5 steps to mobile risk management

1DMI WHITE PAPER

Nearly 80 percent of American investors say they aren’t likely to invest in companies that have suffered multiple cyber attacks1. Analysts estimate that data breaches cost large enterprises an average of $5.4 million per breach2 and can erode brand value by hundreds of millions of dollars3.

As data breaches have damaged business performance and company valuations, data security concerns have broken out of the CIO’s office and into the boardroom, where CEOs are being challenged to explain what they’re doing to ensure that vital revenue streams and shareholder value are being safeguarded.

As the business stakes have been raised, the explosive growth in mobile devices has multiplied the threat. Nearly 40% of organizations in another recent study had data breaches resulting from lost or stolen mobile devices, including tablet computers, smartphones and USB drives that contained confidential or sensitive data4.

So what does a company need to do to manage the risk of data loss through mobile devices? This white paper outlines a rational, risk-based approach to data protection that’s designed particularly for the new world of mobile devices.

1 Zogby Analytics/HBGary Feb 25, 20132 Ponemon Institute 2013 Cost of Data Breach Study3 Ponemon Institute October 20114 Ponemon Institute 2011 Cost of Data Breach Study

MOBILE SECURITY:5 STEPS TO MOBILE RISK MANAGEMENT

2DMI WHITE PAPER

Mobile Security: 5 Steps to Mobile Risk Management

Historically, when new business process-changing technologies become available, e.g. Email, Web Services, Laptops, Wifi, Cloud Services, and now ubiquitous and heterogeneous Mobile Devices, the focus is on figuring out how to use and manage the technology. Worrying about securing it comes later. Then a familiar pattern is often repeated: a period of time is spent admiring the security problem; eventually a myriad of disparate “bolt on” point security solutions are developed; then finally security is integrated into the technology.

Right now, Mobile technologies are somewhere between admiring the problem, and bolting on solutions. Mobile security vendors are in a rush to launch new products. Dozens of new point solutions are flooding the market, and enterprises are challenged to determine what they need, and how to integrate them into their infrastructure.

The problem is that there is little discussion of what the business requirements for security actually are. Mobile Security is not just one thing. There are multifaceted threats and risks that need to be managed. These include secure identity and access control; data protection and content management; application management and security; malware protection; digital forensics, secure transport, monitoring and reporting, policy enforcement and device management. Each of these plays a critical part in managing risk, because no organization has the same risk profile. Balancing which to prioritize, and how much to implement takes expertise.

Users

Data & Content

Apps

Networks

Devices

Secure Identity

Application Security

Data Protection

Secure Transport

Access Control

Malware Protection

Content Management

Monitoring/Reporting

Privacy Controls

Digital Forensics

Application Management

Policy Enforcement

Device Management

Mobile Security Landscape

3DMI WHITE PAPER


A Risk-Based ApproachThe key to real security is taking a risk-based approach. This means developing a set of practical business and security requirements that point the way to the technologies and policies that eliminate the most risk without unduly impacting usability and needed business functionality. This avoids the common backwards approach: buying a technology based on feature set, then figuring out how to integrate it into the business process.

Establishing business security requirements involves answering the question, “secure from what?” Almost every organization will have a different answer. There will certainly be standard risk-based approaches and security features that apply across the board. But the priority of controls, the way they are implemented, and the way they are managed will be unique to each organization.

The Twenty Critical Security Controls, developed by the SANS Institute, have helped many large enterprises and government agencies begin to transform security by focusing their spending on the key controls that block attacks that have the greatest overall impact on security. Several of these Critical Security Controls apply just as well to mobile devices as to traditional computers:

Asset and configuration management

Strong authentication and identity management

Protection of sensitive data at rest and in transit

Protection against Lost/stolen/decommissioned devices

Protection from malware from email or web

Device-specific Operating System vulnerabilities

Connecting to insecure/rogue wifi

Protection and management of web and email traffic

The organization’s unique business requirements will determine where to start and how to build. For companies with intellectual property to protect, encryption will be a high priority; organizations that field many mobile apps might need to focus on application security; companies where users need to access internal applications might require strong identity management. Many tools are available for each area. Selecting the right one depends on an organization’s unique environment and requirements. To help define requirements and determine the best approach, DMI recommends a Five Step Mobile Risk Management Process.

4DMI WHITE PAPER


5 Step Process for Mobile Risk Management: Understand how employees want to use Mobile Devices and Applications

Identify potential threats

Define the impact to the business based on probable threat scenarios

Develop policies and procedures to protect the business to an acceptable level

Implement manageable procedural and technical controls, and monitor their effectiveness

1

2

3

4

5

Step 1: Understand User Requirements

This may vary by industry, business needs or organizational culture, but a typical list of user requirements for a personal mobile device is likely to include:

Access to enterprise applications (email, calendar, contacts, business applications, Sharepoint servers, etc)

Ability to make both personal and professional calls

Privacy for personal employee activities, data, photos, emails, texts, and applications (i.e., no corporate collecting, monitoring, or tracking)

Prohibition of organizational backup or wipe of personal data

Step 2: Identify Potential Threats

Some common threats introduced or exacerbated by mobile devices are listed below. Like user requirements, threats that are relevant to any given organization will vary depending on industry, corporate culture, and current security program and architecture implementation.

Corporate loss of control of data on device (lost/stolen/decommissioned/employment separation)

Compromise of user credentials (malicious applications, insecure applications or operating systems, credentials passed in clear over public networks, phishing web sites)

Unauthorized access to sensitive data (data passed over network in clear, data stored unencrypted on device, data backed up to uncontrolled system)

Devices (intentionally or unintentionally) used as recording devices (phone, or camera on during meetings, pictures or video of sensitive information)

5DMI WHITE PAPER


Step 3: Define the impact to the business based on probable threat scenarios

Business risk is about loss of Confidentiality, Integrity, or Availability (CIA). Each kind of loss is associated with a different level of business impact. And the approaches to monitoring and protecting against each type of loss are different. An adversary might use a spear phishing email to compromise an endpoint to steal user credentials to access a database to exfiltrate data (loss of Confidentiality). Or, they could corrupt (loss of Integrity) or delete (loss of Availability) that data.

One problem with traditional risk modeling is that it often sets a “value” for an asset based on a simple measurement, such as the cost of a lost device. But business impact value is more complicated--value of data, of business process, of loss of future revenue, etc. must all be considered. And the impact of a loss may even vary depending on how the asset is lost. For a given set of data, loss of Confidentiality (trade secrets fall into the hands of a competitor) might have a greater business impact than loss of Availability, or Integrity (the same data is deleted or corrupted).

Standards need to be created that call out different levels of impact and different controls for each of these three (CIA) risks. More important, the likelihood and impact of a security event need to be factored in to achieve better prioritization. A whole paper could be written about vulnerabilities in mobile operating systems, applications, or ActiveSync. But risk management is about playing to the rule and not the exception. A rational approach addresses the more likely and costly threats before getting to the more esoteric.

Loss of a device is very common—for most organizations, it’s likely to be a high priority for risk management. What about a hacker in a coffee shop sniffing WiFi traffic and pulling data or credentials off the air? This is where it’s necessary to think about unique business characteristics and how they influence risk: does your company manage a lot of intellectual property? Are there significant regulatory requirements for how to protect and control data? Do you have a diverse workforce distributed around the country, or around the globe with different privacy laws? Do your users only access email, or do you have critical business applications running on your mobile devices, or do you collect critical business data on them? These are the kinds of questions that need to be answered, and risks factored for each.

A security program built around the threats that get the most “press” is likely to be both costly and ineffective. Successful programs address the risks that carry the greatest business impact and that are most likely to occur--like expecting that users will lose mobile devices.

6DMI WHITE PAPER


Step 4: Develop policies and procedures to protect the business to an acceptable level

Mobile security can be complicated. If the organization owns the mobile endpoints, the same security controls and policy processes can be applied as are being used to protect laptops:

Require good passwords

Encrypt the data

Antivirus (only effective on Android)

Educate users about phishing emails that ask for credentials

Educate users about application risks, don’t allow apps over public wifi

Keep phones out of meetings when talking about proprietary information

But BYOD introduces significant privacy issues. Employees might need to sign off on a policy that authorizes forensics testing on their device. Implementation becomes more complex because it may require separation for work email, calendar, contacts, phone, and documents from personal data. A policy should include:

Maintenance and management of a list of devices (linked to users) that are authorized to access company resources

Tracking of devices and users accessing company resources at any given time

Restricted access from devices with insufficient protection against compromise to data or user credentials

Controlled access to data, applications, and resources based policies such as data classification, user, device, network, or location

Secured company data, at rest (at server and locally), and in transit (across mobile network or wifi)

Protection of devices from unauthorized access or malicious code

Maintenance of user privacy (email, texts, contacts, voicemails, applications, etc)

Regular security evaluation of all business applications to identify data leakage or unnecessary access to device resources (e.g., camera, contacts list, call history, etc)

Removal of corporate data from personal devices in case of loss, theft, or separation from employment

An additional item that might require discussion with HR or legal: Geo-location (do you need to know where your employees are?) This might have privacy implications whether company owned or BYOD.

7DMI WHITE PAPER


Step 5: Implement manageable procedural and technical controls, and monitor their effectiveness

Once requirements have been established to mitigate the potential risks to the business it’s possible to estimate the size, scale, complexity, and budget for implementation. It might be that having better visibility of what devices are connected and insuring that they are encrypted is enough. A lot can be done with ActiveSync, which doesn’t cost anything. An MDM platform offers more control. Container, wrapper, or secure virtualization might be necessary to meet some security requirements. Requirements drive a progression from simple and inexpensive to more complex and costly as illustrated below.

Where risk management comes in is identifying what sequence these would be implemented, based on needs of the business, and priorities for protection.

The bottom line is that it takes a rational plan, and an understanding of available technologies. The number of mobile security technology tool companies is growing weekly. First MDMs, then containers, then application wrappers to give more granular control; then encryption tools, and strong authentication tools; application management tools, and even handsets with secure virtualization. Today, many enterprises struggle to to achieve application security – this is true both of commercial apps and custom apps. How to manage secure connectivity to mobile devices; how to secure the data contained in the apps; how to maintain app security by seamlessly pushing

8DMI WHITE PAPER


updates and patches to user devices… these have all become major concerns. And each layer of concern brings more cost and complexity. As enterprises are challenged to determine what tools are needed and how to integrate them, the key is to keep coming back to the question of which risks are the most impactful to the business. These are the areas that must be secured first.

Deciding what level to achieve is the first step. Then research or assistance may be needed to understand all these tools and how they work together, how they integrate, and what benefits they bring. Finally, it’s necessary to set up a monitoring and management structure to maintain this posture going forward. Some organizations may choose to handle mobile security internally, others may outsource to specialists. Either way, it’s important to set the balance, applying the security that’s necessary without over spending on trying to cover everything. It takes a risk-based approach to prioritize organizational needs and develop a security architecture and process to match.

The DMI Security Services ApproachDMI has developed a comprehensive security service that effectively manages the risks that mobile devices bring to the Enterprise. We take a Risk-Based Approach--putting priority on the risks that carry the greatest business impact; and combine it with a unique security foundation, tailored to meet each client’s specific needs.

Then we address the whole life cycle by repeatedly applying our 5-Step Process.

Through the entire process, our focus is on defining and matching customer requirements to protect from the threats that are most relevant to each individual organization today, while engaging in ongoing monitoring to identify and eliminate the threats of tomorrow.

9DMI WHITE PAPER


About DMIDMI is the world’s leading provider of enterprise mobility services and solutions. We buildenterprise class mobile solutions that generate results for the world’s top brands and businesses.Our mobile solutions combine the award-winning user experience design that has made us oneof the top creators of consumer apps, with the deep middleware and engineering expertise thatwe’ve used to build and manage enterprise applications for the most demanding IT departmentsin the world. DMI mobility solutions improve business processes, tap new revenue streams, buildcustomer loyalty, and increase employee productivity. And we offer a full range of ManagedServices to securely set up, configure, and manage your mobile devices.

The proof:

We’ve built more than 400 mobile apps – in the past 12 months alone – for more than 150 leading organizations – like Disney, Coca Cola, Toyota, Vodafone, P&G, The National Guard, and Universal Studios.

We offer brilliant creative and user experience: Our mobile app development group was named the Best Branded App Developer at the 2012 Mobile Entertainment Awards.

We have 500,000 devices under management for more that 100+ clients, including many Fortune 500 companies – like BP, Johnson & Johnson, Sears, The Associated Press, Allergan, and more. At BP, we’re deploying 1,000 managed mobile devices each day.

We provide 24 x 7 x 365 mobile service support for more than 500,000 users. DMI is the one call our customers need to make to resolve any issue – devices, apps, infrastructure, even carriers.

We offer a full range of security options that include Federal-grade hardware-based security, two-factor authentication, secure container, and sophisticated encryption solutions.

With our expertise and economies of scale, we can provide mobility management at a higher service level and on average 20% lower cost than most companies can do on their own.

Pervasive excellence is our commitment to quality service. DMI is one of only a handful of companies that is CMMI L3 appraised for both application development and services, as well as ISO 9001:2008, ISO 27000:2005, and ISO 20000-1:2005 certified. Our average D&B Open Ratings performance score from our clients is 93/100.

DMI One Rock Spring Plaza6550 Rock Spring DrBethesda, MD 20817

DMInc.com

DMI Sales TeamU.S. Sales: 855.963.2099Intn’l Sales: [email protected]

©2013 Digital Management, Inc. All right reserved.

5 steps to mobile risk management

Technology