Securing Mobile Devices

Transcription

1 Impacts of Mobile Devices Securing Mobile Devices Mobile devices are changing the business landscape. As enterprises have moved toward global business operations, these devices have become indispensable. Mobile devices offer enterprises the ability to keep their employees connected at all times. These devices afford people the ability to conduct business anywhere whether they are at home, in the office, or traveling between destinations. As a result of the increased use of mobile devices in business, many enterprises are seeing an increase in employee productivity. A recent Aberdeen study showed that best-in-class enterprises are enjoying a 40 percent increased productivity rate.1 These increases in productivity should be able to demonstrate a very quick return on investment (ROI) for enterprises that have chosen to purchase, manage and support the use of mobile devices for employees. While an increase in productivity and a quick and high ROI are positive attributes for any enterprise, the risks associated with mobile devices can be significant and include issues stemming from human factors to technology and architecture issues. A lack of enterprise control of physical devices, and employees using personal devices for business has increased mobile device risk levels. Therefore, it is imperative when considering the deployment of such tools to consider the potential benefits, risks and controls associated with the technology. What Are Mobile Devices? Mobile devices can mean many different things to people. For this paper, we will define mobile devices as: Full-featured mobile phones with personal computer-like functionality, or smartphones Laptops and netbooks Tablet computers Portable digital assistants (PDAs) Portable Universal Serial Bus (USB) devices for storage (such as thumb drives and MP3 devices) and for connectivity (such as Wi-Fi, Bluetooth and HSDPA/UMTS/EDGE/GPRS modem cards) Digital câmeras

2 Radio frequency identification (RFID) and mobile RFID (M-RFID) devices for data storage, identification and asset management Infrared-enabled (IrDA) devices such as printers and smart cards Devices such as these provide the user with the opportunity for seamless communication and/or information storage whether in the office or elsewhere. The communication capabilities allow workers to utilize wireless networks to communicate via phone, and text. Many provide access to the Internet, access to company documents and drives, video and photographic capabilities, and storage capability. In short, many of these devices enable an employee to be away from the office yet have the convenience of all the office resources. Business Benefits of Mobile Devices Mobile device usage is ubiquitous and continually expanding. According to the Gartner PC installed base forecast, by 2013, mobile phones will overtake PCs as the most common web access device worldwide. 2 As individuals in society have experienced the convenience of mobile device use, enterprises across the globe are now equally realizing the benefits that mobile devices can bring to the enterprise. Some of the benefits currently being experienced by enterprises include: Increased workforce productivity Mobile device strategies provide connectivity to knowledge workers Who otherwise would not be able to access , corporate documents and other information. This facilitates the completion of work offsite. Bestin-business enterprises are capturing a 40 percent increase in employee productivity. Improved customer service By providing enterprise representatives with up-todate information irrespective of location, a sales person or account manager can access the customer relationship management (CRM) system while at a customer site and provide ad hoc solutions and current customer account information. Response to customer problems or questions at any time An average of 35 percent improvement4 in customer satisfaction has been seen in best-in-business enterprises using mobile device management strategies. Improved turnaround times for problem resolution Enterprises that effectively employ mobile devices have more flexibility facing the challenges of time zones or office hours.

3 Increased business process efficiency Many enterprises are seeing shortened and more efficient business processes. Mobile devices have affected issues such as supply chain management (SCM) by providing employees with information to speed the capture of inbound s upply chain data and shortening the feedback loop between the supply chain and production planning. Employee security and safety While many mobile devices focus on the real-time access to information that a device such as a smartphone can offer, one of the first reasons for mobile device adoption was safety and security. These devices allow employees to travel to and from remote locations while staying in touch and connected. Employee retention By supporting the use of mobile devices within an enterprise, management creates positives for both the business and employees. The use of mobile devices can improve the work-life balance by facilitating the ability of employees to work remotely. This improvement in the work-life balance has been shown to increase employee retention by up to 25 percent. Although mobile devices can offer enterprises some highly valued benefits, it is important to recognize that these benefits can be realized only if the enterprise manages the technology effectively for both value and risk. Risks and Security Concerns With Mobile Devices Deployment of mobile devices can present a significant amount of risk to the overall enterprise security posture. Mobile devices have numerous vulnerabilities that are susceptible to malicious attacks as well as nonmalicious internal threats. From the types of networks the mobile devices use to the threat of data loss, mobile devices have no shortage of inherent risk. Ironically, many of the risks associated with mobile devices exist because of their biggest benefit: portability. Mobile devices transport data via wireless networks, which are typically less secure than wired networks. These wireless networks can leave information at risk of interception. Additionally, many of these devices have storage capability and unencrypted data at rest, thus the information gathered from either the interception of data in transit or theft or loss of a device can result in the compromise of sensitive and proprietary information.

4 In addition to data loss, mobile devices carry the risk of introducing malware. The devices themselves can be used as a platform for additional malicious activity. Devices and laptops with onboard microphones and cameras are particularly vulnerable because they can be activated easily using publicly available tools, possibly resulting in malware propagation, data loss and eavesdropping. Likewise, cellular and Voice-over IP (VoIP) technologies also have vulnerabilities that can be easily exploited, resulting in intercepted calls. The risks of using mobile devices are certainly abundant. In addition to the previously mentioned issues, the potential exists for technical attacks against devices by using vulnerabilities in the communications layer. These attacks are perpetrated using remote access tools (RATs) that can be planted on a mobile device, and thereby access the physical device to recover information and data. These threats can be countered in many cases by using sound policy and judgment in the implementation and use of the devices. However, some threats require the additional layers of protection that technical controls and countermeasures offer, such as encryption and third-party security software designed to counter these threats. Conclusion Technical innovation has paved the way for mobile device assimilation into the workplace. These devices have acted as a catalyst for improving efficiency, productivity and availability in business operations. While many enterprises have chosen to utilize this technology, they have often not considered the business risk or the governance implications associated with these devices. Loss, theft or corruption of sensitive or confidential data; malware that can affect not only the mobile device itself, but also the enterprise network; and the way in which employees use the devices are just a few of the risks involved with this type of technology. In addition to the governance and security that already exist within the enterprise, risks and associated controls (if they exist) that accompany this boundaryless technology must be assessed to ensure that enterprise information assets are protected and available. Enterprises that have been considering the use of mobile computing devices in their environment should calculate the benefits that the technology can offer them and the additional risks that are incurred. Once benefits and risks are understood, businesses should utilize a governance framework to ensure that process and policy changes are

5 implemented and understood, and that appropriate levels of security are applied to prevent data loss. Fonte: ISACA Journal, 2010.

6 Atividade: Objetivo: Identificar riscos e definir estratégia para tratar esses riscos. Grupos: Os alunos podem optar por trabalhar em duplas ou individualmente. Entrega: A entrega ocorrerá na próxima aula (Aula 15) no formato impresso. 1. Identifique pelo menos 5 (cinco) riscos relacionados com mobile devices. Vulnerabilidade Ameaça Risco 2. Descreva a estratégia de tratamento para cada risco identificado na questão anterior. Risco Planos de Ação 3. Descreva um procedimento de auditoria para verificar a eficácia dos planos de ação. Não se esqueça de definir claramente: o objetivo da auditoria, os controles a serem auditados e as evidências que devem ser analisadas.