing appropriate security for the new working paradigm may seem like a formidable challenge. However, mobility does not have to be a risk for organisational security – with the right solutions in place, it can create new efficiencies and cost savings while allowing the workforce to work anytime, anywhere.

Original Publication

Embedded network security: defence at all levels

Perimeter controls are no longer enough

Confidential information is increasingly at risk in many organisations. Recent incidents have shown that perimeter controls are no longer enough—businesses need to seriously update their security strategies to reflect new threats and new working practices. With bring-your-own-device becoming the norm and employees becoming more mobile, company data is increasingly being taken out of the organisation on laptops, smartphones, tablets and more. Third parties are connecting to the corporate network on devices that the IT department has little, if no, control over, and branch offices are becoming the mainstay of multinational organisations.

The traditional perimeter around a business is no longer there, so companies must adapt to ensure their security, both internal and external, is up to scratch. Those businesses who do not modernise their security will inevitably be more at risk of a security breach that has the potential to seriously disrupt regular business activity.

The Nomadic Challenge

In the knowledge economy, rock-solid security is a must have. Intellectual property is at a financial premium, so it is essential to protect it from inadvertent loss and to keep it out of the reach of professional fraudsters. Information is becoming increasingly difficult to secure in companies that have many branch offices with limited IT resources and growing numbers of mobile workers.

The task of securing information has been made much more difficult by the workforce becoming increasingly nomadic. While this extends a company’s reach, it also extends their risk. Confidential information is frequently out in the field and away from the direct control of the IT department. With increased mobile working, it is not all that surprising that there has been a rise in laptop loss and theft, and yet, few companies encrypt the data stored on mobile devices.

The 3rd Party Challenge

It is not just mobile employees who can put a strain on an organisation’s security. An increasing number of organisations are inviting third parties into their corporate environments and providing them with company services, such as email, web portals and business applications. In security terms, third parties introduce an unknown quantity into the organisation—their devices may not be secured and could potentially introduce malware into the network, or they may not be properly identified and inadvertently given access to confidential information.

The Remote Site Challenge

It is at smaller sites where the risk is most pronounced. Many multinationals have moved away from having a handful of very large sites and offices to a decentralised infrastructure with many smaller offices, depots, sites or outlets. Centralised delivery of enterprise applications over the corporate WAN is empowering this change, however, this often means that there is very little IT resource needed at smaller sites. Although this centralised delivery is an efficient use of resources for application delivery, it leaves smaller locations exposed with little to know IT security onsite.

The Trusted Zone Challenge

Essentially, the corporate network cannot be relied on to be the “trusted zone” that it once was. Organisations need to become “de-perimeterised”. There is no point in having an enterprise perimeter if workers need to access corporate information when they are outside of it. To protect the de-perimeterised organisation, it is important to have security embedded throughout the business.

Enterprises need to have consistent and comprehensive security from the edge of the enterprise through the local area network to the end user. All assets and sites need to be protected as security is only as strong as the weakest link. Automatic preventative devices, which can automatically take action based on what the device has detected, should be embedded throughout the organisation at all layers. Security controls need to be embedded in the infrastructure layer, the transport layer and the application layer in order to ensure that the entire organisation is secure from threats.

For example, user authentication needs to be embedded within the application layer to control access to company resources. The level of accreditation needs to be automatically calculated based on the user’s personal security level and the device and network from which he or she wishes to access the resource.

Embedded network security Opportunity

The de-perimeterisation of an organisation means that security breaches don’t just happen outside a nominal boundary that is protected by a firewall, they can happen just as easily inside. For this reason it is essential to also embed security in the transport layer so that all communications within the business are protected from security breaches.

For too many businesses, security is still seen as merely an expense, when in fact good security offers many business advantages. Security must be seen as an essential element to growing the business, as it not only protects users, but it also enhances productivity by making sure the right people access the right resources at the right time. Embedded network security can ensure that an organisation is secured from top to bottom, providing invaluable peace of mind.

Original Publication

Security complexity threatens enterprises

Information security is one of the biggest challenges facing enterprises this year. Being hacked by criminals is becoming depressingly familiar for a many businesses. A roll call of prominent brands has succumbed to what is an unprecedented number of attacks. Increasing threats, regulations and complexity have catapulted network security up the corporate agenda. Considering billions are being spent on cyber security each year, why are businesses continuing to fall victim to cyber attacks?

The changing dynamics of the workplace have led to increasing complexity of enterprise security. Employees bringing their own devices to work, escalating the growth of data and need for corresponding protection. The proliferation of new cyber threats, daily, and the sheer number of security solutions available make a chief information security officer’s job a formidable challenge. These are issues that need to be examined in greater detail.

Employees and BYOD

The consumerisation of technology has been one the biggest trends in recent years—one that shows no sign of abating. Consumerisation has brought a whole new range of devices into the workplace, often as part of a sanctioned Bring Your Own Device (BYOD) program. These additional devices can create security and management headaches for enterprises as they struggle to deal with the implications of securing corporate data. Employees using their own devices also create numerous additional access points to the network—leading to many more opportunities for cyber criminals to attack the enterprise network, as well as leading to greater potential for data leakage.

Data growth is rocketing

Exacerbating the impact is the explosion in data. Over the last five years, data on the internet has increased five-fold, to almost 2 zettabytes (billion terabytes) and this trend is likely to continue on an exponential scale in the foreseeable future. Video is one of the main culprits—in January 2012, YouTube reported that 60 hours of video were being uploaded every minute to the site, equating to more than 300,000 full-length feature films each week.

Aside from video, amidst this avalanche of data there is important confidential information such as legal documents, state secrets, company IP and healthcare data. The challenge for businesses is to identify what they are actually responsible for in this growing mass of information.

Compliance demands protection

Companies need to identify and protect confidential information—and not just to protect their own assets. An increasing raft of international regulations and legislation are demanding that enterprises show due care and diligence in protecting confidential information. This is an area that Australia is yet to cover in depth, but with the advent of more and more sensitive information going online—for example, healthcare—this will need to be addressed.

New threats daily

There are currently over 45 million different viruses in circulation, with over 2000 new ones appearing each day. The steady increase in threats, coupled with manyfold new vulnerabilities created by employees using their own devices for work purposes, means it is nearly inevitable that an enterprise’s defences will be overcome at some point. Businesses need to develop new methods and systems for protecting critical company information and sensitive customer data.

Solution overload, outsourcing and increasing cost pressures

The combination of rising threats in security, changing employee behaviour and increased regulation has led to myriad solutions being made available by vendors. The sheer scale and complexity on offer can make it confusing for businesses to know what to choose for optimum protection.

There is also an increasing disconnect between the budget available for security and the wide-ranging nature of the chief information security officer’s area of responsibility. Previously, security was only about being able to connect the network securely and safely. Now a CISO needs to be a business leader while also managing security policy, compliance, access and application security. Finding the right staff is also crucial, and the higher demand for IT specialists has created a skills shortage which is, in turn, driving the uptake of outsourced security services.

Businesses are looking to outsource their security needs to third party suppliers to utilise their specialist capabilities and knowledge which the business may lack internally. Managed security, from specialists, can better handle the complexities posed by increasing threats, regulation and costs, and can free up internal resources. It can also help simplify the business’s security controls, audit and reports—something that is vital for efficient compliance.

By taking complexity out of the equation, a business will be able to focus on developing its responses to security incidents, ensuring that its reputation does not suffer while also establishing itself as a leader in doing business securely. As we rapidly move into a mobile age, it is vital for business to adapt and grow with the times, or risk becoming a risk itself.

Original Publication

The six pillars of security operations

Six key points that should be considered when creating and developing a SOC

As mobilisation and bring-your-own-device (BYOD) becomes increasingly prevalent, business security has been propelled to the forefront of corporate strategy. The Security Operations Centre (SOC) is a key part of the enterprise security infrastructure – it enables an organisation to establish effective protection against security threats. There are six key points that should be considered when creating and developing a SOC that can effectively detect and counter any cyber threats in a timely manner.

1) Determine the correct policy.  

Security policy is the beating heart of an effective Security Operations Centre – it clearly defines the scope of protection and outlines the responsibilities of all relevant parties. The first step in designing a policy is to determine exactly what role you want the SOC to play. Will it simply observe, record and report on recurring attacks? Will it be actively involved in mitigating threats? Determining its role is crucial to ensuring your resources are not working against each other, but are instead working in harmony.

The second step is to agree on the scope of your SOC’s activities, such as whether it is restricted to the network only, or includes suspicious behaviour from user activity. An effective policy allows for the delegation of responsibility for certain actions within the SOC, maintaining close involvement among related parties who need to work together to accomplish a shared purpose.

2) Perform risk analysis

In a perfect world, there would be no risk and thus no need for security. But since the world is not perfect, risk is the main driver of security processes. A careful risk analysis can reveal critical issues – maybe issues you originally thought were insignificant, or perhaps vice versa. For example, attention may have previously been focused on your network monitoring, with anti-virus updates taking lesser precedence. This leaves your organisation more vulnerable due to anti-virus signatures not being updated.

A thorough risk analysis will enable you to pinpoint any threats and take corrective action. The results of the risk assessment should be used as the foundation of your security policy, with periodic reassessments. The SOC must meet the strategic needs of the business and it is usually appropriate to revise the risk analysis on an annual or biannual basis.

3) Define appropriate procedures

Procedures are vital – they will inform the actions you take in any security crisis. Implementing a clear set of procedures for your SOC will mean that all parties know, and understand, how to undertake their responsibilities properly in the event of an attack. If your current procedures need altering, if they do not meet best practice standards, changes should be agreed to by all parties involved.

It will also be valuable to provide instructions on how to best implement the procedure tools. Small but significant details about business operations should be stated clearly and used as reference in any incidents.

4) Focus on staffing

Staff are the life blood of any organisation, so your SOC staff are in a key position to prevent any threats disrupting your business. It is therefore essential to hire experienced staff such as incident responders, IDS analysts or knowledgeable forensics analysts with proper network experience. These people may not be easily found amongst job seekers and they may be expensive to hire, but the bottom line is – you get what you pay for. They are valuable resources who can search for a tiny detail in an ocean of data, and this ability makes them a good investment. It is too risky to have a security attack go unnoticed due to inexperienced staff.

5) Consider the organisational dynamics 

When you begin to implement your SOC, you need to define your organisational dynamics. There are three tiers you should consider, namely:

Tier 0: Core services where the security centre operational procedures run monitoring, prevention and mitigation of incoming attacks. Tier 0 is responsible for performing incident response, complete monitoring, and providing the patches and updates appropriate to the business needs of the organisation.

Tier 1: Internal customer base. This tier incorporates the other departments in your organisation which receive security protection. Protection and monitoring Tier 1 are daily duties.

Tier 2: External or business partners. When business is being conducted over the shared network, they are protected by your security operational procedures and monitored directly.

These three tiers require different levels of security. Tier 0 needs optimum protection and control over any incoming threats, while Tier 2 only needs minimum protection. Ideally, the critical assets in Tier 0 should be kept close to the core of the security operations centre.

6) Integrate the SOC in the organisation

It is necessary to integrate the SOC into your organisational information flow and activity. If there is any information that is valuable to the SOC, it needs to be passed on as every piece of information helps. Integration of information and effective communication strategies will enable the security operations manager to obtain information from within the organisation that may be relevant and applicable to detecting threats. Fully integrating the SOC into the organisation will enable a rapid response to any attacks.

These six pillars are vital to building a strong and effective security operations centre. By having a solid SOC, you can feel confident conducting daily business with minimal risk. In an increasingly online world, having the right defense in place is critical to business operational security.

Original Publication on CSO