Mo­bile de­vices (phones, tablets etc) are every­where. Giv­ing in to the wave of pres­sure and recog­nis­ing the pro­duc­tiv­i­ty im­prove­ments that are pos­si­ble through the use of mo­bile de­vices, com­pa­nies have in­creas­ing­ly be­gun arm­ing their staff with mo­bile de­vices or al­lowed them to use such in per­form­ing their work. Un­doubt­ed­ly com­pa­nies have ex­pe­ri­enced a per­for­mance boost. No longer are cus­tomers told that the per­son didn't see the email be­cause they weren't in the of­fice or that they'll get a re­sponse on Mon­day when the per­son goes to the of­fice.

Mo­bile de­vices are a tremen­dous ben­e­fit to Caribbean com­pa­nies but they car­ry a risk that many aren't recog­nis­ing. This risk is com­pound­ed as em­ploy­ees of­ten bring their own de­vices to work and use them for work pur­pos­es. Some em­ploy­ers view this bring your own de­vice (BY­OD) ap­proach as cost sav­ings to the or­gan­i­sa­tion be­cause they think that they don't have to in­cur the cost of pur­chas­ing and main­tain­ing such de­vices.

The risk that some Caribbean com­pa­nies aren't recog­nis­ing is that mo­bile de­vices, if not prop­er­ly con­fig­ured, can open up unau­tho­rised means of ac­cess to com­pa­ny in­for­ma­tion lead­ing to dam­aged rep­u­ta­tion, cor­po­rate es­pi­onage, loss of rev­enue etc. Unau­tho­rised ac­cess can al­so lead to the in­tro­duc­tion of virus­es and mal­ware on a com­pa­ny's sys­tem which can shut down a com­pa­ny's IT sys­tem and crip­ple its op­er­a­tions.

The risk is mag­ni­fied be­cause as em­ploy­ees, in seek­ing to re­duce the us­age of their da­ta plans and save on their per­son­al cost, will fre­quent­ly use open wire­less net­works that they dis­cov­er and of­ten have their mo­bile de­vices con­fig­ured to search for such and use those first. These net­works are of­ten un­se­cured and thus fre­quent­ed by hack­ers look­ing for vic­tims.

There are sev­er­al mea­sures that com­pa­nies should have in place when al­low­ing the use of mo­bile de­vices. The first and sim­plest method is that any­body who wants to use a mo­bile de­vice to ac­cess the In­ter­net and com­pa­ny net­work should have in­stalled and reg­u­lar­ly up­dat­ed an­ti­mal­ware soft­ware for their de­vice. Sec­ond, mo­bile de­vices should be con­fig­ured to avoid un­se­cured wire­less net­works. Third, Blue­tooth should be hid­den from dis­cov­ery; when not in ac­tive use for head­sets and head­phones, it should be dis­abled al­to­geth­er. These are just good first steps. Com­pa­nies should take oth­er mea­sures.

In­creas­ing­ly in­di­vid­u­als have re­alised that they can­not have mo­bile de­vices open to be picked up and used by any­one. Peo­ple have learnt that if their mo­bile de­vice is stolen any­one find­ing it can ac­cess their per­son­al in­for­ma­tion and use their de­vice and in­cur charges that they'll have to pay. As such, most in­di­vid­u­als have con­fig­ured their mo­biles to re­quire a pass­word.

Where a mo­bile de­vice is be­ing used for work pur­pos­es, ac­cess-grant­i­ng should go be­yond just a pass­word to en­sure that pos­ses­sion of a mo­bile de­vice doesn't au­to­mat­i­cal­ly grant ac­cess to im­por­tant in­for­ma­tion and sys­tems. Most mod­ern mo­bile de­vices now in­clude lo­cal se­cu­ri­ty op­tions such as built-in bio­met­rics–fin­ger­print scan­ners, fa­cial recog­ni­tion and voice­print recog­ni­tion–and com­pa­nies should re­quire the use of one of these plus the pass­word.

Ex­perts rec­om­mend that "all mo­bile de­vice com­mu­ni­ca­tions be en­crypt­ed...sim­ply be­cause wire­less com­mu­ni­ca­tions are so easy to in­ter­cept and snoop on... (They) rec­om­mend that any com­mu­ni­ca­tions be­tween a mo­bile de­vice and a com­pa­ny or cloud-based sys­tem or ser­vice re­quire use of a vir­tu­al pri­vate net­work (VPN) for ac­cess to be al­lowed. VP­Ns not on­ly in­clude strong en­cryp­tion, they al­so pro­vide op­por­tu­ni­ties for log­ging, man­age­ment and strong au­then­ti­ca­tion of users who wish to use a mo­bile de­vice to ac­cess ap­pli­ca­tions, ser­vices or re­mote desk­tops or sys­tems."

The dif­fi­cul­ty that's faced when com­pa­nies opt for the BY­OD route is that the user owns the de­vice, not the or­gan­i­sa­tion, which makes se­cu­ri­ty some­what trick­i­er for IT to es­tab­lish and main­tain. Oth­er ex­perts rec­om­mend­ed that in those sit­u­a­tions, com­pa­nies should "re­quire such users to log in­to a re­mote vir­tu­al work en­vi­ron­ment. Then, the on­ly in­for­ma­tion that goes to the mo­bile de­vice is the screen out­put from work ap­pli­ca­tions and sys­tems." This means the da­ta doesn't re­main on the de­vice once the con­nec­tion to the com­pa­ny's net­work is ter­mi­nat­ed. Since ac­cess­ing a re­mote vir­tu­al work en­vi­ron­ment in­vari­ably oc­curs through VPN con­nec­tions, com­mu­ni­ca­tions are se­cure as well.

For com­pa­nies that want to go fur­ther, they can im­ple­ment mo­bile DLP tech­nolo­gies as they pro­vide da­ta clas­si­fi­ca­tion fea­tures to la­bel mes­sages and doc­u­ments (meta­da­ta la­bel­ing), as well as fea­tures that analyse and fil­ter con­tent when a mo­bile de­vice in­ter­acts with a cor­po­rate serv­er. They can pre­vent in­for­ma­tion that's been clas­si­fied as Sen­si­tive or cer­tain types of emails from down­load­ing to a mo­bile de­vice. Some of the DLP (Da­ta Leak­age Pre­ven­tion) prod­ucts pre­vent sen­si­tive in­for­ma­tion from be­ing trans­ferred to de­vices based on a user or group rather than a de­vice ID.

Along with tech­no­log­i­cal mea­sures, com­pa­nies need to ed­u­cate users on the dan­gers of da­ta leak­age, what's con­sid­ered sen­si­tive and con­fi­den­tial in­for­ma­tion, and about se­cu­ri­ty of de­vices. Em­ploy­ees should be taught about the im­pli­ca­tions of da­ta leak­age not on­ly to the or­gan­i­sa­tion but al­so to their own job se­cu­ri­ty. Most em­ploy­ees will help pro­tect an or­gan­i­sa­tion's as­sets once they un­der­stand what con­sti­tutes "con­fi­den­tial" in­for­ma­tion and the con­se­quences of its leak­age plus the risks that or­gan­i­sa­tions face through unau­tho­rised mo­bile ac­cess.

Bri­an Ram­sey, MBA,&nb­sp;Chair­man, CISPS

�2 The Caribbean In­sti­tute for Se­cu­ri­ty and Pub­lic Safe­ty is a reg­is­tered in­sti­tu­tion with the Ac­cred­i­ta­tion Coun­cil of Trinidad and To­ba­go (ACTT). Tel: 223-6999, 299-8636, in­fo@caribbeanse­cu­ri­tyin­sti­tute.com or www.caribbeanse­cu­ri­tyin­sti­tute.com

&nb­sp;