Its
remarkable how much can change over the course of just a couple of years. We've
seen bring-your-own-device (BYOD) evolve from a buzzword to an accepted
practice with a strong business use case. Cyber
criminals are savvier than ever and using mobile-optimized techniques and
malware to obtain more targeted prizes, such as Social Security numbers and
credit card information. Decade-old attacks are even resurfacing under new
guises, and with far greater precision than their predecessors. And of course,
the proliferation of mobile devices available to an increasingly remote
workforce continues to plague IT security professionals who are all too aware
of the potential threats.
However,
for all the considerable hype around each emerging mobile threat vector, one
simple truth remains often overlooked: The only secure way of handling mobile
devices is in a managed way. But what exactly does a managed approach look
like?
IT
security professionals and cyber criminals are continuously battling to gain
the upper hand. The trouble is, for the most part, the good guys are being more
reactive than proactive. While we are learning from mistakes or flaws in
security frameworks as they are breached, cyber criminals are already plotting
the next attack, carefully considering areas of network security
that are most susceptible to infiltration. How many more high profile
incidents, such as the Adobe or Target hacks, must we endure before going on
the offensive? As an industry, it's time to realize that mobile
security has been, and continues to be, a systemic problem. Unfortunately,
despite myriad expert warnings and sensitive data being put at risk, many
mobile technology companies'
primary focus remains on the consumer market instead of the enterprise market.
To
put it bluntly, endpoints like personal laptops, smartphones or tablets remain
the weakest points within a security infrastructure. That's why it's so
befuddling how organizations are still permitting unmanaged devices on their
corporate networks. With the technical ability of today's cyber criminals,
intercepting unencrypted communications, for example, is as simple as taking
candy from a baby. While proactive steps to combat threats such as these are
clearly necessary, it's important to note that
there is no one magic technology that can efficiently safeguard against
every type of malicious situation or attack.
It
boils down to this – there is no substitute for fundamentally robust network
security components being seamlessly implemented to establish defense in depth.
Ideally, this will include everything from client device firewalls to IPsec
VPNs. An important caveat to include here is, even these rigorous security
mechanisms aren't failsafe against users ignoring common safety precautions,
such as blindly clicking on links or opening suspicious e-mail attachments.
This means companies should not take for granted that everyone within their
organization is equally savvy about basic technology and security
protocols—they must continuously educate and reinforce best practices.
Comprehensive
solutions are hard to come by, as many security solutions designed to combat
mobile threats can, at best, be described as siloed solutions that lack
integration between critical security functions and the ability to be managed
by IT. To be clear, these solutions do not lack sophistication because, in many
cases, they are perfectly functional for the tasks they are designed to
perform. Rather, the issue is that threat detection, mitigation and response
requires an integrated and managed approach that is often difficult to obtain,
considering the way mobile threats are currently tackled.
For
instance, because mobile devices are constantly exposed to different and often
hostile public networks, the best security technologies are barely enough to
secure a user. Therefore, in the absence of a one-size-fits-all security
product – which does not appear to be on the horizon – the best option is to
interconnect the range of best-of-breed security products and technologies and
have them work together, focusing on providing defense-in-depth rapid threat
response. IF-MAP, for example, is an open standard that is well-positioned to
deliver in this area. IF-MAP provides the possibility to interconnect different
IT security systems for an accurate representation of the health status of an
IT network.
All
things considered, the problem with mobile devices remains a systemic one.
Organizations must be more and more proactive about patching up the holes in
their remote access strategies at every stage, from policy creation to the
technologies' implementations. IT administrators must reach out across the
aisle to everyone, from designers, software architects, company management and
end-users, to ensure that the necessary security precautions are being taken,
and that corporate compliance is being adhered to. If this collaboration and
holistic approach can be accomplished, we are likely to see fewer headlines
about major corporate network breaches. Let's make 2014 the year that we take
action.
No comments:
Post a Comment