Top tips for improving mobile security

Tags:
Risks,
Balance,
Mobile Phones,
Owned

Cath Everett ZDNet.co.uk

Published: 30 Oct 2007 17:43 GMT

...it could also be worth considering two-factor authentication, which includes digital certificates and biometrics, remote monitoring and data-wiping offerings.

5. Don't be shy about using the built-in security features of mobile devices themselves
One idea is to encourage users to lock up their devices when they're not using them. If you can, get them to create a password to lock up the SIM card on their mobile phones, for example, or to turn off services such as Bluetooth and Wi-Fi if they don't need them just at that moment. Also ensure that software, such as antivirus programs, is kept up-to-date and, if such software doesn't come as part of the package, then add it yourself.

6. To do this successfully, however, will entail standardising on one or more company-owned devices, rather than allowing an explosion of uncontrolled consumer gadgets to occur
More than a third of respondents in Rhetorik's survey said that they had banned the use of consumer devices, but a huge 51 percent said they routinely employ a mix of personal and company-owned gadgets, while about eight percent use only their own handhelds.

While the use of consumer devices may appear to be a cheap way of doing things on the surface, it does generate problems — and hidden costs aplenty.

Firstly, it makes it more likely that IT managers will be unaware of exactly what technology is in use in their organisations, making it more difficult to take appropriate action.

Secondly, failing to standardise means that you can end up with a wide range of devices knocking about that are difficult and time-consuming to configure, secure, support and manage because they don't belong to the company but to individuals, which makes them more difficult to control centrally.

Thirdly, because gadgets are getting smaller and more sophisticated, it's increasingly difficult to know who is carrying what around in their pockets. The problem here is that, because these devices are essentially fancy storage devices, disgruntled individuals can use them to steal information. They can also act as a reservoir for viruses and worms and, therefore, pose the risk that they may infect the corporate network if they're left to run unchecked.

The aim is to find a balance: you're happy that you've done what you can and they're happy because they don't need a 10-page manual just to try and start up their handheld

Finally, consumer devices, unlike their enterprise cousins, rarely have much security functionality built in, beyond notoriously insecure password protection which most users decline to activate anyway, because this would add to their price tag. This means that, if they are lost or stolen, sensitive corporate data, including emails, may all too easily become prey to prying eyes.

7. Always be careful to balance security issues against usability considerations
This one's tricky. While, by instinct, IT managers would prefer to lock down everything that moves to save it from harm, in practice, the reason that users are so keen on mobile technology in the first place is that it's convenient, flexible and helps them to do their jobs better — important considerations that shouldn't be overlooked, not least because, if you don't get it right, they're likely to simply ignore you or introduce workarounds.

So your best bet is to talk to people, find out what their requirements are and weigh them up against the risks. The aim is to find a balance so that everyone gets the best of both worlds: you're happy that you've done what you can and they're happy because they don't need a 10-page manual just to try and start up their handheld.

8. And last, but by no means least, don't forget the dangers of wireless networks
The problem with wireless networks, whether they're inside or outside the enterprise, is that they're inherently insecure. While the situation is somewhat better than it used to be, even in-house you have to be meticulous about adding extra security protection or even limiting usage to segregated visitor areas.

Outside in the big wide world, however, where mobile workers may well be using hideously insecure hotspots in cafes or airports, much danger awaits. And, in this scenario, it is simply imperative that devices are protected by everything that can be mustered, from firewalls and antivirus software to intrusion-detection systems. SSL VPNs are just as imperative in their own way for securing remote communications, and network access should strictly be prohibited without one.

Are there are any other tips you can think of in terms of how to go about securing mobile devices effectively? If so, post a comment at the bottom of the page and let us know.