Network vs. Device Security
Which is more important in a collaborative environment?
- By Sanjay Jain
- Oct 01, 2012
As virtual offices and remote workforces become the norm, so does
the need for a secure mobile collaborative environment. Employees
want to be able to work and share information whenever and wherever,
and enterprises want to reap the productivity benefits that
mobile delivers. However, supporting today’s mobile workforce
doesn’t come without a few challenges. Businesses need to balance their employees’
desire for bring your own device (BYOD) and bring your own apps (BYOA)
with their IT department’s mandate to maintain control and keep sensitive corporate
data secure.
Without proper policy and tools in place, employees will ultimately create their
own solutions or “workarounds” by default. This unwittingly puts the enterprise
at risk for myriad security threats, including data leakage, non-compliance, version
conflicts and former employees who depart with sensitive corporate information.
While mobile workforces can potentially be disruptive to the enterprise, they don’t
always have to be. By implementing a proper mobile collaboration and BYO policy,
both the IT department and mobile workers can be kept happy—while increasing
overall productivity and efficiency at the same time. But where should you begin? Do
you focus on securing the network itself, or the mobile devices? Or neither?
Network Security
Most organizations provide access to corporate data and applications through
virtual private networking (VPN) software and services. Unfortunately, however,
road warrior employees often find that VPN services are not available in every
location—especially when traveling abroad. And when they are available, connections
can often be slow and intermittent. In addition, VPNs can provide access
to too much of the corporate network, making it harder for IT to truly enforce
security policies.
VPNs pose challenges locally, as well. When used with unprotected mobile and
home devices, VPNs can serve as an easy entry point for malware and hackers into
the corporate network. SSL VPNs offer ways to restrict mobile data access, but
that access has to be Web-enabled. The split tunneling features of today’s VPN
solutions separate employee Web surfing from LAN access but also provide a convenient
pathway for Internet malware and hackers to enter directly into the corporate
LAN. The more sophisticated hackers siphon off corporate data for profits,
and the less sophisticated simply wreak havoc on the network and add to unnecessary
restoration costs for the organization.
Policy-based network access to certain types of corporate data is another mechanism,
but this option would be hard-pressed to provide secure access directly to
all native corporate repositories, including those of Microsoft SharePoint.
While network security is still a necessary part of a successful, secure enterprise,
certain measures can interfere with employees’ mobility, and, thus, productivity,
which can make device security seemingly more attractive.
Device Security
Let’s look at devices. Essentially, pass codes and remote wipe capabilities are helpful
and can be used as a deterrent when a device is lost or stolen. However, neither
is sufficient to completely secure corporate data. Passwords can be figured out,
and even the most secure mobile devices can be rooted or hacked, and often by the
time an IT administrator is notified of a lost or missing device, the data has been
acquired or leaked and it’s too late for a corporate wipe.
Stolen devices can end up costing enterprises a lot more than they might expect,
as highlighted earlier this year in an infographic published by the technology accessories
company Kensington. The research also pointed out some other frightening
facts:
- 70 million smartphones are lost each year—only 7 percent are recovered
- 50 percent of all mobile device users keep passwords, personal information and
credit card info on their device
- 36 percent of tablets contain confidential work-related information
- Devices are most often stolen at the office (52 percent) or at a conference (24
percent)
- One laptop is stolen every 53 seconds
And then there are apps. According to a recent report from Appthority, 96 percent
of iOS apps and 84 percent of Android apps have some ability to access sensitive
information on mobile devices. That access is most often supplied to gaming
apps, but very often business apps such as those used in healthcare and finance
also have visibility into that information.
So, if network security is causing headaches for mobile workers and employees
and standard mobile device security measures simply aren’t enough to calm IT’s
nerves, what is the most important security aspect in providing efficient, cost-effective
and safe collaboration? It is data security.
Data Security
“We’ve always believed that ultimately security and compliance boils down to being
able to control the data,” said John Herema III, senior vice president of corporate
strategy at Good Technology.
Achieving mobile worker productivity with no compromises to the data is the
key—but how? The challenge is to find a way to provide users within the enterprise
file sharing tools that provide the mobility, flexibility and easy collaboration
they demand, while also providing the enterprise security, governance and controls
that any organization requires to protect its sensitive and valuable data. Maintaining
data ownership, security and governance is the most important criteria for
enterprises in allowing BYO and mobile collaboration.
According to a recent report conducted by the Ponemon Institute, the average
cost in 2011 of recovering from a single corporate data breach was $5.5 million.
Enterprises simply can’t afford to have their data and, subsequently, their reputation
compromised.
Based on my experience working with companies around the country, I think there are three key areas a business needs to review about its data before embarking
on a productivity project with a secure enterprise collaboration solution for
mobile smartphones and tablets.
- Data Ownership: Where is your data? With BYOD and BYOC (consumerbased
cloud solutions) for document sharing, your corporate data stays with
the account owner. So how do you make a separation of personal and corporate
data? Do you want your data copied in the cloud? In the DMZ? Do you
want any extra copies?
- Data Security: Protecting the corporate data has always been a top priority. For
the mobile enterprise, it is even more so. What about lost or stolen devices? Will
you be able to use the same protection mechanisms as you have been using with
your corporate-issued laptops? Is VPN access an option—do you want to open
your network to accessing any app? Do you want to run the risk of introducing
malware into the network?
- Data Governance: How do you get control and visibility so that you can ensure
there are no data breaches? Do you need user-specific policies? Perhaps you
want to allow the marketing department editing capabilities for collateral, but
you do not want the sales department to be able to change the master slide
deck. How do you make sure a document does not live on a user’s device forever?
What do you do for departing employees who take their BYOD and personal
accounts with them? How do you handle compliance regulations? You
will definitely need an audit trail to prove compliance.
To ensure data security and harmony among IT and employees, enterprises
should also consider the following mechanisms:
- Secure access that provides native file server access, including to SharePoint
files, network shares and other document management systems without costly,
risky duplicate cloud/DMZ stores and with no firewall reconfigurations. Multifactored
authentication with Active Directory credentials and a token or other
industry standard authentication mechanism should be enforced for access.
- A secure data container that doesn’t rely on the mobile device’s data protection
to be enabled but instead stores all corporate data on the mobile device in a
container that is encrypted with enterprise-grade encryption. The keys should
be stored inside the firewall with the corporation and not with a third-party,
multi-tenant cloud provider.
- Trusted app data sharing: Allow documents to be shared only by trusted applications
that are authorized by an IT administrator. Unauthorized apps should
be prevented from accessing corporate data. This capability enables separation
of personal and corporate data. That is, it enables dual use and co-existence
of personal and corporate data on the device; but by allowing the corporate
data to be accessed only by authorized apps, it isolates the corporate data from
personal apps and data.
- Policy management offers enterprise controls by enforcing policies based on
a mobile worker’s profile. The policy management should be granular and capable
of being applied for a variety of factors such as caching, emailing, printing,
opening in apps, expiring and revoking. Mobile workers should be granted
entitlements on their mobile app based on the policies. Auditing capabilities for
governance are needed, too.
Securely accessing documents and sharing and syncing them through mobile
devices—across any platform—from laptops to SharePoint or other file servers, is
necessary for employee productivity. Mobile workers also need the most up-to-date
information at their fingertips across their multiple devices. Meanwhile, IT departments
need to maintain control and governance over data, mobile devices and the
network itself, without interfering with employee productivity.
While network and device security are important and can certainly be useful
in contributing to the overall security of an enterprise, they simply aren’t enough.
Data security is more important, more effective and the best bet
for an enterprise looking to secure a mobile, collaborative workforce
while maintaining harmony with the IT department, which
in the end increases overall enterprise efficiency.
This article originally appeared in the October 2012 issue of Security Today.