Fast Facts: On average, around one-third of employees travel regularly for work Just one in three companies, however, prepares for these trips by implementing security guidelines and other measures. This article explains how to protect smartphones and describes the factors that must be taken into account when choosing security solutions for mobile devices. A good one-third of employees do not work at their companies offices. Instead, they travel to customer and partner locations. The mobile devices they use particularly smartphones are, however, often unprotected once they leave company premises. This article describes how to protect smartphones and explains the functions essential to mobile security solutions. ------------------------------------------------------------------------------------------------------------- IT Security on Business Trips On average, a good one-third of the workforce travels for business purposes. It is, therefore, time for companies to systematically expand their security strategies to include mobile users. This article explains how to do so. Even if IT security experts don t travel much themselves, their customers often do. This creates one of the greatest security challenges facing IT departments. According to a survey carried out by Kaspersky among 1300 decision-makers in 11 countries, more than a third of employees regularly take business trips. No-one, however, travels with a pen and paper nowadays. Instead, notebook computers and smartphones are the order of the day. Many corporate security strategies, however, cover only office-based computers and networks, with the result that users are often on their own once they leave the premises. According to the Kaspersky survey, two out of three companies do not have security strategies in place to cover remote workers. Just 30 percent of companies have modified their policies to accommodate mobile devices, while 27 percent encrypt content on smartphones used for work [1]. Despite this, something of a rethink is taking place, with 55 percent of the companies surveyed stating that they are Page 1
much more concerned about mobile threats now than they were a year ago. Simply increasing awareness is, however, insufficient. Here are some practical tips. Mobile Protection Strategies An Essential Element Why should corporate security strategies take mobile phones into account? The answer is simple: because smartphones have so many functions. Smartphones are used most frequently to access communications systems. While this primarily, of course, involves phone and email systems, it also and increasingly includes other messaging systems, such as those used to manage schedules and provide comprehensive access to contact databases. In such cases, preserving the confidentiality of sensitive company data is essential. Third parties should not be permitted access to company emails, nor of course should they be able to access customer or vendor information. The next step is full access to corporate networks. Employees usually use VPN connections to dial into these. From here, they can access files and business applications such as ERP systems. One thing is clear: companies must prevent unauthorised users from using these networks to access internal company information, siphon off data, or manipulate existing applications. Smartphone Threats There are three basic scenarios against which smartphones must be protected. The most common is Category 1: smartphone loss or theft. Category 2 is similar to Category 1, in that it involves a third party gaining full access to a mobile device. In such cases, however, this access is for a limited time only, rather than being a permanent state of affairs. Say, for example, that an employee leaves his or her smartphone lying on the desk during the lunch break, and someone else picks it up. This also constitutes a real risk of corporate information being misused due to unauthorised access. Category 3 includes all the other attack scenarios including malware specifically designed for mobile devices, SMS attacks, and targeted data theft via specially designed emails or websites. None of these scenarios require the attacker to have physical access to the device in question. Protecting Yourself Against Loss or Theft Page 2
If your smartphone is lost or stolen, a third party gains physical access to it. If the finder is a dishonest one, he or she now has all the time in the world to access the information stored on it. It is not only the information stored on the phone itself which is valuable, however, but also any login information for corporate networks or communications services. If VPN and mail server passwords are stored on your phone, a thief need only touch the appropriate app to gain access. Protective software like Kaspersky Endpoint Security 8 for Smartphones contains special anti-theft functions to prevent third parties from accessing information if a phone is lost. Missing smartphones can even be blocked remotely using special management software, while devices with built-in GPS receivers like most business smartphones nowadays can be located. Businesses can also take more drastic measures and use a wipe command to restore lost devices to their factory settings. Although the financial burden of replacing the lost devices remains, this is not an insurmountable expense for most companies. Meanwhile, erasing the data stored on the phones prevents sensitive corporate information from falling into the wrong hands. A professional thief will take measures to avoid being detected as soon as possible. One of his or her first actions, therefore, will be to remove the phone s SIM card. Here, too, however, Kaspersky Endpoint Security provides an appropriate solution. The SIM Watch function enables management software to retain control of the device, even if the SIM card is replaced. It even enables the new mobile number to be automatically texted to the phone s rightful owner. But what if the smartphone can t be locked down in time? In such cases, an old-fashioned method can help, one which has proved effective in protecting data on laptops for years: encryption. Kaspersky Endpoint Security uncrackably encrypts files, folders and storage media, and permits access to this data only to users with the correct password. Protection Against Attacks The mobile malware problem is one which is often dismissed. When it comes to sheer numbers, it cannot hold a candle to the current Windows situation. While malware for a variety of platforms exists including, for example, trojans which send texts to premium services in order to run up huge bills for phone owners there have been no major virus outbreaks to date. It is, however, important to exercise caution, as the increasing popularity of smartphones and tablets is making them objects of interest for malware Page 3
authors. It is also worth bearing in mind that not all virus attacks are intended to cause media sensations. Over the years, security experts have noticed an increasing professionalisation of the malware scene. Quality is more important than quantity and, if someone is interested in the data on your field sales team s smartphones, a targeted attack is a real risk. This is, however, something you can prevent using mobile virus protection. Your chosen virus scanner should protect mobile devices in real time, as well as performing scheduled malware scans. It is also important that your mobile protection solution contains an anti-spam module which filters text messages and calls as well as emails. Additional Security Measures Although blocking functions and encryption will, of course, help conceal information from curious colleagues if you leave your smartphone briefly unattended on your desk, sophisticated protective software also has other tricks up its sleeve. These additional features can also be useful when it comes to protecting your privacy. You can, for instance, choose to conceal individual contacts and call lists, as well as text messages, from prying eyes. When choosing appropriate protective software for smartphones, companies should take the following three points into account: Management Functions: One smartphone is easy to configure manually. If you have five, it becomes inconvenient; any more than ten and it is no longer economical to do without a centralised management interface which allows anytime maintenance access to mobile devices. Using a management interface which enables administrative tasks to be performed remotely is the only way for your IT department to retain full control of the devices at all times. It also allows updates and new programmes to be distributed easily and in a targeted manner. Rules: Who is allowed to do what on the network? Policies have now become indispensable for companies and not just for compliance reasons. They are also an essential element in ensuring seamless, secure smartphone integration. Kaspersky Endpoint Security therefore allows rules to be assigned to different user groups, using both traditional and over-the-air methods. This allows administrators to conveniently Page 4
customise the antivirus settings. They can, for example, define which smartphone file types should be scanned for malware and which should not. Support for all Platforms Used: When it comes to smartphone security, don t compromise. The protective software you choose must support all the mobile platforms your company uses. [1]www.kaspersky.com/images/kaspersky_global_it_security_risks_survey-10-100468.pdf Other useful links: http://newsroom.kaspersky.eu/ www.securelist.com/en/analysis www.kaspersky.com Page 5