Diane Conde, Senior Manager – Enterprise Mobility Managed Service practice at the software firm Tangoe, discusses end-point security in connected world.
Late last year, at the Symantec’s Crystal Ball event which discussed the next decade of information security, Ian Levy, technical director at the UK’s National Security Centre, warned that “sometime in the next few years we’re going to have our first category one cyber-incident.”
A category one incident requires a national government response. Most organisations, and those that lead data-security efforts for them, understand this, yet continue to do little to nothing to prepare for such an incident. This is despite constant reminders in the local and national news of incidents (1,131 attacks reported, 590 classed as significant and more than 30 assessed serious enough to require a cross-government response), and warnings from top government security officials of the need to elevate cybersecurity to the same level of priority as fighting terrorism.
Employees are increasingly communicating, and integrating, with organisations beyond traditional means, with more crossover between their professional and personal worlds. Use of mobile devices, laptops and wearables is still increasing, as well as more connectivity with the Internet of Things. As this popularity continues to rise, so too do the opportunities for cyberattack. Most organisations are slow to respond to this growth with appropriate end-point security measures, which leaves their data, and therefore their business, at risk.
The advantage of these new device types is their closer integration within consumer routines and employee work-habits. Organisations can realise increased sales, great productivity gains, along with improved employee satisfaction. What most companies overlook, however, is the increase in security gaps that comes along with this. End-users subconsciously feel a closer connection with these devices, thus providing them with a higher comfort level compared to PCs and other traditional devices. This leads to a higher level of trust when, in fact, it should be the opposite.
How companies can address their challenges
Policies must adapt as end-point technology, as well as context (location, time, user, etc), continue to evolve. However, don’t expect to tackle everything all at once. Focus should be on the items that you can change without additional IT investment (or at least a large investment). Ian Levy’s advice is for organisations to stop putting so much faith into “off-the-shelf” security solutions, and instead focus on what is possible, and what can be uncovered, using your people. This makes sense if you think about where the key risks are (daily end-user interaction) and who these security solutions are built for (IT). Focus should be on helping your end-users become better stewards of enterprise data, instead of trying to police their every move. Mapped out below are steps any organisation can implement to help identify key security gaps as well as protect enterprise data.
Assess infrastructure
Looking at access points through the lens of traditional IT doesn’t work anymore. A new viewpoint is required to capture all access points across, not only today’s technology, but the technology to come tomorrow. IoT, wearables, mobile devices and the like don’t tie back into the network the same way as PCs, so why manage them the same way? Everything from secured WiFi with WPA2 and RADIUS authentication to guest WiFi and even VPNs should be considered. Understanding those points of entry into a network and what they subsequently provide access to is critical to shaping end-point security. Deploy company mail and documents (as well as document repository access) exclusively through an Enterprise Mobility Management (EMM) solution
Apple through DEP, and Android through Zero – Touch, also allows for supervision and more restrictions on corporate devices, allowing for better mitigation of compromised and non-compliant devices. Essentially, the logic is “if you aren’t enrolled and in good standing, you’re not getting to the data you want.”
Management of Internal/enterprise apps from version to version, allowing for testing and validation of new versions prior to deployment, prevents buggy or possibly compromised apps from getting pushed to enrolled devices and interrupt the end user experience. Mobile OS updates can also be managed to some extent through an EMM, with the approach being the same as pushing out new versions of internal apps: test and validate, then deploy when everything passes security and stability standards.
Keep inventory
An EMM can provide visibility into all the enrolled devices accessing the system; tying that into systems like Exchange ActiveSync and Cisco ISE can also provide a greater scope of what devices are accessing which systems and where, as well as who is connecting to what. In an optimal scenario, all mobile device traffic – regardless of ownership stance or level of access required – should be passed through a combined EMM/ActiveSync/ISE system. This is by no means an all-encompassing list of enterprise data-security requirements, and there is no guarantee that even after full implementation of all of the above, your organisation will be safe from threats. However, these procedures will at least put you on the right path towards a stronger security policy that can prevent your organisation from making the National Security Centre’s next list of incidents, or quite possibly the national news.
Katja Ruud, Research Director at Gartner said at an event recently, that by 2020, End-point strategists still focused on traditional devices and focusing only on IT-facing improvements will be replaced. Make sure you’re not one of them by re-evaluating your security protocols to include all access-points.
About the author
As Senior Manager of the Enterprise Mobility Managed Service practice at Tangoe, Diane Conde brings over 15 years’ experience in managed services and mobility. Diane and her team of engineers work with clients to leverage their EMM platforms, secure their mobile environments, and increase their employee’s mobile productivity.
