Category: BYOD

Warning: This story may seem eerily familiar but is still terrifying to IT security and BYOD users nevertheless. Reader discretion is advised:

A recent survey of over 1,000 employees by email data protection firm ZixCorp produces some important takeaways that organizations would be remiss to ignore if they want a BYOD program that employees can actually get behind. 71 per cent of the employees surveyed said they would avoid using their personal phone out of concern it could be completely wiped should they lose their phone or leave their company. 20 per cent of respondents also admitted that they would wait a few days or longer to report a missing device out of fear of getting their device wiped.

There are several very important reasons why your company should wipe out remote wiping from its lexicon, but one reason is very simple: You don’t have to do it if you’re not saving corporate data on personal devices. While Mobile Device Management (MDM) and most mobile security solutions are still founded upon an approach that necessitates securing data already saved on the device, Virtual Mobile Infrastructure (VMI) runs a mobile operating system compatible with all Android and Apple devices, and instead stores all of the apps, files and data on a secured and remote cloud. You can access and work on all of these applications thanks to a remote display protocol which transfers them onto your phone as a flat display. This lets your employees check and respond to emails, access network files and use enterprise apps without saving any of the information on their device.

If there’s no data on the device to protect, there’s no need to remote wipe your employees’ phones and suffer the significant negative ramifications this causes.

The survey results spell out a very important fact that organizations should take heed of sooner rather than later: Remote wiping isn’t just a headache or employee concern – it’s a significant obstacle to implementing a successful BYOD policy for pretty much everyone involved.

Here are three main reasons remote wiping is a barrier to a successful BYOD program, and how using VMI technology can render these issues a moot point:

1) Remote Wiping is actually a security risk

It may seem strange to think of a security procedure as a security risk, but security measures are only effective when they earn the approval and loyalty of the people they govern. If one out of every five of your employees decided to ignore your BYOD policy and chooses not to report their missing device for a few days, a week or even longer, than that puts the corporate data sitting on that phone at risk. During this window of time, critical information can be stolen and used against your company’s best interests. A VMI solution means zero data is stored on the device. Ever. This means your employees are much more likely to immediately report lost devices. It also makes managing devices simple and stress-free for IT, which can easily disconnect the device’s access to the cloud.

2) Remote wiping is a burden to your IT security department

Mobile phones go absolutely anywhere and everywhere their owners go, and are therefore misused, lost or stolen more frequently than any other device. This adds an unnecessary demand on your security team’s time and resources to remote wipe compromised devices. VMI literally wipes away the hassle of remote wiping and let’s your IT team focus on projects that add value to your organization.

3) Remote wiping personal devices is a lose-lose BYOD solution for both management and employees

Your BYOD policy isn’t worth the paper it’s written on if it alienates your employees to the degree that they would avoid reporting missing devices, or even worse, avoid using their smartphones to access work resources. Your BYOD program is supposed to encourage participation and facilitate productivity, not deter it. The survey also indicated that employees were very concerned about their privacy, mainly giving their employer access to their personal information and control of all or part of their device.

Forward-thinking organizations should look beyond immediate security threats and short-term responses and visualize the bigger picture heading into the future, where user dependence on mobile technology is only going to increase. A successful BYOD policy needs to be designed in a way that not only secures your data, but enhances your corporate brand and reputation. Using a solution like VMI which removes the substantial threat caused by storing corporate data on personal phones, not only gives IT more security and peace of mind. It also removes the most important fears and concerns holding your employees back from embracing your BYOD program. This will empower them to take advantage of the core strategic benefits BYOD was meant to provide and increase productivity. Their support and loyalty will also boost your company’s credibility and raise its reputation that much more.

If you thought Heartbleed was the queen bee of all security bugs, then you’re in for quite the “Shell Shock”. Late last week, it was discovered that the security vulnerability Shellshock can be made wormable and grant hackers the ability to run arbitrary codes on Bash, the most widely-used command processor which serves as the default shell for Unix, Linux and Mac OS X, and is also ported to run and automate tasks on Microsoft Windows and Android operating systems.

CGI scripts, which have been attacked the most so far by this bug, and are being exploited to send malicious commands to servers. If you’re actually still running these scripts within your organization, then this bug essentially could give attackers access to your entire operating system.

If you consider the fact that network services are most prone to these threats then it’s especially critical to grasp the vast reach and impact Shellshock poses to enterprise mobility and BYOD programs.Therefore the ensuing panic in the cyber and enterprise communities is no shock at all.

Why? Because in typical BYOD program, users access various corporate network resources via multiple applications, each of which transfer data from employee owned devices to the desired network service. Multiple apps equal multiple network services, which leaves more pathways vulnerable to attackers.

You may have thought that you need not protect your internal network resources and only need to patch internet resources. But in BYOD programs each user’s device has access to those endless corporate services. In this particularly weak link in security, hackers can easily exploit your organization’s network services by planting Trojans and worms. You need to carefully secure and patch each network resource. If some of your systems are Legacy systems then you’re even more vulnerable as such systems are even harder to apply patches.

The writing is on the security wall, and it’s important to heed the wake up call: Giving hackers a foothold on your apps and network services which are connected to your employees’ personal devices means that Shellshock quite realistically is the largest security vulnerability ever faced by BYOD. And like Heartbleed, it isn’t the first nor will it be the last major security bug to threaten your corporate network resources.

You can say that your BYOD devices are protected by MDM and it also protects your network with VPN connections. But in truth this isn’t nearly sufficient enough.

It’s precisely the BYOD devices which are the weakest link in your corporate security, and can be easily hacked and allow such attackers access to your corporate VPN connection and to a large number of unprotected internal network services.

For security infrastructures that store their apps directly on devices, Shellshock could be the security nightmare they’ve always dreaded and potentially take years to eradicate. Fortunately, the solution to this problem – Virtual Mobile Infrastructure (VMI) – already exists. VMI is the silver bullet to precisely such a threat because there is no direct link from devices to network services. This relatively new framework virtualizes a mobile platform remotely as a display onto devices, leaving all apps and data on a remote server. This makes just one secured protocol necessary to transfer back to the data center, instead of the multiple pathways required by all other security infrastructures to service each and every app added to the device. One protocol means security teams can effectively focus on securing just one network service, making the Shellshock ordeal much more manageable, and much less terrifying. Nubo Software was the first to introduce VMI to the security industry worldwide, and its mobile platform can enable app-based firewalls from virtual devices, which permits only specific selected apps to access network services.

Looking ahead, it seems like a foregone conclusion that major security threats like Heartbleed and Shellshock are going to surface again and again, which makes it that much more imperative that organizations in our BYOD generation are proactive in setting up the infrastructure that can best solve these vulnerabilities now and into the future. VMI gives organizations the safe and remote platform to do just that.

Look around in today’s emerging mobile generation and you’ll notice a new consumer app for business sprouting up every which way you turn. While the tsunami of business-related consumer apps flooding the market can feel exciting and liberating to employees, the impact of this demand on many current security solutions could have anxiety-ridden IT personnel worldwide scampering to their nearest therapist for sympathy and compassion. That’s because mobile phones are considered the weakest link for data security as additional protocols must be added for each app, creating multiple entry points for potential attackers. Personal phones often connect with unsecured WiFi networks, which makes the information they house that much more vulnerable. Until recently, most mobile security solutions such as MDM/MAM use secured containers – but this is far from a sure-fire way to guarantee that data cannot be accessed and breached. Data can be attacked from various angles by either breaking the encryption layer or locating the encrypted keys. Having it encrypted and decrypted within the device means that by design the keys must also reside there.

As the market for apps grows then so does the perceived burden on security. But if today’s BYOD culture means more employees will be accessing corporate data on their personal devices, why store the data there to begin with? This is why Virtualized Mobile Infrastructure (VMI) technology has been designed to leave zero data on personal devices.

With this new approach, Enterprise IT can plan for the future and sustain the demand for mobile apps in ways that haven’t been possible until now. With VMI, all apps and data are stored on a remote platform that works with both Android and iOS systems, unlike Virtualized Desktop Infrastructure (VDI), which depended on a Windows platform, and doesn’t translate well with mobile. The data is reflected from a cloud onto the device as flat image that cannot be analyzed nor captured. This renders many common mobile security issues, such as lost devices, a moot point. With no digital footprint on the device itself, IT can simply disconnect access from the cloud and rest easy knowing it owns all of the data.

By employing a VMI strategy that also preserves the native app experience for users, security teams gain an unprecedented level of peace of mind. Meanwhile, employees can enjoy the flexibility and freedom to choose from the wide world of apps. The sheer selection of mobile apps available seems to be increasing exponentially which can be a lot to absorb. But selecting useful apps for business can dramatically aid collaboration and organization and save both companies and their staff valuable time and money, all benefits that BYOD was meant to deliver, so the earlier you take the plunge the better.

In Part II of Wild World of Mobile, we’ll guide you through consumer apps that have been proven to save time, improve workflow and enhance the quality of engagement for employees and their clients.