Datensicherheit – Mobility Advantage: Why Secure Your Mobile Devices?

white paper Mobility Advantage: Why Secure Your Mobile Devices? www.sybase.com table of contents Mobile Insecurity — The Elephant in the Room 1 Understanding Mobility Risks and Remedies 1 Risks related to lost and stolen devices 2 Unauthorized data access 3 Risks related to personal and business use on the same device 3 Gaps in device management and policy enforcement 4 Life-Cycle Approach to a Mobile Security Strategy 5 Mobile Security as a Way of Life 7 Notes Mobile insecurity — the elephant in the rooM Industry experts say that by 2013 there will be 1.2 billion mobile workers worldwide.1 They also report that by 2013, 75 percent of all U.S. workers will be mobile2, meaning those workers will use a mobile device for at least 20 percent of their work. Another survey reveals that 36 percent of cell phone owners have either lost a phone or had one stolen.3 These facts suggest that in the near future, nearly 25 percent of all workers will have lost a mobile device that could provide access to confidential information. It’s no wonder that mobile device security is a top concern for businesses today. And yet for all that worry, few organizations devote adequate attention to mobile security. Surveys show that although mobile security is top of mind and many companies experience frequent data breaches, companies implementing a strong mobile security strategy are in the minority. 4 Why haven’t organizations been more aggressive about securing their mobile devices? There are a number of reasons: • The speed with which new generations of mobile devices have come into the workplace has caught many businesses unprepared; • Work groups and employees are driving today’s business mobility, not corporate IT policy makers. This has resulted in a piecemeal approach to mobile security; • Today’s mobility is complicated by workers using their own devices for both work and personal purposes; • Security is further complicated by the increasing diversity of mobile devices in the work place; • Easy access and a proliferation of mobile applications makes security management appear to be a daunting task. Many companies have not implemented a comprehensive mobile security strategy because they believe it will be too costly and cumbersome. Meantime, mobility continues to become a larger part of daily business operations. And the costs related to security breaches are high. In 2009 the average per-incident cost of a data breach was $6.75 million.5 Most companies have security policies. The challenge they face is a two-part problem: 1. Adapting security policies to a mobile work environment; 2. Deciding what kind of technology they need to manage devices and enforce policies. The first step in building a mobile security strategy is understanding the nature of the threat. understanding Mobility risks and reMedies Indirect costs associated with security breaches are often far greater than the direct costs of mitigating damages. Beyond costs of data remediation and possible fines for compliance rule violations, security breaches can cost companies their competitive advantage. They can embarrass companies or key people in those companies, creating bad publicity and legal problems. They can cause a loss of customer and partner confidence. Ultimately security breaches can damage a company’s brand and its ability to do business. As mobility becomes a more important part of routine operations, companies who are developing a mobility strategy must address the issue of mobile security. To do that, it’s important to understand the vulnerabilities. Broadly speaking, there are four areas of vulnerability in mobile business operations: • Lost or stolen devices • Unauthorized data access • Risks arising from combining personal and work use in one device • Gaps in device management and policy enforcement Let’s look at each of these. Risks related to lost and stolen devices Mobile devices are easy to lose, and that is not going to change. Lost devices account for a significant amount of lost data. In spite of the amount of data lost through stolen devices and the ease with which these devices are lost, in many cases nothing is done to actually protect data on mobile devices. The same study that found more than one third of cell phone owners in the U.S. had a lost or stolen phone also revealed another startling fact. Almost 90 percent of those people had no way to either remotely lock their devices or remotely wipe data from them. Additionally, more than half of smartphone users did not use any password protection on their phones.6 1 These facts suggest four capabilities that should be at the heart of any mobile security strategy: • User authentication at the device level — This requires mobile workers to have password logins in order to access company applications and data. • Remote lock and wipe — This enables companies to remotely disable mobile devices so no one can use them, and to remotely wipe data from devices. • Data encryption — In case the loss of a device is not immediately discovered, any business data it contains should be encrypted. • Data control — If a user does not log into the network within a certain amount of time, the device will delete its own data or block access to corporate email. Unauthorized data access This threat involves apparent authorized use of mobile devices to gain unauthorized access to data. This is not strictly a mobility issue. These same threats come from any client computing system in an organization. Mobility management tools offer ways to extend standard security polices to the mobile environment. There are three principle ways mobile devices can act as portals for unauthorized access to proprietary information: • An unauthorized user accesses data with a lost or stolen phone — User authentication, remote lock and wipe, data encryption, and data control protect against this threat. • Authorized users gain unauthorized access to, or make inappropriate use of, proprietary information — This is a threat common to any client system in the organization. The added risk in a business mobility environment comes from some of the very benefits mobility provides: any time any place access, and convenience. AMAzing FActs • Approximately 1.3 million mobile phones are stolen each year, just in the UK7 • Major US corporations lose by theft 1,985 USB memory sticks, 1,075 smartphones, and 640 laptops, every week8 • 120,000 cell phones are left in Chicago taxi cabs each year9 • In the US, 113 cell phones are lost every minute10 Security best practices, including group policies and access restriction policies, will help regulate access to proprietary information in a business mobility environment. However a mobile security strategy can provide some additional controls, including: • Mobile application provisioning — Organizations control who can run enterprise applications. This provides a layer of “hard” control over access to proprietary information. • Remote configuration updates — The ability to remotely adjust device settings and restrictions “over the air” ensures enforcement of established policies. • Event and activity monitoring and logging — Activity monitoring and logging can quickly identify security issues and automatically control access to corporate data. 2 Risks related to personal and business use on the same device There are significant advantages to businesses that allow their workers to use one mobile device for both work and personal purposes. Workers who can work with their preferred devices are more likely to use mobile business applications simply because it is easier for them to do so. Also, allowing employees to work with their own devices significantly reduces the company’s hardware refresh costs. However there are risks as well. Companies are rightfully concerned about any liability they may have if workers use their phones inappropriately. Also, what happens to all that data if an employee leaves the company or sells their old phone on eBay? A mobile security strategy that includes policies and device management tools can provide controls to address these issues. • segregating business functions on the mobile device — Mobile security management tools enable companies to designate which applications and data on the devices are business related and therefore under their control. • Remote data wipe — This enables organizations to enforce device decommissioning policies. For instance, if an employee leaves the company, their device can be selectively wiped of only business applications and data. This would happen without affecting “personal use” functionality.