Protect Mobile Devices, Protect Your Network

February 2, 2012 - 0 Comments

Reduce the risk of compromised company data by securing users’ smartphones

Once upon a time, a mobile phone was just a phone—you made and received calls on it, and that’s all. It posed zero risk to the security of your network or your business. Now, a mobile phone is so much more than just a phone. It’s a personal assistant, a portable game player, a digital camera, and most importantly, a full-fledged computer—and these smartphones definitely pose a security risk. Just like a laptop, smartphones, tablets, and other mobile devices can connect to your network, which means they could compromise your company’s data or leave your network vulnerable to attack from a hacker. You wouldn’t leave employees’ laptops unsecured, so why would you take chances with their mobile devices?

For the most part, the same security measures you ascribe to the computers on your network in the office should also be applied to mobile devices that have access to your LAN. Just like desktop PCs and laptops, all mobile devices need software protection to guard against malware and other attacks. Smartphones and tablets should have a firewall as well as antispam and antivirus software installed, such as the Cisco AnyConnect Secure Mobility Solution and Norton Smartphone Security offering.

Look for a mobile security product that also provides safe web browsing, such as Lookout Mobile Security, which offers a free, basic version for iPhones and Android devices. With safe web browsing, each URL a user clicks on is checked for malware and phishing scams. Also, as with laptops and desktop computers, employees’ mobile devices should also be locked down with strong passwords.

Special to smartphones

In some ways, a smartphone is even more than a laptop, and there are a few risks inherent to carrying one: Smartphones are easier to steal than laptops, extremely easy to lose, and can connect to public hotspots without the user knowing it.

Because a smartphone is so easily stolen or lost—left in a taxi, forgotten at the gym, or dropped out of a purse—it needs to be protected from prying eyes. A passcode is important, but a four-digit code isn’t too difficult for a skilled hacker to bypass. So, any mobile security solution you choose should also include a remote self-destruct feature that lets a user wipe the data from the smartphone if it gets lost. Less drastic is a locate function, which allows users to use a different computer to find his or her lost smartphone by displaying it on a map.

Also, smartphones often connect to local Wi-Fi networks automatically and unbeknownst to the user. If employees are connecting to the Internet using their mobile devices, they could also be connecting to your company network and giving hackers accidental access to business resources and data. Ask your employees to keep Wi-Fi turned off and connect to hotspots intentionally and only if they believe them to be secure. Also be mindful of automatic Bluetooth connections that could compromise the mobile device.

Best practices for mobile security

Guarding against malware and other attacks isn’t a sure thing, but these best practices make it easier. If your employees want to use their personal smartphones to connect to your small company’s network, make the following suggestions a condition for access.

Every smartphone must:

  • Automatically lock to the login screen after a couple of minutes of being idle
  • Be configured to use a PIN or passcode for access
  • Connect to Wi-Fi hotspots manually
  • Have a mobile security suite installed

Security for all mobile devices should be one part of your overall security policy, and it should dovetail with the requirements you’ve established for laptops. Even if users don’t consider their smartphones to be computers, you should. After all, these remarkable devices can give hackers easy access to your network and all of its resources with just a few swipes of an evil finger.

Have you established security requirements for employees using their personal mobile devices to access the company network?

In an effort to keep conversations fresh, Cisco Blogs closes comments after 60 days. Please visit the Cisco Blogs hub page for the latest content.