42

Info

security To

day

July/August 2006

co

lu

mn

In response to increasing demandand the pursuit of greater flexibility

and productivity, businesses are providing staff with devices that enable them to work anytime,anywhere. In fact, mobile devices and networks are now essential components of business life.

In combination, devices and networks give users remote access to corporate resources, applicationsand information, from home, in hotels, airport lounges, trains andeven in coffee shops.

Providing ubiquitous remote access and allowing employees to communicate with each other,customers, suppliers and businesspartners may yield both quantitativeand qualitative benefits. But it alsomeans that sensitive information isoften handled and stored outside thecontrol of the organization.This canincrease the many risks to which thecompany is already exposed.

Many readers will already have one or more mobile devices, such as a laptop, PDA, smartphone orBlackBerry, that provide fast, simple access to the internet and hence corporate networks. Many of them arealready feature-rich with support forbusiness applications, and new, morecapable models continue to emerge.

Securing these devices and the data stored on them can be a majorproblem. It is made worse by weaksecurity controls and inappropriateuser behaviour. Furthermore, if personally-owned devices are used for business purposes, theproblems may be compounded because imposing even a minimallevel of security may be difficult.

The range of connection technolo-gies is also growing.They includewireless networking based on theIEEE 802 standard such as WiFi,WiMAX and Bluetooth; and mobilephone platforms such as GSM, CDMAand 3G.These underlying technolo-gies, which are also not static targets,are also subject to a range of securitythreats such as eavesdropping,jamming and denial of service.

Major challenge The major information security challenges are to provide reliable connectivity, meet legal, regulatoryand business requirements to safeguard business information, andprevent the disclosure of sensitivepersonal information.The informationsecurity professional needs to choosethe most suitable approach for theirorganization, based on a thoroughrisk assessment of not only the devices but of the corporate networkand the method of connectivity.

To embrace mobile networkingwhile addressing the challenges,organizations need to secure four levels: the user, the access device,the data both in transit and in storage, and the access networks.

Users and their behaviour are paramount. Even the best security

wizardry is worthless if employeesleave devices or passwords lyingaround. So, user education and discipline is vital to minimize therisks of security breaches.

If they are applied rigorously, arange of existing technologies willsecure devices and the data onthem.These include encryption,firewalls and anti-virus software.Others are remote locking and deletion software and the use of digital certificates for authentication.Data in transit can also be protectedusing VPN solutions such as SSL or smartphone, or other mature technologies such as PGP.

The same is true for protecting the corporate network. Logical segmentation, application security andtechnologies such as Radius, 802.1Xand Network Access Control and itsvariants are all effective weaponsagainst attack.And if an organizationhas wireless access points, these toocan be made more secure by placingthem in a DMZ, changing default settings and by using WirelessProtected Access (WPA), the successorto Wired Equivalent Privacy (WEP).

Anytime anywhere access is not go-ing away, and neither are the businessdrivers and requirements for such ac-cess. Information security has to in-corporate this reality.There is nopanacea, but a layered approach, us-ing a combination of existing tech-nologies, can and does already pro-vide security without compromisingmobility.•About the author Adrian Davis is a member of theInformation Security Forum (ISF).www.securityforum.org

Information security canenable mobile workingAdrian Davis

Help is on hand to protect corporate information and assist in the adoption of mobile devices and technologies.

Adrian Davis

“Securing these devices is madeworse by weak

security controls andinappropriate user

behaviour”