Top 10 Tips for Securing Your Mobile Devices and Sensitive Client Data
Keith Daniels | March 08, 2018
One thing’s certain: BYOD looks set to continue with its exponential growth in popularity in 2018.
Research conducted by Markets and Markets predicts that the adoption rate of BYOD policies among North American businesses will reach 50% by the end of 2017. A 2017 study by Cisco is in a similar vein, finding that 69% of IT decision makers were in favour of BYOD. What’s more, according to Markets and Markets, the BYOD & Enterprise Mobility Market will be worth an eye-watering $73.30 Billion USD by 2021.
Once the preserve of office-based jobs, BYOD has begun to creep into industries as diverse as healthcare, education and manufacturing. BYOD is incredibly flexible by its nature, and, any workplace that uses devices such as laptops, smartphones or tablets could potentially benefit from its adoption.
Many industries, such as manufacturing, are realizing that if they want to attract the talent of today and tomorrow, their IT policies need to change to suit the tech-savvy outlook of millennials. As CIO put it, “If you hope to attract GenY technology professionals, your IT strategy better include a bring-your-own-device plan that plays to the strengths of this tech-dependent generation”.
Millennials are predicted to make up 75% of the global workforce by 2025, and with baby boomers retiring at a rate of 10,000 per day, the trend of catering to generation Y’s working practices is only likely to increase. This means more sectors embracing remote working, Bring Your Own Internetpolicies (BYOI), and BYOD. https://www.casstelecom.com/blog/top-byod-trends-for-2018
BYOD is already a global phenomenon to some extent, being well established in the US and Europe, but 2018 could well be the year that it spreads beyond early-adopters in APAC and LATAM countries. The Asia-Pacific BYOD market is expected to expand to $66.84 billion by 2019, more than quadrupling in size from $13.54 billion in 2013. Meanwhile, in Latin America, the BYOD market is predicted to rise to $15.5 billion by 2019 - a growth of $11m since 2014. This rise in BYOD adoption is being driven by two things: multinationals extending their BYOD programmes to employees in emerging markets, and the proliferation, and growing demand for, connected technology for increasingly mobile workforces in Asia and Latin America.
BYOD policies have become a common fixture, particularly in larger organisations, and seem set to stay. Despite concerns about security breaches, governance issues, device management and a range of other possible complications, businesses’ perception seems to be that the benefits outweigh the potential issues. Indeed, a recent survey of BYOD trends revealed that adoption rates were at 36 percent at the beginning of 2017 and expected to rise to almost 50 percent by the start of 2018.
According to research, it is estimated that the average worker can save 81 minutes per week in productivity by using a personal device at work. Further, 78 percent of employees claim BYOD policies support an improved work-life balance. Adding the improved employee benefits to the company’s financial incentives, the same study reported the average employee on a BYOD plan saves the business around £1,000 every year in device and software maintenance costs. it’s easy to see why companies are keen to implement BYOD.
The current state of BYOD is a long way from perfect. However, new innovations in practice and technology are helping businesses to work towards a better way of working where employees can use their personal devices to boost productivity, minimize costs and minimize security risks. k
- World-wide, corporate fraud has hit an all-time high and pushed fraud numbers up with it. For the first time on record, data theft has now surpassed the stealing of physical assets. A little under 30 percent of businesses reported they had suffered information theft, loss or attack in 2017. Around 40 percent of executives reported their companies suffered a virus or worm attack, while the second-most frequently cited attack was email-based phishing.
- The news is consistent with a general trend that has been visible and growing since 2012, with 86 percent of firms worldwide reporting at least one cybercrime incident in the last 12 months, according to Kroll’s annual global fraud and risk survey. https://www-pymnts-com.cdn.ampproject.org/c/s/www.pymnts.com/news/security-and-risk/2018/corporate-fraud-hits-all-time-high-thanks-to-cybercrime/amp/
World-wide, corporate fraud has hit an all-time high and pushed fraud numbers up with it. For the first time on record, data theft has now surpassed the stealing of physical assets. A little under 30 percent of businesses reported they had suffered information theft, loss or attack in 2017. Around 40 percent of executives reported their companies suffered a virus or worm attack, while the second-most frequently cited attack was email-based phishing.
The news is consistent with a general trend that has been visible and growing since 2012, with 86 percent of firms worldwide reporting at least one cybercrime incident in the last 12 months, according to Kroll’s annual global fraud and risk survey.
Do you have employees who bring mobile phones to work and use those devices on the corporate network? Do they store company data on these “Bring Your Own Devices (BYOD)”?? Does your company have a policy in place for this?
First, the moment a person brings in their personal phone to work, there is a fusion of personal and business tasks that occur. And, equally as bad, company issued devices are used for personal use as much, if not more than the employees own devices. Not sure you believe this? Here are some stats:
A recent survey asked 2,000 office workers about their habit of using their personal mobile devices at work. https://www.webroot.com/us/en/about/press-room/releases/new-webroot-survey-reveals-company-and-employee-disconnect-on-byod-security-policies.
Here’s what it found:
- 73% of people admit to downloading personal apps to tablets they got from their company.
- 62% of people admit to downloading personal apps to mobile phones they got from their company.
- 45% of people admit to downloading personal apps to notebooks they got from their company.
- The people who were most likely to do this were in the 25 to 38-year-old age group.
- 90% of people use their personal mobile devices to conduct business for work.
The program also needs to meet the needs of employees, not just IT personnel’s preferences. Otherwise, they may evade the cumbersome safeguards put in place to protect the company’s data to be more productive and streamline their own user experience.
“BYOD: an emerging market trend in more ways than one,” a study from Ovum, sponsored by Logicalis, shows that 79 percent of employees in high-growth markets believe the constant connectivity associated with BYOD enables them to do their jobs better. However, these benefits to the enterprise may come with higher risk, as 17.7 percent of survey respondents who bring their own devices to work claim that their employer’s IT department has no idea about this behavior, and 28.4 percent of IT departments actively ignore BYOD behavior.
There are a variety of enterprise mobility management (EMM) solutions to help enable safer BYOD programs, including virtual environments, data classification, virtual container approaches, device integrity scanning solutions, stronger encryption or authentication programs, but enterprises need to bring multiple stakeholders to the table to confront the risks associated with user-owned device use.
Putting policies in place to manage BYOD risks is a global problem also, as shown in the Ovum study. Only 20.1 percent of companies surveyed had signed a policy governing BYOD behavior. U.S. companies are doing better than many in this field, but companies without BYOD strategies still outnumber those with signed policies.
According to the NIST report “Guidelines for Managing the Security of Mobile Devices in the Enterprise,” there are three common security objectives for mobile devices: confidentiality (ensuring that transmitted and stored data cannot be read by unauthorized parties), integrity (detecting intentional or unintentional changes to transmitted and stored data) and availability (ensuring that users can access resources using mobile devices whenever needed). BYOD programs support the latter, but the former two create hurdles to a successful BYOD program. https://www.securitymagazine.com/articles/87016-bring-your-own-risk-with-byod
As you can see, a lot of people are using their mobile devices on the job, and this could not only put your company data at risk, but also the data associated with your clients. Do you have a plan to minimize or even totally prevent how much sensitive company data is wide open to hackers?
Devices should have a hardware root of trust to protect the organization’s sensitive device, application and user private keys. Enterprises should have:
- A sound registration and provisioning process for employee-owned devices before access to enterprise resources is allowed;
- A mechanism for assessing the integrity of a device, especially detecting if the device has been compromised at the platform level, (e.g., rooted, jailbroken) which would defeat the built-in security protections that are provided by the platform manufacturers;
- A capability to isolate and protect the enterprise applications and data from the rest of the device environment;
- Enforcement of strong authentication mechanisms leveraging the hardware root of trust before the user can access enterprise applications and data from a personal device;
- Protection of the confidentiality and integrity of communications between the mobile device and enterprise services;
- The ability to know who, when, what, where and how the enterprise data and services are accessed; and
- The ability to remotely wipe the protected environment for a lost device or potentially locate the lost device.
Solutions to Keep Sensitive Business Information Safe
Owners, managers and every employee should always consider their personal devices as equal to any business device. You do not want your proprietary and sensitive company information out there, and this information is often contained on your personal mobile or laptop device.
Here are some things that you can do to keep this information safe:
Firstly, you and your employees need to know the risks about email. More than 14.5 billion emails laced with malware were sent in 2017 according to the annual Global Security Report by AppRiver.
Give Your Staff Information About Phishing Scams
Phishing is a method that cybercriminals use to steal data from companies. Studies show that it is extremely easy for even the smartest employees to fall for these tricks. Here’s how they work: a staff member gets an email with a sense of urgency. Inside the email is a link. The body of the email encourages the reader to click the link. When they do, they are taken to a website that either installs a virus onto the network or tricks the employee into giving out important company information.
In 2017, AppRiver observed a 1,000 percent increase in phishing efforts, including those tailored to gather user email login credentials, followed by an unparalleled spike in malware attacks launched from the compromised email accounts of users across all services, including Office 365, Gmail, Yahoo and AOL.
Phishing has become the cyber attacker's go-to option for identifying vulnerability in the corporate network. Depending on the attacker's goal, it can be quick and easy or it could be part of a sophisticated attack.
Inform Your Staff that the Bad Guys Might Pose as Someone They Know
Even if you tell your staff about phishing, they can still get tricked into clicking an email link. How? Because the bad guys make these emails really convincing. Hackers do their research, and they are often skilled in the principles of influence and the psychology of persuasion. So, they can easily create fake emails that look like they come from your CEO or a vendor, someone your staff trusts. With this in mind, it might be best to create a policy where employees are no longer allowed to click email links. Pick up the phone to confirm that whatever an email is requesting, that the person who sent it is legitimate.
Teach Employees that Freebies aren’t Always Goodies
A lot of hackers use the promise of something free to get clicks. Make sure your staff knows to never click on an email link promising a freebie of any kind.
Don’t Buy Apps from Third-Party Sources
Apps are quite popular, and there are many that can help to boost productivity in a business setting. However, Apple devices that are “jailbroken” or Android devices that are “rooted” are outside of the walled garden of their respective stores and susceptible to malicious viruses. Make sure your employees know that they should never buy an app from a third-party source. Only use the official Apple App Store or the Google Play Store.
Always Protect Devices
It’s also important that you advise your employees to keep their devices protected with a password. These devices are easy to steal since they are so small. If there is no password, there is nothing stopping a bad guy from getting into them and accessing all of the accounts that are currently logged into the device.
Install a Wipe Function on All Mobile Devices Used for Business
You should also require all employees to have a “wipe” function on their phones. Even if they are only doing something simple, like checking their work email on their personal mobile device, it could get into the wrong hands. With the “wipe” function, the entire phone can be cleared remotely. You should also require employees to use the setting that erases the phone after a set number of password attempts.
Require that All Mobile Devices on the Company Network Use Anti-Virus Software
It’s also important, especially in the case of Android devices, that all mobile devices on the network have some type of anti-virus software.
Do Not Allow Any Jailbroken Devices on Your Company’s Network
Jailbroken devices are much more vulnerable to viruses and other malware. So, never allow an employee with a jailbroken phone to connect to your network.
All Employees Should Activate Update Alerts
One of the easiest ways to keep mobile devices safe is to keep them updated. So, make sure that all employees have update alerts enabled, and make sure that they are updating their devices when prompted or automatically.
Teach Employees About the Dangers of Public Wi-Fi
Finally, make sure your staff knows the dangers of using public Wi-Fi. Public Wi-Fi connections are not secure, so when connected, your devices are pretty open. That means, if you are doing things that are sensitive, such as logging into company accounting records, a hacker can easily follow. Instead, urge employees to use a VPN. These services are inexpensive and they encrypt data so hackers can’t access it.
If an enterprise neglects to put proper mobile security policies in place, what sort of risks do they run? Can you give me an example of a likely scenario?
- Sensitive enterprise data, such as personally identifiable information and proprietary intellectual property, could be stored or transmitted without adequate protection, allowing the data to be leaked to third parties.
- Compromised devices and user credentials could be used as an entry point into an enterprise network or a pivot point within an enterprise as part of a larger attack seeking access to high-value enterprise assets.
- A device that is compromised and taken over by the attacker could be used to impersonate the user, get the user’s personal information, take over the user’s accounts via password reset mechanisms, monitor user activities on the device including location/voice/video, change critical data such as a bank account number during a financial transaction, attack other devices, destroy the personal data on the device such as photos/videos/address books, exhaust resources such as battery, or render the device and associated data unusable.
- The September/October 2019 issue of ITA PRO magazine is now available in digital format here:
- ITA Pro Magazine May/June 2019
- Spotlight on the 2019 IASA Conference
- ValueMomentum Selects Erie as Site of Regional Development Center
- Capgemini and Majesco Become Alliance Partners
- Electronic Chat with Dr. Dan Shoham
- Electronic Chat with Todd Greenbaum
- Martha Notaras: The “Outsider” with an Amazing Inside View
- ProSight Direct Offers “Effortless Insurance for Today’s Professional”
- Electronic Chat with Larissa Tosch
- Martha Notaras Will Join ITA LIVE 2019 as a Keynote Speaker
- Five Things to Consider When Evaluating Your Cyber Risk
- ITA Pro Magazine, January/February 2019
- Major Ransomware Attack Could Hit U.S. with $89B In Economic Damages
- ITA Announces 1st of Three Keynote Speakers at ITA LIVE 2019
- Electronic Chat with Jeroen Morrenhof
- Legacy Systems Are Dead. Really? Don't Count On It.
- Now Accepting Nominations for the 2019 ITA Bridge Awards
- It's time to register for ITA LIVE!
- Registration is Now Open for ITA LIVE 2019!
- What to Expect from a Digital Experience Platform Implementation
- ITA Pro Magazine September Edition is Now Available
- It's National IT Professionals Day
- Save the Date for ITA-LIVE 2019
- OneShield Software and UrbanStat Work Together to Improve Real-Time Analytics and Risk Decision-Making
- ITA LIVE 2019 - SAVE THE DATE!
- Insurance Technology Association Announces New Editor-in-Chief
- August 2018 Edition ITA Pro Magazine is Now Available
- Enterprise Architecture in an Agile World
- Top 10 Tips for Securing Your Mobile Devices and Sensitive Client Data
- Industry Insight: 4 Global Insurance Trends in Digital, Data, Content Services and Security
- Diving Deeper into Prioritizing Your Strategic Digital investments
- Why Content Rules
- How Mass Personalization Will Open the Small Business Benefits Market
- At Year End 2017, Will Your Organization Be Protected from Cyber Risks?
- Do Insurance Bots Dream of Mitigating Risk?
- Conditioned to Respond
- Managing & Mobilizing Insurance Data in a Connected World
- Race to the Finish Line
- New Tools, New Opportunities in Claims
- ITA LIVE: Reaching Insurance Industry Crossroads
- Advice to Insurance IT Leaders: Keep Your Eye on the Ball
- New Date, Venue for ITA LIVE 2017
- Guidewire Makes Major Push to Small and Midtier Market by Acquiring ISCS
- Insurance Disruption is Happening Right Now
- Insurity Adds Strategic Investment Partner, General Atlantic
- Beyond Transformation: The Convergence of Finance, Risk, and Actuarial Functions
- The Rapid Evolution of Consumer Protection Regulation
- Talent Hunt: Finding, Attracting, Retaining Top People
- Insurers Flexing Their Distribution Models
- Technology Driving Disruption in Insurance
- Fear of ‘Next Bubble’ Challenges Life, Annuity Carriers
- Technology Allows Commercial Lines Insurers to Stand Out
- Single Sign-on Viewed as Biggest Tech Challenge for Agencies
- ISCS Observes 20th Anniversary; Scurto Predicts Major Changes Ahead
- Policyholders and Their First Impressions
- Progressive Making Progress on the UBI Front
- High and Dry: Insurers Search for Disaster Recovery Plans
- Insurers Sign The (Un)Dotted Line
- Reflections of a Retired Insurance CIO
- Mobile Device Management Just One Answer to BYOD Issue
- Lessons from GEICO and Progressive on Winning the Critical Buying Stage
- You Are a Target for a Cyber Attack
- Web-based Systems are the Next Evolution in Claims Technology
- Gaining a “Wow” Experience from Web Users
- Time to Shift from Business/IT Alignment to Business/IT Alliance
- Healthcare Insurers Changing to Consumer Model
- Organization is the Key for Selecting Software Vendors
- Analysts Expound on the Needs of the Mid-tier Insurance Market
- Finding the Cure for Obamacare’s Website
- New Software Solutions Benefit Insurers on the Inside and Outside
- Products, Market Impede Investment in Systems for Life Insurers
- Combatting Cyber Threats: Predict, Prevent, Persist
- The Future of Telematics Heads Beyond Insurance
- The Shame in Cyber Security Lapses
- Building Policy Administration Systems for the Future
- Insurers Look Into The Eyes of Their Policyholders
- It’s a New Dawn for the ITA
INSURANCE IT NEWS
- AI-Powered Insurmi Secures Funding to Modernize How Insurers Engage Customers
- JAUNTIN’ Launches On-Demand Health Program for Gig Economy Workers
- Carpe Data Launches New Commercial Data-as-a-Service Platform
- First Broker-Led Investor Group and Accelerator Program Launches in Des Moines
- Branch Launches Bundled Home and Auto Insurance Products Using ClarionDoor Technology
- Ask Kodiak and Friends to Host Insurtech Boston on October 29
- SageSure Insurance Managers Reaches 10-Year Milestone
- As InsureTech Wave Matures, Insurers See Partners More Than Competitors, Says Novarica
The Email Chat is a regular feature of the ITA Pro magazine and website. We send a series of questions to an insurance IT leader in search of thought-provoking responses on important issues facing the insurance industry.
ITA LIVE 2020
ITA LIVE 2020 –SAVE THE DATE!
April 5th – 7th, 2020
The Diplomat Resort
Become a member today to receive updates – www.itapro.org/MR
BLOGS AND COLUMNS
Customer experience is an essential component of the transformational journey... READ MORE
Insurance companies can serve customers better when they have access to accurate data and use it to send personalized, relevant messages that deliver... READ MORE
You have surely heard it said that small businesses are the growth engine for America. Today, the phrase has a special ring to it for benefits... READ MORE
With stagnant growth and lingering low interest rates, the life insurance industry faces a challenging future... READ MORE
Finding insurance carriers willing to write commercial lines risks has always been a challenge for producers... READ MORE
As Guidewire Software prepares for the start of Connections, its 11th annual user conference that begins on Nov. 2, Brian Desmond, chief marketing... READ MORE