Social Media Center

This week, Juniper Research estimated that the number of employee-owned smartphones and tablets used at work is set to reach 350 million by 2014, up from 150 million in 2012. With new smartphones and tablets inundating companies worldwide, IT security teams are struggling to determine acceptable use policies. It goes beyond corporate BlackBerries and laptops to the newest BYOD (like iPads, iPhones, etc).

To help teams manage the mobile influx, we just released a new five-part Websense Mobile Acceptable Use Policy Kit. It provides a guide to help your company embrace mobile devices, communicate with employees, and keep confidential data secure. You can confidently use this guide to help you get started on your company’s acceptable use policy or to supplement your existing mobile device acceptable use policy.

Did you know that 90 percent of all companies experienced some type of data breach within the last year? And that 64 percent happened while employees were outside of the corporate headquarters? We predict it will only get worse as more people use mobile devices and tablets.

Join me this Wednesday, July 11 at 3 p.m. ET/12 Noon PT to discuss...

“Both the bring-your-own-device phenomenon, whereby workers opt to use their own gear for work, and company-provided mobile work tools offer opportunities for data leakage,” said Fiaaz Walji, Canadian country manager for Websense. “When you add the fact that these mobile devices have cloud-based applications, free access to social sites, and a lot of them carry sensitive data on them, the security risk has just skyrocketed.”

http://www.cbc.ca/news/business/story/2012/03/19/technology-data-loss-mobile-devices.html

TORONTO—March 19, 2012— A new “Global Study on Mobility Risks” reveals that corporate mobile devices and the bring-your-own-device (BYOD) phenomenon are rapidly circumventing enterprise security and policies in Canada. Seventy-one percent of more than 400 respondents in Canada agree that the use of mobile devices in the workplace is important to achieving business objectives. But 72 percent also believe that these devices put their organizations at risk—and only half the organizations surveyed have the necessary security controls to address the risk...

“We’ve seen the Android platform become the preferred platforms of attack, because it’s open source, it has more malware – 252 versions at last count,” Fiaaz Walji, Canadian country manager for Websense said. “Apple iOS is a little bit safer, partially because of the vetting process Apple does on its end. Regardless of platform, companies have to secure these devices. Restricting them is not an option. ”

http://infoexecutive.itincanada.ca/index.php?id=16426&cid=394

I’ve been to countless RSA Conferences. Two years ago it was about who survived. Last year was cloud hype. This year: mobile security.

In our booth, I demonstrated our new mobile security solution on an iPad non-stop. To the point of shoulder pain and post-show massage therapy after holding that thing up for hours and hundreds of demos to eager onlookers. The interest in mobile security is very real.

So how big is the problem?

We had the Ponemon Institute survey more than 4,000 IT professionals in 12 countries. It is clear from the answers that corporate mobile devices and the bring-your-own-device (BYOD) phenomenon are absolutely circumventing enterprise security and policies. Fifty-nine percent report that employees circumvent or disengage security features like passwords and key locks. A lost device with no password is an open door to email, calendars, social circles, and apps that access confidential information. And just over half experienced data loss because of unsecured mobile devices, including laptops, smartphones, USB devices, and tablets. The problem is big.

Most IT pros know that by enabling a mobile workforce they are supporting business productivity, but they also recognize the risk. Check out the full results of the survey here.

I can’t say this often enough: standard mobile device management (MDM) isn’t enough. You really need to look at the new Websense TRITON Mobile Security solution that we announced the RSA Conference. It combines four components (web security, data security, mobile malware / app protection, and mobile device management features). As a cloud security service, it prevents confidential data loss on iPads, iPhones, Android, and other mobile devices.

Feel free to comment and let me know what you think.

“Security keepers at Websense believe that these new devices are entering the workplace faster than enterprise IT pros can rule them out as potential threats to corporate security. The iPad and iPhone cleared the way here. ‘It really became an avalanche after that,’ Websense CSO Jason Clark tells Fast Company. In response, Websense thinks it's developed a gateway system for this BYOD age.”

http://www.fastcompany.com/1820962/enterprise-mobile-security?partner=rss

“The [bring-your-own-device] BYOD phenomenon is rapidly circumventing security policies,” said Jason Clark, CSO of Websense. “It’s difficult to enforce security policies on something you do not control.”

“Clark said many organizations are trying to take the technologies and security concepts for laptops and desktops at the endpoint and apply them to smartphones and tablets. ‘These are concepts that everyone has been educated on [for protecting] things and they’re trying to apply it over to something that is completely different,’ he said.”

http://searchsecurity.techtarget.com/news/2240118659/CISOs-fear-lack-of-mobile-device-control-visibility-survey-finds

When we were looking at putting out our Websense Security Labs predictions for 2012, we knew that mobile threats were going to be big this year. While we included one prediction on it, there was one piece that I had thought of, but didn’t include. It’s still a ways away, but Paul Henry has an excellent write up on “QR Codes – Leading Lambs To the Slaughter.”

He correctly points out that these “ultimate url-obfuscators” can be a serious threat down the line.

It’s a good reminder that any applications on workforce mobile devices need to be properly sandboxed from the operating system. We’ve already noted in Websense Security Labs research that there are challenges with certain platforms and there are a number of mobile malware variants, including Trojans on handhelds.

It’s interesting to think QR codes as threats continue to evolve in the mobile landscape. What’s funny is as I was writing this, our Security Labs researches discovered QR codes being used a new way – through a spam campaign. 

What do you think about QR codes?

Today, in a Reuters article, Websense® Senior Security Research Manager Patrik Runald discusses how hackers have revealed a bug in Apple iOS software. The security flaw was discovered today when a popular jailbreaking site (www.jailbreakme.com) released a code for Apple customers to modify their device’s operating system.

In the article, Runald warns that this code could be a major security downfall: cybercriminals could easily download the code, reverse engineer it to find a hole in iOS security and then quickly build malware in a matter of days. The creator of the jail-breaking code, Comex, agrees that the code would not be difficult to reverse engineer.

"If you are a malicious attacker, it is fairly doable.” –Patrik Runald, Senior Security Research Manager

Apple’s iOS software runs on the millions of iPhones, iPads, and iPod Touches sold around the world – any security flaw to iOS holds the potential to create some major damage. Reuters quotes Runald warning that once the device is infected, hackers could do anything they want, including stealing passwords, documents and emails.

Reuters reports that Apple is currently developing a software update to circumvent any potential threats.

In the meantime, learn how to protect your organization from mobile security threats here.

Read a Websense Security Labs™ report on a past jailbreak-related security threat here.