|
Shaping mobile security Keith Bird shows how a new approach to mobile security can help organizations achieve the right balance of protection, mobility and productivity. Most of us are familiar with the ‘triangle’ project management model, which highlights the constraints on delivering results in projects. The three corners of the triangle are fast, good and cheap, showing that in any given project, all three attributes cannot be optimised: one will inevitably be compromised to maximise the other two. You can have a good project delivered quickly, but not cheaply, and so on. And while 56 percent said they have to try and manage business data such as email, contact information, corporate calendars and customer data on employees’ own devices, 44 percent of respondents don’t currently attempt to manage business data on personal devices at all. It’s this last point that is significant: nearly half of organizations don’t manage or secure employees’ own devices. So it’s no wonder that for most companies, their approach to mobile security is so skewed out of shape. Why have security strategies to protect data and assets on mobile devices fallen behind? Part of the reason is because IT teams don't have endless time and resources to invest in securing mobility. They have to prioritise: and the influx of employee devices is racing ahead of the resources available to manage them. So how should organizations approach protecting their sensitive data against the risks of loss or theft from both corporate and personal devices? One of the key issues is that mobile security is not a single problem, but a mix of challenges from securing remote access, to securing data on devices, to securing documents that need to be shared. There’s also the challenge of making users aware of the organizations' data security policies and of the possible consequences from data losses, through education. Various disparate solutions attempt to address mobility and security, but none provides a complete solution. Enterprise mobile management (EMM) solutions manage device configurations, but do not secure business data and documents in uncontrolled environments. Similarly, mobile solutions that are focused on a specific sub-segment of security are not integrated with the organization’s corporate security policy or infrastructure. None offers a simple, integrated approach that secures mobile devices from threats, and secures data and documents on devices in line with corporate policies: making it easy to apply security, while still empowering staff with simple, secure mobile working. Three cornerstones of security, mobility and productivity What’s needed to enable this is an integrated approach that addresses the three main mobility problems. These are:
The first problem occurs when a device becomes infected by malware when used outside the corporate perimeter. This makes the data stored on the device vulnerable, and when the infected device is used again, the threat can spread to the corporate network. An effective solution to this issue is to deliver security to devices as a cloud-based service, using an encrypted VPN tunnel. This prevents suspicious file downloads, blocks malicious websites, and stops bots before they can cause damage; protecting users, networks and business data from threats inside and outside the company network. It also enables corporate security policies to be extended to all devices, for easier management. The second issue is enabling secure use of personal devices while protecting and managing business data on those devices. The solution in this case is to create a secure business environment on the device which segregates business and personal information and applications, while protecting both. This lets users access corporate email, documents, and assets from within a secure, encrypted application workspace on the device that is separated from personal data. The third mobile security problem is protecting business documents everywhere they go, both inside and outside the network. Here, the ideal solution is to secure the document itself, to ensure only authorised users can open and read frequently-used document types such as Word, Excel, PowerPoint and Acrobat. Security should be established when the document is first created, and travel with it, so that corporate security guidelines are always enforced, with full logging and auditing of who accessed the document. Taking a device-agnostic approach to security, and focusing more on managing and protecting the use of business data greatly simplifies mobility challenges. Locking down devices too tightly can interfere with employees’ application user experience and their privacy, which in turn can lead to them trying to work around the organization’s policies. Also, the type of device being used to access and process the information does not matter as long as the data and session are secured, and the person using the data has the appropriate rights to do so. With this approach, organizations can ensure their security project triangles have the right balance and shape: they can enable true enterprise mobility and productivity anywhere, without compromising security. The author •Date: 16th December 2014 • World •Type: Article • Topic: ISM
|
To submit news stories to Continuity Central, e-mail the editor. Want an RSS newsfeed for your website? Click here |
||||||||
WELCOME TO THE CONTINUITY CENTRAL ARCHIVE SITE Please note that this is a page from a previous version of Continuity Central and is no longer being updated. To see the latest business continuity news, jobs and information click here.
|
