Basics

Protecting the Mobile Workforce

Seven ways to safeguard your company's roaming data from thieves, hackers, viruses and just plain stupidity

By Stacy Collett

April 08, 2008 — CSO —

Where did I leave my #&%! Palm Pilot?

A salesperson for an international conglomerate with more than 50,000 employees probably uttered a similar phrase while rifling through pockets and suitcases looking for his PDA while traveling on business.

After a lengthy search, he believed the mobile device was simply lost. But later he would learn that it was actually stolen. The salesperson had been targeted by a competitor. The thief wanted access to his contact list of fellow sales reps at the company. Weeks later, 80 percent of the sales force also disappeared, lured away by more lucrative pay packages.

True story. Think it can't happen to you?

Today's highly mobile workforce, coupled with an explosion of new mobile gadgets that give users access to the Internet from anywhere, has created nightmares for security managers, who are losing control of what devices employees use at work.

As mobile devices are becoming physically smaller and logically larger, employees can easily take large amounts of valuable corporate information with them anywhere. Today's multiuse cell phones, for instance, can hold up to 2GB of data on a removable miniSD (secure digital) card. BlackBerrys, iPhones and laptops are equally mobile, loaded with company data and susceptible to loss or theft.

"The edge of the corporate network is that [mobile] device, and the security controls in the device are a disaster," says Matthew E. Luallen, president of Sph3r3, a security consulting firm in Chicago. "Security, by far, is not keeping up."

Among the culprits: Default settings on mobile devices are too easy to use and infiltrate; most mobile file systems aren't siloed, so when one area is affected, the whole device goes down. Patches are hard to administer and enforce on myriad devices.

There are two types of mobile threats that security professionals must considerâ¬protecting data that's on the device and preventing malicious Web access to corporate networks through the mobile device.

With smaller devices, "you don't necessarily even have the processing power or the resources available to protect the data," Luallen adds. Cell phones, for instance, lack the processing power to accommodate fast, effective encryption tools. Some cell phone encryption software can take up to 10 minutes to decrypt data. "That typically conflicts with what we're trying to provide for a mobile workforce," which is ease of use and performance, he says.

What's more, wireless capabilities are being integrated into every piece of technology. The new SD card from Eye-Fi, for starters, embeds wireless capabilities in the memory card. It promises to effortlessly upload pictures from digital cameras to a PC.

• Email
• Print
• Comments
• Digg This
• SlashDot

• MOBILE SECURITY QUICK TIPS
• How to Keep Portable Data From Escaping
• Wireless Security: The Basics