Fashionable But Vulnerable: Mobile Devices in the Workplace

Tuesday, June 12, 2012

Simon Heron

A88973e7d0943d295c99820ab9aeed27

Many organisations are replacing desktop PCs with laptop computers and rolling out tablet computers and smart phones to teams working outside of the office.

These mobile devices are contributing to improved efficiency and are undoubtedly popular with employees, but they are also inherently vulnerable. To minimise the risks, organisations must develop specific mobile device management policies – and then enforce them.

The figures make interesting reading. In 2012, Gartner predicts that PC sales will reach about 400 million units worldwide. This sounds a lot, but Gartner also forecasts that over 600 million smart phones and 100 million tablets will be sold in the same period, indicating that mobile devices are now significantly outpacing traditional PCs in popularity.

An increasing number of these mobile devices is likely to be employed in corporate environments. Organisations, large and small, are now using tablets and other portable computing equipment to realise significant improvements efficiency. Indeed, in a survey of 6,275 global organisations, conducted by Symantec (2012), 70% of respondents said they expected smart phones and tablets to increase employee productivity.

Whatever their potential value, mobile devices nevertheless pose an enormous security risk. They are, after all, easy to accidentally misplace and highly lucrative prizes for opportunistic thieves. If lost or stolen, smart phones and tablets could be used to gain unauthorised access to corporate systems, steal data and maliciously infect core business applications.

Given the risks, it is absolutely essential for organisations today to have a comprehensive mobile device management policy in place. This policy must cover security policy, application control, configuration control and a host of other precautions.

Ten important points to address in a company policy include:

  1. Password protection across all mobile devices, enforced for all users
  2. Encryption of all data on local memory and removable memory
  3. Methods of installing, disabling, removing and controlling permitted applications
  4. The use or prevented use of public WiFi networks and Bluetooth in some locations
  5. Provision and maintenance of anti-malware software
  6. Regular data back-ups
  7. GPS and tracking mechanisms to detect the location of devices
  8. Secure methods of connecting to the corporate network to exchange data (such as a virtual private network)
  9. Effective management of assets: who has mobile devices, where, when and why
  10. Access to IT support and maintenance for remote workers

Once a company policy has been developed, it is of course essential to enforce it. Employees must be educated on the importance and relevance of the policy and measures should be put in place to monitor their adherence.

Cross-posted from Redscan

Possibly Related Articles:
10491
Enterprise Security
Enterprise Security Access Control Data Loss Prevention Mobile Devices Employees Policies and Procedures Enterprise Risk Management BYOD
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.

Most Liked