Your Company Data, Their Personal Device What Could Go Wrong?

Transcription

1 Your Company Data, Their Personal Device What Could Go Wrong? Top 5 Myths about Mobile Security By Barbara Hudson, Senior Product Marketing Manager Employee use of smartphones and tablets to access corporate information and services is exploding. And that means IT organizations need to get beyond widely-held myths about improving their mobile security profile. Warning: Failure to do so is not an option.

2 Pervasive mobility is now a fact of life in organizations of every industry, size and geography. More and more employees are using smartphones and tablets as highly-functional mobile computers. Most organizations have accepted that reality. In fact, nearly 90% of IT professionals polled in a recent InformationWeek survey on mobile security said their organizations permit the use of personally-owned devices, or are moving in that direction. Every day, more organizations are adopting BYOD (bring your own device), often through formal programs and policies. Few technologies are expected to have as great an impact on business operations over the next few years. In a May 2013 report, the McKinsey Global Institute concluded that the mobile Internet would have the largest economic impact among all potentially economically disruptive technologies. Mobile security challenges With increased mobile device use comes a series of potential drawbacks. The increased threat of cyber attacks on mobile devices can result in data loss, security breaches, and compliance/ regulatory violations. That leaves IT organizations scrambling to come up with the right mix of mobile security defenses in order to balance protection, governance and user flexibility. Because so many employees are using consumer-class smartphones and tablets as PC replacements, organizations recognize that they must be extra vigilant against malicious theft attempts, denial-of-service attacks or potentially disastrous end-user carelessness. One of the biggest challenges for IT leaders is making sure that their users and business leaders fully understand the implications of faulty mobile security practices. And they are trying to get users and management to put in place essential steps to secure their mobile devices. For many organizations, overcoming mobile security challenges is a full-time task, with a host of operational issues. For instance, in healthcare settings the typical clinician now uses more than six different mobile devices every day, according to IDC. As the use of mobile devices becomes embedded in organizations core business processes, a number of misconceptions and myths are making IT decision-makers jobs more difficult than ever. Top 5 myths about mobile security Myth 1: Everyone needs full rights to all network-based data and services. This is a common lament for IT organizations. An end user s title or job function shouldn t mean they have access to all applications and services at least not all the time or under all circumstances. Users must have clearly established identities that take into account their responsibilities and authority to access, use and share data, applications and services. And rules and policies must be well documented and meticulously followed. This becomes even more problematic when dealing with contractors who, in many cases, need some form of network access over open Wi-Fi networks. A Sophos Whitepaper July

3 Segregating network data, applications and services is a security best practice. IT professionals need to implement security software that automatically manages identities and access for all employees and contractors. Myth 2: Employees are savvy about proper use of mobile devices and can be trusted to avoid risks. It s true that many users are quite savvy about accessing data and applications using mobile devices. But that doesn t mean they re using smart security practices. It s hardly unusual for an IT manager to stroll around a department and find passwords written on Post-it notes attached to monitors or desks. At the same time, IT s repeated attempts to encourage users to change their passwords regularly and avoid using easy-tocrack passwords are often ignored. The trend known as bring your own software or services (BYOS) is another area of growing concern, when an employee uses applications for both work and personal use to access information and services behind the corporate firewall. IT organizations must put in place policies for locking and wiping lost or stolen devices, and there are security solutions that can do that quickly and automatically according to organizational policies. Finally, keep in mind that not all users regularly update their device software especially security patches and new encryption schemes. Myth 3: Data protection is a concern for company executives, not rank-and-file employees. This is a dangerous misconception for a number of reasons, not the least of which is that malware attacks most often strike from the web. Unless a user s personal mobile device has been properly and regularly protected, it s an open invitation to any number of malicious attacks. Web attacks not only put corporate data at risk, but also seriously undermine user productivity because access to data, applications and services is denied. Employees end up losing the use of their personal devices for work while IT organizations search for the cause of an attack and fortify the device against future attempts. Then, there are the legal issues. Users don t like being dragged into discussions with attorneys and compliance officers about whether they regularly follow company policies and security protocols. It s important that all mobile device users not only understand organizational best practices, but also recognize their role as the potential weak link in the security chain protecting corporate assets. Myth 4: BYOD compliance programs are unnecessarily rigid and inhibit user flexibility. This may have been true for some organizations as IT departments struggled to understand how to accommodate personal mobile devices in the workplace. Today, however, most organizations have implemented rules and guidelines that balance the need for security and compliance with users desire to use familiar platforms wherever and whenever they work. Some organizations have even implemented formal choose your own device (CYOD) programs, ensuring that the use of consumer devices is in compliance with organizational policies and industry regulations. A Sophos Whitepaper July

4 BYOD compliance mandates don t have to be a burden on users. Well-established guidelines and automated mobile device management tools can save time and money, making users happier and more secure. Myth 5: Encryption is a security issue, not an operational one. By now, it s clear to IT departments and their business stakeholders that personal mobile devices and the data on them must be protected with strong encryption schemes. Encryption does more than protect company data. Users certainly care that their personal data, applications and services are safe and secure, and that their devices can t be improperly used if they are lost or stolen. Proper encryption of mobile devices is a vital element in most organizations disaster recovery and business continuity plans. And it should be regarded as an operational imperative for all users, not just a technical requirement for the IT team to worry about. What to look for in a mobile device security solution First, you ll need to make sure your security solutions can support a wide variety of devices. This includes hardware platforms like Apple, Samsung and BlackBerry, along with their operating systems (such as Android, ios, BlackBerry and Windows Phone 8). Your mobile security solutions will need to seamlessly integrate with your infrastructure and services framework, so look for security solutions with strong application management and control features. You ll also want the ability to block unwanted applications from executing, as well as to deploy required applications. Naturally, your security platform must incorporate not only industry-standard security best practices, but also policies unique to your organization. It must include robust data encryption and data protection from the onset, not added on after the fact. Finally, policy management and compliance protocols are an essential part of today s mobile device security solutions. Sophos mobile security solutions Sophos Mobile Control (SMC) is a long-established and highly-regarded security software suite that includes essential mobile security functions such as device management, encryption, security, application management and data protection. SMC supports all popular device platforms, including ios, Android, Samsung SAFE, BlackBerry and Windows Phone 8. You can deploy SMC either on-premise or using a Software-as-a-Service model. And Sophos works closely with numerous managed service providers who offer a no-worries, pay-as-yougo managed service. SMC can scale easily from a few devices to thousands of devices, making it an ideal solution for a wide range of organizations, regardless of their growth profile. SMC s highly automated feature set eases the burden of managing the growing number of mobile devices across your organization. Over-the-air management and user self-service through an intuitive, easy-to-use web portal also save IT time. A Sophos Whitepaper July

5 Your Company Data, Their Personal Device What Could Go Wrong? The solution ensures that only compliant mobile devices have access to corporate and data, and that devices out of policy compliance are locked or wiped if lost or stolen. The Sophos Mobile Encryption app gives users the ability to securely access encrypted files stored in the cloud, with Dropbox, Egnyte and other storage provider integration for transparent use. Sophos SafeGuard Enterprise Encryption for Cloud Storage from a Windows workstation integrates tightly with Sophos Mobile Encryption, enforcing password complexity. SMC also supports an add-on application, Sophos Mobile Security, to protect Android devices against web-based attacks. Conclusion IT organizations are being asked to embrace and support user demands to access essential data, applications and services on tablets and smartphones. And this trend will only accelerate in the coming years. That puts major pressure on IT and security teams to ensure that those devices are used in accordance with policies and best practices designed to safeguard corporate assets. IT leaders have discovered that there s a very fine line between giving mobile users the freedom and flexibility to use personal mobile devices, and potential disaster brought on by faulty technology, inappropriate user behavior, or both. Fortunately, mobile security solutions available today can support all hardware and software platforms and offer automated prevention and remediation of problems. Sophos Mobile Control is a richly featured, highly automated security suite for mobile devices across a variety of platforms. Its tight integration of device management, security, data protection, compliance management, encryption and other security measures makes it a smart choice for IT decision-makers. Sophos Mobile Control Sign up for a free trial at Sophos.com United Kingdom and Worldwide Sales Tel: +44 (0) sales@sophos.com North American Sales Toll Free: nasales@sophos.com Australia and New Zealand Sales Tel: sales@sophos.com.au Asia Sales Tel: salesasia@sophos.com Oxford, UK Boston, USA Copyright Sophos Ltd. All rights reserved. Registered in England and Wales No , The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners GH.wpna.simple