SECURITY ARCHITECTURE INSIDER
Policies for reducing mobile risk
Lisa Phifer
04.25.2006
Rating: --- (out of 5)
|
Today, many workers are carrying PDAs, smartphones and other mobile computing devices containing at least some business data, such as contact lists, account passwords, confidential e-mails and file attachments. A 2005 Nokia study found that 21% of US employees carry PDAs and 63% carry mobile phones used for business. While these devices are increasingly well-connected, they are largely unsecured and can pose a significant risk to business networks and data. Reducing that risk starts with establishing an information security policy that deals with both employee-purchased and company-owned mobile devices.
Risky business
When a mobile device is lost or stolen, any business data it contains is jeopardized. Laws, such as California SB1386 (and similar laws introduced in 35 states last year), require companies to notify individuals whose private information may have been compromised. And businesses that violate industry mandates like HIPAA and GLBA face hefty fines or even jail time. But many companies cannot even enumerate the data carried by lost or stolen mobile devices.
A growing number of workers are using PDAs and smartphones to access business networks and applications. In the Nokia study, commonly-used mobile applications included e-mail, instant messaging, corporate database access, sales force automation, field service, CRM and ERP/supply chain applications. Companies without mobile-specific applications may still face mobile exposure through traditional applications. For example, many employees synchronize company e-mail onto PDAs or forward messages to smartphones. Therefore, if lost or stolen, these devices can be used to gain unauthorized access to an ot
To continue reading for free, register below or login
To read more you must become a member of SearchFinancialSecurity.com
herwise private network and applications therein.
Additionally, many mobile devices now support multiple wireless interfaces, creating new attack vectors. Mobile phones with Bluetooth can be "BlueBugged" (used by an attacker to place calls) or "BlueSnarfed" (accessed to retrieve contacts and calendars). Cradled PDAs can become Wi-Fi bridges into corporate networks. When used correctly, wireless interfaces can aid productivity, but safeguards are needed to prevent misuse or attack.
Security policy
To manage these risks, companies need to define which mobile devices are allowed and under what conditions. They should place limits on network and application access, and on business data storage and transfer. Security measures and practices should be required, and processes defined to monitor and enforce compliance.
These decisions should be documented in a mobile device security policy -- a formal statement of the rules by which mobile devices must abide when accessing business systems and data. Such policies may include the following sections:
About the author
Lisa Phifer is vice president of Core Competence Inc., a consulting firm specializing in network security and management technology. Phifer has been involved in the design, implementation, and evaluation of data communications, internetworking, security, and network management products for nearly 20 years. She teaches about wireless LANs and virtual private networking at industry conferences and has written extensively about network infrastructure and security technologies for numerous publications. She is also the guest instructor for SearchSecurity.com's Wireless Security Lunchtime Learning.
|
|
|
|
|
|
