Securing mobile data

If you don't believe that mobile devices pose a serious data security risk, consider this statistic. According to consulting firm Acenture, 85,000 mobile phones had been left behind in Chicago taxi cabs as of 2004. And three years have gone by since then, three years in which data capable phones have become more and more prevalent."It means you have a pretty big issue," says Vaibhav Parmar, a senior manager in Accenture's technology consulting practice. "If you've got BlackBerries being left behind in taxi cabs, that in itself poses a challenge. But if the owner hasn't implemented built-in password protection, that is then an open device that could give somebody access to a lot of stuff." Users mislaying a handheld is one problem. Theft of mobiles has also become a growth industry. Juniper Research Ltd. estimated in a report published a year ago that, despite the best efforts of police and carriers, 4% of all handhelds would be stolen annually by 2011. That means hundreds of thousands of stolen cell phones, PDAs and smartphones every year. A report from security software firm Symantec earlier this year estimated that 54% of all data breaches that could - not did, but could - facilitate identity theft were the result of the loss or theft of computers or data storage devices. Criminals are "very aggressively going after this data," Symantec spokesperson Ollie Whitehouse told IT Week.Not that all cell phone thefts are committed by organized criminals, of course. And presumably not all those phones in Chicago were irretrievably lost. It's also likely that only a small percentage of them stored sensitive data, given that they were lost in 2004 or earlier. But this is cold comfort. As anyone in IT knows, it's an increasingly mobile world and mobile devices are increasingly data capable. By 2008, according to Accenture, 80 million people worldwide will be carrying data-centric 3G devices. And by 2009, 65% of US enterprises will have deployed data applications to mobile workers. Many companies are awake to the threats posed by widespread use of data-capable mobile devices, but a surprising number are still asleep at the switch. BPM Forum, a non-profit organization advocating better business performance management practices, last year published Compliance on the Fly, its report on a survey conducted around mobile data security. Just fewer than half the respondents ranked their companies on a scale of one to five as either "very mobile" or "mobile" based on the number of devices they had in the field. A similar percentage said their firm's use of mobile devices would increase in the future.Almost 30% said half or more of their mobile devices were running business-critical field and sales force applications and other systems that communicated over the air with the corporate network. Yet 40% of companies surveyed did not have formal programs in place for securing mobile data. In some cases, to be sure, this was because they didn't use mobile devices very much, but other reasons given included budget constraints, a lack of emphasis on compliance in their companies, other compliance issues taking priority and lack of senior management support.Wakey-wakey!What are the risks involved in storing company data on mobile devices and communicating it over the air? And how can you reduce those risks? To find out, we talked to analysts, consultants and vendors. The risks, all agree, fall into three broad categories. Mobile devices or storage units can be lost or stolen - and as we've already seen, frequently are. Hackers can intercept data transmitted over the air by mobile devices. Unauthorized users can log in to corporate networks through ports set up for remote access by mobile users.The business outcomes range from mildly irritating to catastrophic: Viruses or worms could attack mobile devices rendering them temporarily unusable, destroying data or causing them to automatically spread the virus to customers' networks - causing embarrassment and loss of credibility.Data stored on a device or on a flash memory card, including trade secrets and customer lists, could fall into the hands of rivals, damaging your company's ability to compete. Personal information about customers or patients, protected under privacy laws, could fall into the hands of criminals who use it to steal identities or make unauthorized purchases. This damages the company's credibility when the loss is disclosed, which in some jurisdictions it must be by law, and leaves you open to prosecution or litigation. Criminals, hackers or competitors could use an unsecured lost or stolen device, or data stored on it (usernames and passwords), to log in to a corporate network and steal or destroy data or mount a denial of service attack.The number one risk, according to everyone we talked to, is loss or theft of mobile devices, including laptops, PDAs, smartphones, flash memory cards - some phones now have flash memory cards that hold as much as 4GB of data - and USB thumb drives. The stats previously cited on lost and stolen cell phones give some idea of how great the risk. "Certainly there have been breaches of company networks where data was stolen, and some of those have been publicized," says Shari Freeman director of product management for Sybase iAnywhere's Afaria mobile device management solution. "But we hear more in the news about lost or stolen devices, probably because it is happening more frequently."On the other hand, says Fred Kost, director of security solutions marketing for Cisco Systems Inc., it's reasonable to assume that in future hackers will increasingly try to use mobile devices to break into enterprise networks. "I wouldn't say it's the top problem today," Kost says, "but when you're looking to compromise a network, you go for the lowest hanging fruit. As other types of end points become more secure and as more and more mobile devices become IP equipped, that will turn into a target-rich environment ."The risk of compromise to data in motion - data as it's transmitted over airwaves - is much lower. In unsecured or poorly secured Wi-Fi networks, it's possible for hackers to use sniffer technology to intercept transmissions and extract useable data. But in cellular networks and properly secured Wi-Fi networks, it's difficult or impossible for unauthorized users to connect to the network and data is encrypted anyway, making it useless to hackers. Wi-Fi hotspots are of necessity unsecured, however. "And you'd be surprised to find how many enterprises have deployed Wi-Fi networks for private use that are either wide open - they use no encryption - or the security protocols used can be compromised very quickly," Parmar says.So what do you need to do to secure mobile data? Technology is certainly part of the answer, but it's not all of it. "The first thing is that there has to be centralized governance and definition of policies around the use of mobile devices," Parmar says. In too many companies, each business unit has procured mobile devices on its own and established its own policies and procedures, which aren't always aligned.Once governance has been centralized and policies established, you can begin to define a set of solutions to help comply with those policies. There may be some back-and-forth between investigation of solutions and definition of policies, Parmar says. "To some extent, you have to know what the technology can do to tell what the policies should be. But you don't want the technology to dictate the policies." More and more big American firms, faced with new regulatory compliance imperatives, are appointing chief information security officers (CISOs), who are tasked with, among other things, developing such policies. There isn't much that's fundamentally new about the technology for protecting data at rest on mobile devices. It starts with strong password protection of the device itself. The operating system provides basic password functionality. Strong passwords are long and random enough to make them impossible to break or not worth a hacker's while to attempt. Case sensitive passwords that include alphabetic, numeric and special characters are more difficult to break. Most security analysts recommend changing passwords at least every 90 days.The trick, though, is to ensure that users actually implement passwords, which they may be disinclined to do. Several available solutions enforce the use of passwords. Products such as Sybase's Afaria and others from Trust Digital, mFormation Technologies Inc. and InnoPath Software provide this capability. In some cases, they send a message to a new device, or a device newly added to the network, instructing it to remind the user to set a password. If the user doesn't comply, the system can remotely disable the device until a password is set. Some of these systems can also monitor user behaviour for signs that a device might have been stolen or lost. At the simplest level, if the user makes two unsuccessful attempts to enter the correct password, software on the device disables it, or the network sends a message disabling it. The level of disablement can range from making it unusable until the owner is authenticated by some other means, to deleting sensitive data on it, to sending a "kill pill," instructing it to do a hard reset, wiping all data.Afaria can even monitor usage patterns and execute kill pill or data deletion procedures in response to other types of changes in behaviour. For example, a healthcare worker logs on every morning to download patient records for the day. If the network management system detects that the device hasn't been turned on in a few days, it can start deleting data as soon as it is turned on.There is clearly a real risk of false positives with such a mechanism. One can imagine users tearing their hair out when they turn on a device and find all the data deleted. "The important thing is to have accompanying that the ability to do backups," Freeman says. "You do not remove data that you don't have backed up. And if the user does find that, hey, now all my data is gone, it's an easy process to get it restored."Savvy thieves will soon learn to defeat such mechanisms by removing a phone's smart card before attempting to hack it, for example, or taking it out of the cellular coverage area, but they still provide another level of protection that in enterprises dealing with highly sensitive data may be worth the trouble and expense. Afaria client software begins at about $40 per device, server software to manage up to 250 clients, at about $5,000.BlackBerries come with many of the security features of products like Afaria built in, but Afaria and other comprehensive security and management solutions also support Windows Mobile and Symbian devices.To get around the problem of user non-compliance with password policies, some companies, are now moving to biometric or token authentication on laptops and desktops. The user must swipe a finger over a fingerprint reader or insert a USB token to log on to the device. The first smartphones are now beginning to appear with fingerprint readers built in. One OEM manufacturer of fingerprint readers for wireless devices, AuthenTec, claims its sensors have already been designed into more than three million phones, including models from Samsung and HTC. Companies that are really serious about security will opt for multi-factor authentication, a combination of password or PIN, plus biometrics or tokens. The second line of defense for data at rest on mobile devices is file-level encryption. It's essential where memory cards are used to store data since they can be popped out of a device and put in a reader. If a device is lost or stolen, even if password protection prevents the finder or thief from accessing data through the device's operating system, hackers could still conceivably extract data using hardware tools. And removable storage is clearly very vulnerable.The other key security technology for mobile devices is anti-virus and firewall software to protect them from the same kinds of threats that exist on the Internet for laptop and desktop computers. The major anti-virus brands have for several years offered small-memory-footprint versions of their products for handhelds. Symantec, for example, has versions of its full Security suite for both Windows Mobile and Symbian mobiles.Protecting data as it passes over the air requires a different set of technologies. Some of the same technologies used with laptops to protect data crossing the Internet to the corporate networks is also available for handhelds, including VPNs. Another option that may be available is point-to-point connections between a cellular provider's point of presence and the corporate network. So instead of traversing the public network after it leaves the cellular carrier's network, data travels over a private network link.According to Parmar, many carriers make the routing service available to large clients with many devices in the field for little or even no charge. The major cost incurred is for the point-to-point link, which the customer pays for and manages.No other protection is available or really necessary for data travelling over cellular networks. Wi-Fi networks - and many handhelds now have built-in Wi-Fi adapters - is another matter. Implementing VPNs and file-level encryption is the only protection available for users communicating over public Wi-Fi networks and hotspots. For Wi-Fi networks within the enterprise, the best solution is a combination of strong authentication and native Wi-Fi security measures including 802.11i and the third-generation encryption technology WPA2 (Wi-Fi Protected Access 2). The original Wi-Fi encryption technology, WEP (Wired Equivalent Protocol) can be too easily compromised using easily obtainable hacking tools.Implementing the right technology is certainly a good part of the solution for protecting mobile data, but generally technology alone is not enough. Cisco commissioned a study recently of user behaviour around mobile security and it revealed some startling findings. Almost three quarters of the users interviewed admitted they are "not always cognizant of security threats and best practices when working on the go." Many said they were aware "sometimes," but 28% said they hardly ever" considered security risks and proper behavior, and some said they never did. When asked why they were lax about security, they offered reasons such as, "I'm in a hurry", "I'm busy and need to get work done," "Security just is not top-of-mind for me," and "It's IT's job, not mine."Risky behaviours? Using other people's private and unsecured Wi-Fi networks, opening emails and attachments from unknown and suspicious senders. Others that are almost certainly as prevalent: not implementing passwords, not changing them regularly, and the one that makes every network security specialist tear his hair out in frustration, writing passwords on a sticky note and attaching it to the device.The point of the study, says Cisco's Kost, is that IT departments have an opportunity to improve behaviours around security by engineering users rather than devices and networks. It may even be more effective than using mechanisms for enforcing security. Too much enforcement and users may start looking for ways to circumvent security, or they simply won't use the tools and applications, defeating the purpose of the investment in mobile technology.Most companies now have policies defining acceptable use of company-issued technology. They should be extended to cover mobile devices. Many companies require employees to sign agreements that they will abide by the policies, but that on its own may not be enough, Kost says. "You certainly need to renew the agreement when you give them a PDA. And you need to reinforce it with annual or periodic updates. ‘Here are the policies, here are the things you should be doing.' User education needs to be constantly refreshed."The trick, again, though, is not to impose so much from above that users rebel or stop using the technology. "It's a question of how you communicate with them," Kost says. "You have to become more a partner with them, rather than carrying a big stick and whacking them with it."That sounds like reasonable advice. But if you're an IT manager and you have users writing passwords on sticky notes and pasting them on their mobiles, your first and uncontrollable impulse may be to reach for a very big stick.

Securing mobile data

News | September 19, 2007

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us