Adapting Your Mobile IT Security Strategy to Enable Mobile Workers
Providing employees with mobile access to corporate resources and applications can deliver a wealth of benefits, including improved productivity, satisfaction and innovation. However, it also introduces security and compliance challenges, from data loss to network breaches and malware attacks.
The way people work has fundamentally changed and mobile devices are at the forefront of this shift. An IDC study predicted that by now, more than one third of the world’s total workforce would consist of mobile workers. Meanwhile, Gartner Predicts by 2017, Half of Employers will Require Employees to Supply Their Own Device for Work Purposes. The phenomenal growth of mobile computing stems from its convenience and benefits. Mobile users have become accustomed to having the internet and their email and calendaring applications at their fingertips in their personal lives, and they are now expecting a similar experience when accessing business-critical applications, along with the ability to choose their corporate device or use their own. Organizations are finding that providing these capabilities increases employee productivity and spurs innovation.
Of course, there are challenges and risks to providing mobile access. The top five mobile threats are data loss from lost, stolen or decommissioned devices, information-stealing mobile malware, data loss and data leakage through poorly written third-party applications, vulnerabilities within devices, OS, design and third-party applications, and insecure Wi-Fi network or rogue access points. Mobile devices are often lost or stolen, which makes the data on them, as well as the corporate network, vulnerable to unauthorized access. In addition, a mobile device can become a conduit for malware from rogue apps, and unless data is encrypted in flight, it’s susceptible to interception, especially when users are on public Wi-Fi networks.
Compliance and legal aspects are another obstacle. In particular, it isn’t always clear who owns the data on mobile devices; some organizations insist that company data on employee owned phones and tablets belongs to the company and that it should be backed up and archived for legal and compliance purposes. In addition, unless a device has been locked down, there’s also a chance that an employee will move corporate data into the cloud or that it will be lifted directly from the device by an advertising network or a cybercriminal. Accordingly, an interesting dynamic is emerging between the teams responsible for IT and those tasked with security and compliance. IT leadership has strong motivation to implement a mobile access policy to gain productivity and user satisfaction benefits, while the individuals responsible for information security and compliance or IT support may try to stall or block the adoption of a mobile computing model.
Clearly, implementing a mobile program promises significant benefits but also introduces important risks. Therefore, in order for a strategy to emerge, all stakeholders must agree on the organization’s mobile computing needs, what can be supported in the short and medium term, and the ultimate vision.
To help your organization establish to what extent to embrace mobility, consider the secure mobility risk and compliance model (see figure below), which shows the risk, level of compliance and level of access associated with different mobile strategies.
As the model shows, company-issued devices offer the lowest security risk and the highest level of compliance. However, issuing devices to each user can be costly, and limiting mobile users to only a single device (that is not of their choosing) can significantly reduce the potential productivity benefits of the mobile strategy. At the other end of the spectrum, embracing full “bring your own device” (BYOD) may delight the mobile user community, but it entails some significant IT support, security and compliance challenges. Many organizations choose a mobile strategy between these two extremes, such as “company-owned, personally enabled” (COPE) or “choose your own device” (CYOD).
Whatever mobile strategy you choose, it is important to add context to access requests made by an authenticated user. For example, users who are accessing from a company-issued device should expect virtually the same experience as they would have in the office. However, users accessing company data and applications from a personal tablet or smartphone might be denied access to business-critical systems that contain sensitive data (such as HR, order processing or CRM) and allowed access to only email and calendar data.
Ensure that your IT security strategy is adapted to your mobility requirements read the tech brief “The AAA approach to network security”.
