Security Experts:

Connect with us

Hi, what are you looking for?


Mobile & Wireless

Network Security Planning: Steps for Safely Enabling Mobile Devices

Safely Enabling Mobile Devices – Planning for Network Security Part 3

Safely Enabling Mobile Devices – Planning for Network Security Part 3

The topic of mobile security (and BYOD) is probably one of the most divisive security topics, and at the same time, one of the most critical challenges security organizations face worldwide. Why? According to IDC and Gartner data (PDF) on mobile devices, annual revenue generated by smartphones and tablets sales have exceeded those of PCs by 4x. Mobile device use cases are vast, and the conditions for securing devices on a user or enterprise basis can be so diverse that architecting the right enterprise mobile security solution can be very challenging.

Organizations have explored various options, none of them ideal. Very security-conscious organizations have chosen to block all mobile devices. While this may be an acceptable option for some employees, others will find a way to use mobile devices despite such policies. In addition, it prevents the organization from tapping into mobile productivity benefits that could improve revenue.

Enterprise Mobile Security StrategyOther organizations have attempted to address mobile security challenges by extending the same products and technologies used to secure laptops like IPS, anti-malware and VPN to mobile devices. This approach has its limitations as existing security technologies may not provide coverage for mobile threats, and are not suitable to run on mobile devices with limited computing power and battery life. The ephemeral quality of VPN also means that when a user disconnects, they will not be subject to network security controls and therefore may inadvertently be downloading malware or sharing files inappropriately.

Requirements for Securing Mobile Devices

So, what are the right requirements for securing mobile traffic? Three critical elements are:

Managing the device – the challenge with mobile devices is there are so many different settings and knobs to personalize that it can be easy for a user to put it in a state that is ripe for compromise. Therefore, in order to secure a mobile device, you need to first start by managing it. But, think of it less as the typical MDM device onboarding or asset management but from a security angle. The information about the state of the device could be used in making decisions to protect the device and control the data. For example, a device that has malware can be blocked from accessing corporate data.

Protecting the device – In his article in Network World on VMware’s acquisition of Airwatch, Zeus Kerrala correctly pointed out that it is impossible to remove security threats solely by managing mobile devices. We also established earlier in this article that protection of the device cannot be done at the endpoint. Therefore, protection of the device needs to occur on a network device that sees all mobile traffic and can implement protection against a spectrum of threats, including exploits and new, unknown forms of malware. Protection of the device must include an always-on secure IPSec and SSL VPN connectivity to ensure that protection of the device extends to insecure locations like hotel WiFI or public hotspots.

Controlling the data – The network is also the right place for IT to see all mobile traffic and enforce control between applications and mobile users, and that’s true regardless of what device is being used. Controlling the data means establishing access to corporate applications and data associated with them, in addition to controlling data that may traverse laterally between applications on the same mobile device. Even with BYOD use cases, the organization can’t control what users do with their own devices, but they can control access to applications once the users touch the network.

These requirements need to be evaluated as a solution or system, because each of these requirements are interdependent on each other, and must operate as a comprehensive framework. For example, when a new form of mobile malware is discovered (protect the device), the endpoint may be wiped (manage the device), or access limited (control the data).

Planning for Mobile Security in 2014

So how do you start planning for mobile security in 2014?

Here’s a 3-step plan:

Start with your objectives – Identify what your goals are, which includes identifying the types of mobile devices you will support on your network and the types of critical applications and data that can be accessed from mobile devices. You need to find the right balance to deliver a mobile security environment that meets productivity and flexibility needs without putting your devices, apps, or data at risk. Consider the following:

> Will BYOD be part of your mobile security strategy? Does it make sense to support BYOD as part of your mobile security strategy, or do you limit access for users on BYOD devices?

> Regulatory and industry concerns – How do your regulatory compliance requirements apply to mobile devices and data on it?

Building your infrastructure – Your mobile security strategy should focus on vendor solutions that can deliver the requirements above in a comprehensive, integrated solution. Take your time to look at mobile security with a completely different perspective from traditional remote access or traditional MDM solutions. Instead the focus should be on vendors that already have a strong security and threats focus, and have an understanding of how to implement the right safe enablement policies.

Institute mobile device policies and standards – Finally, develop mobile device policies and standards for your organization, making sure to institute them hand-in-hand with an education and training program for end-users.

This article is the third piece in a series on Network Security Planning for 2014. You can read Part 1 here and Part 2 on implementing a Zero Trust Network here

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Network Security

Attack surface management is nothing short of a complete methodology for providing effective cybersecurity. It doesn’t seek to protect everything, but concentrates on areas...

Cybersecurity Funding

Network security provider Corsa Security last week announced that it has raised $10 million from Roadmap Capital. To date, the company has raised $50...

Network Security

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud,...