Lock up your mobile data
Never mind WEP, have you secured the data on your mobile devices?
By Peter Judge | Techworld | Published: 00:00, 12 January 2004
- Laptops are increasingly used to replace the office desktop, so IT managers can no longer demand that users keep all sensitive data off their portable PC
- PDAs now pack a lot of memory and muscle, and routinely hold correspondence including sensitive files
- Smartphones are now used for email and other tasks too
The first line of defence is always a password and all serious PDAs and smartphones have this as an option. However, far too many users simply do not turn the password on. Add to this the fact that many of them think it is a good idea to keep all their corporate passwords, and even bank-machine PIN numbers on the PDA, and you have the makings of serious problems. This danger is so obvious, it is a surprise to find that a third of users leave themselves open to it, according to an annual PDA Usage Survey, carried out on by Pointsec Mobile Technologies. Most PDA thieves simply want the hardware to sell. If they find data they can use, they may well have a go, but a non-trivial password is usually enough to make them decide to do a hard reset and unload the kit for whatever they can get for it. The IT manager can forbid PDAs, or demand that they are all password-protected, but this is futile unless it can be enforced. "If you tell people they can't use a device, they will use it clandestinely," says Jackie Groves, managing director of mobile security company Utimaco. "It doesn't work unless you have a very controlled environment. " The best way to make sure a password is used, is to ensure that non-password protected PDAs can't use the VPN to access the corporate network. "Don't give them an extra password, replace a less secure password with a more powerful one," says Groves. Encryption
Passwords will keep out the opportunists, but someone who wants to get through them can, according to Groves. "The authentication that comes with a PDA is insecure - a two year old can get round it," she says. "Also there are very portable slot-in memory cards, which can get stolen or lost." The answer is to encrypt all the corporate data on the mobile system. The aim is to make sure that anyone finding the PDA cannot get access to the data at all. To do this, you must encrypt the data. It has to be done transparently to the user, or the "awkwardness" overhead is too high. The encryption should also apply to any form of portable storage, such as a USB RAM drive or an SD card. "You need to force-encrypt memory cards," says Groves. "The user should have no choice. Put in an unencrypted one, and the system requires you to fully encrypt it, so the user can't circumvent what you as a company have decided to do." According to Pointsec, 57 percent of corporate PDAs are unencrypted, a figure that suggests a lot of companies have work to do here. Biometrics
All security discussions eventually mention biometrics, and mobile devices are no exception. Signature recognition can be put on most PDAs, and the HP iPaq 5400 series is available with built-in fingerprint recognition. There is little sign of biometrics taking over from password security here, as elsewhere in IT, because there are ways round it and it is still not trusted fully by IT managers. For now, keep an eye on it, as it becomes more suitable for large installations. Management lockdown
All this has to come in a package that is easy to apply, and companies like Utimaco and Pointsec make much of their management tools. The thing is to make a policy and translate that into the workings of the chosen tools and, as with most security issues, the policy takes a lot more work than the technology. "Our consultancy to the customer is mostly based on best practice, not how to use the product." Policy issues include preventing devices being synchronised with non-authorised computers, preventing smartphones working with other SIM chips and stopping non-company applications being launched. Securing access to corporate applications has become easier, even across mobile devices, with the rise of VPNs. Traditional VPNs require a client to run on the device, but the SSL VPNs now in vogue allow standard web browsers (including those built into mobile devices) to connect to corporate applications using their built in SSL encryption. Neoteris, a hardware-based SSL VPN supplier has a version designed to work with the small screens of Pocket PC and Symbian devices. The cost of securing a fleet of PDAs needn't be excessive, although they become proportionately higher the smaller the number secured. For 1000 laptops, the cost of Utimaco's Safegaurd would be £73 per machine, for 1000 PDAs, it would be £35 per machine, says Groves. However, the ongoing administrative cost should also be factored in. Requiring heavier password use creates a burden on the support desk, although Groves says this needn't be too severe. Single sign-on means that users have fewer passwords to remember. However, enforcing a regime where passwords must be changed regularly, will inevitably mean more "I forgot my password" calls to the helpdesk. The IT manager has to determine how the helpdesk will positively identify an employee when he or she phones up, and make these rules clear, Also, staggering the day on which people have to change their password is a good idea, as it prevents a big spike of helpdesk calls, when they instantly forget the new password. "Don't heap a load more work on the helpdesk," says Groves. Conclusion: do it now
Mobile devices themselves are more of a risk than the wireless networks they use to communicate. There are many things IT managers can do to ensure such devices are not a corporate risk. The fundamental issue is to make sure that laptops and PDAs are within the control of the IT department. This is a serious task, but is made easier by the fact that packages exist to do much of the work and the IT manager holds the keys to corporate access. Securing mobile devices is a job that can - and must - be done.