Smartphones have done wonderful things for employee mobility, but they have also complicated the security picture at organizations large and small. Where most companies used to limit smartphone use to one platform, such as Research In Motion’s Blackberry, most now cope with multiple smartphone models, platforms, and operating systems, each with its own quirks and vulnerabilities. Add the growing number of employees expecting to use the same device at home and work and things get even dicier.
However, there are steps you can take to secure smartphone use. As usual, they involve education, policy, and technology.
If you allow multiple smartphone platforms, such as iOS, Android, and Windows 7, it’s important to educate users on the security challenges these devices bring to the organization and the proper measures users must take to address them. Users should be educated about the dangers of device theft, data theft, data leakage, and malware and the financial impact they can have on the business. Include some actual use cases and anecdotes that demonstrate just how damaging smartphone breaches can be, and keep users aware of publicized, damaging breaches as they come up. Education should be repeated at least once a year and new employees should be educated immediately to the dangers as well as the company policies related to mobile devices.
Policy is the second obvious defense. Most policies should at least require users to:
- Keep smartphones within their sight at all times
- Activate phone locking after a period of inactivity and use strong passwords or PINs for reactivation
- Back up smartphone applications and content regularly
- Report smart phone theft immediately so remote locking or remote wiping can be activated
- Avoid using smartphones over insecure Wifi networks
- Connect from smartphone to the corporate network over secure VPN’s
- Encrypt all corporate information stored on the phone using provided tools
- Keep Bluetooth out of discovery mode when not in use
- Avoid clicking on links in SMS messages
- Make it clear that no jailbroken phones will be allowed in the organization.
When it comes to malware, things get a bit more complicated. Some smartphone platforms have malware protection software available and some don’t. Even for those that do, the applications are relatively new.
One way to reduce the threat of malware is to educate users on what to look for when downloading new applications. For example, Android displays all the permissions a new application is seeking on the device. Users should be taught to look out for applications that seek access to things like contacts or location unnecessarily and to carefully read user application ratings before downloading. Some companies might want to provide their own online store of pre-approved applications. Users should submit any other applications to the store minders to ensure their safety.
(Source:McAfee)
