A mobile device strategy is unavoidable in today’s financial services sector. Despite the best efforts of Chief Information Officers and IT Directors, employees will revolt if they are unable to use mobile devices and access corporate information when they are not in the office. Coupled with the loss of productivity, an enterprise mobile strategy is inevitable. Whether you implement BYOD or a company owned mobile device strategy is largely irrelevant. Either way, you must ensure that company data is as safe and secure as possible when it is being accessed via a mobile device.
Mobile security is not an added extra, it is an integral part of your overall cybersecurity strategy, architecture and governance structure. So how do you ensure your mobile workers are not compromising your firm’s security strategy?
Firstly, make sure your house is in order. Ensure that your enterprise wireless LAN and enterprise Ethernet networks are secure. Use strong encryption and multi-factor authentication where possible. Biometric security such as fingerprint scanners and token-based authentication is very effective. Utilize a VPN and segregate data access using VLANs to ensure that users only access the data they need in their specific role. Next generation firewalls will keep out unwanted connections and continuous monitoring and reviews of server and firewall logs will identify unusual activity. Regular penetration testing will provide assurance that your network security is fit for purpose.
The next step is to implement a robust Mobile Device Management solution, which allows you to manage all mobile devices on the network. Usually with a simple enrollment process, mobile devices can be authenticated and the appropriate apps and content can be dynamically pushed to the device. With a robust MDM solution, devices can be remotely controlled in the event of loss or theft, so that access to corporate networks is disabled. A central management console will allow you to identify and block unapproved devices from entering the corporate network.
A comprehensive Mobile Device Management solution will incorporate multi-layered endpoint security functionality that includes anti-malware, packer variant protection, encryption, device control, data loss prevention, vulnerability shielding, command and control blocking, browser exploit protection, application whitelisting, behavior monitoring and web threat protection.
Finally, and this is a regular topic of discussion between RFA and our clients, users create a real threat to cybersecurity, and especially mobile security. In addition to the multi-layered software security solutions that the company can implement, it is key that you implement a solid mobile device security policy and educate users on the best ways of keeping their devices secure.
My top tips for employees include only connecting to trusted networks, using strong passwords on all mobile devices, storing minimal information on the actual machine, using secure enterprise cloud storage or accessing the corporate network via VPN.
Only by including mobile device security as standard in your cybersecurity planning and policies can you ensure that you have covered all bases.