Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

6/27/2014
12:00 PM
Vijay Basani
Vijay Basani
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Mobile Security Tips For SMBs

Everyone in an organization has to work together to combat intrusions and data loss, but this is especially true for small businesses.

Mobile technologies have introduced a completely new world of risks to organizations that use them. While many larger enterprises have the resources to mount comprehensive campaigns, the era of mobile computing has placed smaller companies smack in the middle of a widespread and proliferating security crisis.

Here are three steps to help SMBs develop smarter mobile security policies in this ever-changing landscape.

First step: policy
Map out a security and mobile device policy that clearly separates personal and corporate data commingled on devices. Employees need to know specifically what they can and can't do on their mobile phones. You should write a user-focused rules of behavior document that every employee must understand and sign before they are granted access to your network.

Second step: education, access controls, and audits
It’s important to educate users on both the risks the devices present to the organization and your expectations of conduct. But strong, clearly stated company policy should also be consistently enforced through access permissions, published audit reports, and other sanctions. Frequent reminders that are integrated into general company-wide communications can make it clear what is expected and create a culture of good stewardship of digital devices and network resources.

Users should also be taught about the  many basic precautions they can take to mitigate risks associated with lost or stolen devices -- and how to keep both personal and corporate resources significantly safer. These steps include:

  • Setting lock screens with strong passwords of 8- to 10-character minimum length
  • Installing anti-virus/anti-malware apps
  • Implementing data encryption
  • Securely backing up all data
  • Installing device locator and remote wiping capabilities
  • Keeping operating systems and apps updated

Third step: ongoing monitoring
Continuous monitoring and measurement will be essential to address known and emerging threats. This effort requires focus, discipline, leadership, and innovation involving:

  • People -- trained, skilled information workers
  • Culture -- a true concern for protecting employee data
  • Leadership -- for the big picture, and priority setting
  • Process -- You can't improve what you don't measure. What are you doing with the technology once you buy it?
  • Technology -- Is it implemented properly? Are you monitoring it? Is it integrated across your entire enterprise?

Strategies to monitor and assess devices and their data should include identification of all mobile devices accessing your network of IT assets, real-time monitoring and correlation of all activity, and both alerting and reporting on violations of security policy, user privacy, and compliance.

For companies of any size -- but especially SMBs --  the most essential and urgent task at hand is to build a culture of good stewardship of devices and data through a robust and detailed company policy and consistent enforcement at all levels, from entry-level employees to CEOs. Everyone in a company has to work together to combat intrusions and data loss.

Vijay Basani is CEO and President of EiQ Networks. He is a serial entrepreneur with a track record of building successful businesses delivering enterprise-class solutions. Before starting EiQ Networks, he founded AppIQ, an application storage resource management provider ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/30/2014 | 3:50:18 PM
Re: Policy
I think many enterprises put more faith in procedural documentation. ie, What should be done, who should perform the tasks, how they should be performed. I think its because these components are quantifiable to some extent and can show great value. And most importantly represent actionable items. However, I think it is important to map out WHY as well. Which is what policies provide. 

As you stated policy establishes the base. For example, we are performing these procedures because our policy dictates that standard accounts should not contain admin privileges. Our policy is such because it helps to protect our environment from watering hole events. There are many reasons as to why policy should be established and I am perplexed as to any who would be opposed to having one.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/30/2014 | 10:11:19 AM
Re: Policy
Ryan, it seems to me that policy is a bottom line basic for an enterprise, large or small. Why do you think organizations drag their feet about establishing them? 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/27/2014 | 10:24:49 PM
Re: Policy
Good SANS reference. I recently took the SANS GSEC and many of the questions stemmed around corporate policy and how it very muchs integrates with security intiative. Very interesting on how laying a policy out logically can extend and enhance the technical aspect of what you are trying to accomplish.
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/27/2014 | 10:13:49 PM
Re: Policy
Good point. I agree that policy is a key issue. It can be complicated, but there a lot of good templates and best practices out there that can give people a headstart: http://www.sans.org/reading-room/whitepapers/leadership/managing-implementation-byod-policy-34217

BP
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/27/2014 | 6:18:53 PM
Policy
Great article. A well defined policy can put your organization to advance initiatives such as mobile device management and EMM. I have many conversations with Gartner about Mobile Devices and they always implore the establishment of policy. Policy can set the baseline to refer to during deployment and can be very effective if future events leave configuration ambiguous. Without proper documentation there isn't anything to compare a healthy config against. 
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34390
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow on the size parameter of the tz_map_shared_mem function.
CVE-2021-34391
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel�s tz_handle_trusted_app_smc function where a lack of integer overflow checks on the req_off and param_ofs variables leads to memory corruption of critical kernel structures.
CVE-2021-34392
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks, which might lead to denial of service.
CVE-2021-34393
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability might allow an attacker to exploit the deserializer to impact code execution, causing information disclosure.
CVE-2021-34394
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in all TAs whose deserializer does not reject messages with multiple occurrences of the same parameter. The deserialization of untrusted data might allow an attacker to exploit the deserializer to impact code execution.