Organizations can improve mobile device security through BYOD agreements with users to ensure they take security precautions. The checklist should include installing available upgrades and patches; ensuring that each mobile device infrastructure component has its clock synced to a common time source; reconfiguring access control features as needed, according to the Computer Security Division of the National Institute of Standards and Technology.
IS teams should also periodically perform assessments to confirm that their mobile device policies, processes, and procedures are being followed properly. Assessment activities may be passive, such as reviewing logs, or active, such as performing vulnerability scans and penetration testing.
4. Define a firmwide security strategy
Nine out of 10 big companies lacked defined security strategy and security plans, or theyre not tied with business goals and business objectives, said Kristine Briggs, vice president of corporate operations at Neohapsis.
"There's no way to know if you're supporting business objectives unless you take the time to develop the security strategy and make they're sure they're doing the most important things for overall risk reduction.
"Some of what we found would shock most people," said Briggs. "We even find that in entirely regulated industries." At one "very large" and highly regulated company, a critical platform was supporting the majority of revenue for one of its internal customers, yet it didnt have a defined security strategy or plan.
"Although they had massive goals for revenue growth for the use of that platform, they weren't taking into account the end customers compliance requirements, but customers assumed they had this covered," Briggs says. "They had no plan to map to the technology infrastructure or to the business growth that's planned. That could bite them very easily" if the platform is breached or crashes.
The strategy and plan don't require outside expenses, and when complete will reduce the overall cost of running the environment "because you're doing things in a planned and repetitive way that improves security and reduces risk. If you get the right people in the room for a half-day session, you should have it 80 percent done," she said. Those people should represent both the business and technology sides, as well as any other stakeholders. "Most people do a one-year plan, and should answer the questions: What are the company's business objectives? What risks are associated with those objectives? For instance, is the business highly regulated or do they perform financial transactions? What type of data resides in the IT environment? What technologies are already available to protect the data? And what does the budget allow for new technologies?
5. Educate Employees
Successful attacks are usually ones that exploit the human mind.
Sign up for CIO Asia eNewsletters.