Network vs. Device Security

Which is more important in a collaborative environment?

As virtual offices and remote workforces become the norm, so does the need for a secure mobile collaborative environment. Employees want to be able to work and share information whenever and wherever, and enterprises want to reap the productivity benefits that mobile delivers. However, supporting today’s mobile workforce doesn’t come without a few challenges. Businesses need to balance their employees’ desire for bring your own device (BYOD) and bring your own apps (BYOA) with their IT department’s mandate to maintain control and keep sensitive corporate data secure.

Without proper policy and tools in place, employees will ultimately create their own solutions or “workarounds” by default. This unwittingly puts the enterprise at risk for myriad security threats, including data leakage, non-compliance, version conflicts and former employees who depart with sensitive corporate information.

While mobile workforces can potentially be disruptive to the enterprise, they don’t always have to be. By implementing a proper mobile collaboration and BYO policy, both the IT department and mobile workers can be kept happy—while increasing overall productivity and efficiency at the same time. But where should you begin? Do you focus on securing the network itself, or the mobile devices? Or neither?

Network Security

Most organizations provide access to corporate data and applications through virtual private networking (VPN) software and services. Unfortunately, however, road warrior employees often find that VPN services are not available in every location—especially when traveling abroad. And when they are available, connections can often be slow and intermittent. In addition, VPNs can provide access to too much of the corporate network, making it harder for IT to truly enforce security policies.

VPNs pose challenges locally, as well. When used with unprotected mobile and home devices, VPNs can serve as an easy entry point for malware and hackers into the corporate network. SSL VPNs offer ways to restrict mobile data access, but that access has to be Web-enabled. The split tunneling features of today’s VPN solutions separate employee Web surfing from LAN access but also provide a convenient pathway for Internet malware and hackers to enter directly into the corporate LAN. The more sophisticated hackers siphon off corporate data for profits, and the less sophisticated simply wreak havoc on the network and add to unnecessary restoration costs for the organization.

Policy-based network access to certain types of corporate data is another mechanism, but this option would be hard-pressed to provide secure access directly to all native corporate repositories, including those of Microsoft SharePoint. While network security is still a necessary part of a successful, secure enterprise, certain measures can interfere with employees’ mobility, and, thus, productivity, which can make device security seemingly more attractive.

Device Security

Let’s look at devices. Essentially, pass codes and remote wipe capabilities are helpful and can be used as a deterrent when a device is lost or stolen. However, neither is sufficient to completely secure corporate data. Passwords can be figured out, and even the most secure mobile devices can be rooted or hacked, and often by the time an IT administrator is notified of a lost or missing device, the data has been acquired or leaked and it’s too late for a corporate wipe.

Stolen devices can end up costing enterprises a lot more than they might expect, as highlighted earlier this year in an infographic published by the technology accessories company Kensington. The research also pointed out some other frightening facts:

  • 70 million smartphones are lost each year—only 7 percent are recovered
  • 50 percent of all mobile device users keep passwords, personal information and credit card info on their device
  • 36 percent of tablets contain confidential work-related information
  • Devices are most often stolen at the office (52 percent) or at a conference (24 percent)
  • One laptop is stolen every 53 seconds

And then there are apps. According to a recent report from Appthority, 96 percent of iOS apps and 84 percent of Android apps have some ability to access sensitive information on mobile devices. That access is most often supplied to gaming apps, but very often business apps such as those used in healthcare and finance also have visibility into that information.

So, if network security is causing headaches for mobile workers and employees and standard mobile device security measures simply aren’t enough to calm IT’s nerves, what is the most important security aspect in providing efficient, cost-effective and safe collaboration? It is data security.

Data Security

“We’ve always believed that ultimately security and compliance boils down to being able to control the data,” said John Herema III, senior vice president of corporate strategy at Good Technology.

Achieving mobile worker productivity with no compromises to the data is the key—but how? The challenge is to find a way to provide users within the enterprise file sharing tools that provide the mobility, flexibility and easy collaboration they demand, while also providing the enterprise security, governance and controls that any organization requires to protect its sensitive and valuable data. Maintaining data ownership, security and governance is the most important criteria for enterprises in allowing BYO and mobile collaboration.

According to a recent report conducted by the Ponemon Institute, the average cost in 2011 of recovering from a single corporate data breach was $5.5 million. Enterprises simply can’t afford to have their data and, subsequently, their reputation compromised.

Based on my experience working with companies around the country, I think there are three key areas a business needs to review about its data before embarking on a productivity project with a secure enterprise collaboration solution for mobile smartphones and tablets.

  1. Data Ownership: Where is your data? With BYOD and BYOC (consumerbased cloud solutions) for document sharing, your corporate data stays with the account owner. So how do you make a separation of personal and corporate data? Do you want your data copied in the cloud? In the DMZ? Do you want any extra copies?
  2. Data Security: Protecting the corporate data has always been a top priority. For the mobile enterprise, it is even more so. What about lost or stolen devices? Will you be able to use the same protection mechanisms as you have been using with your corporate-issued laptops? Is VPN access an option—do you want to open your network to accessing any app? Do you want to run the risk of introducing malware into the network?
  3. Data Governance: How do you get control and visibility so that you can ensure there are no data breaches? Do you need user-specific policies? Perhaps you want to allow the marketing department editing capabilities for collateral, but you do not want the sales department to be able to change the master slide deck. How do you make sure a document does not live on a user’s device forever? What do you do for departing employees who take their BYOD and personal accounts with them? How do you handle compliance regulations? You will definitely need an audit trail to prove compliance.

To ensure data security and harmony among IT and employees, enterprises should also consider the following mechanisms:

  • Secure access that provides native file server access, including to SharePoint files, network shares and other document management systems without costly, risky duplicate cloud/DMZ stores and with no firewall reconfigurations. Multifactored authentication with Active Directory credentials and a token or other industry standard authentication mechanism should be enforced for access.
  • A secure data container that doesn’t rely on the mobile device’s data protection to be enabled but instead stores all corporate data on the mobile device in a container that is encrypted with enterprise-grade encryption. The keys should be stored inside the firewall with the corporation and not with a third-party, multi-tenant cloud provider.
  • Trusted app data sharing: Allow documents to be shared only by trusted applications that are authorized by an IT administrator. Unauthorized apps should be prevented from accessing corporate data. This capability enables separation of personal and corporate data. That is, it enables dual use and co-existence of personal and corporate data on the device; but by allowing the corporate data to be accessed only by authorized apps, it isolates the corporate data from personal apps and data.
  • Policy management offers enterprise controls by enforcing policies based on a mobile worker’s profile. The policy management should be granular and capable of being applied for a variety of factors such as caching, emailing, printing, opening in apps, expiring and revoking. Mobile workers should be granted entitlements on their mobile app based on the policies. Auditing capabilities for governance are needed, too.

Securely accessing documents and sharing and syncing them through mobile devices—across any platform—from laptops to SharePoint or other file servers, is necessary for employee productivity. Mobile workers also need the most up-to-date information at their fingertips across their multiple devices. Meanwhile, IT departments need to maintain control and governance over data, mobile devices and the network itself, without interfering with employee productivity.

While network and device security are important and can certainly be useful in contributing to the overall security of an enterprise, they simply aren’t enough. Data security is more important, more effective and the best bet for an enterprise looking to secure a mobile, collaborative workforce while maintaining harmony with the IT department, which in the end increases overall enterprise efficiency.

This article originally appeared in the October 2012 issue of Security Today.

Featured

  • Allegion, Comfort Technologies Implement Mobile Credentials at the Artisan Apartment Homes in Florida

    Artisan Apartment Homes, a luxury apartment complex in Dunedin, Florida, recently transitioned from mechanical keys to electronic locks and centralized system software with support from Allegion US, a leading provider of security solutions, technology and services, and Florida-based Comfort Technologies, which specializes in deploying multifamily access control, IoT devices and software management solutions. Read Now

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.