TMCnews Featured Article

April 09, 2013

Even the U.S. Military Needs MDM

By Susan J. Campbell, TMCnet Contributing Editor

News channels across the Internet provide viable reasons and sources as to why BYOD (Bring Your Own Device) offers both opportunities and risks. Mobile device users often read and chat about the importance of securing their device, but how many actually do it? The worst way to find out is when you experience a data breach like the military just has.

According to this MSP Mentor report, most mobile users ignore IT professional advice when it comes to locking down a device. When the device is used to access the corporate network, however, such advice cannot be ignored. This higher standard is also true for those in the U.S. military. Higher standards must exist for these users when it comes to BYOD and mobile device management (MDM).

The problem when it comes to the U.S. military is that higher standards often do not exist. Beth Jones, the Senior Threat Researcher for Sophos recently focused on this trend in her Naked Security blog. She outlined the vulnerabilities that exist for the military and its implementation of mobile devices and mobile device management. Perhaps the most alarming reality is that data and mobile devices were not protected by MDM software

.At the same time, the U.S. Department of Defense does not have the ability to wipe devices remotely – a major problem if a device should fall into the wrong hands. The individual in charge of technology for the military – the CIO – was unaware of 14,000 devices that exist and are in use throughout the army. Plus, users do not receive training and are not required to sign user agreements. This brings us to the most alarming finding, which is that users are allowed to save sensitive data on removable media.

BYOD introduces a number of security ramifications for users. The shortcomings in the U.S. military approach to MDM highlight just how widespread the problem is. It’s no surprise, then, that small to medium sized businesses are also struggling to protect users, data, devices and the network. As data continues to become more mobile, it’s critical that all organizations put policies in place to ensure its security.

Jones recommends a seven-step plan to ensure BYOD security. The plan starts with identifying the elements of risk introduced by BYOD. This risk must then be measured according to the impact on the business and then mapped to regulations.

Organization should then form a committee to lead the charge on embracing BYOD and understanding the associated risks. This committee should include IT stakeholders, business stakeholders and information security stakeholders. Policies should then be developed and enforced on all devices connecting to the network.

After, a project plan can be developed, which will include application control, remote mobile device management, data and device encryption, policy compliance and audit report, the augmentation of cloud storage security, the revoking of devices when the end user changes, the wiping of devices when retired and the revoking of access to devices when an employee is terminated.

All solutions involved in the process should be considered according to the impact on the existing network. A pilot program should be developed from each stakeholder department and then extended to departments according to the organizational criteria. At that point, the BYOD program can be opened to all employees.

Once the BYOD program is well underway with MDM firmly in place, it’s important that solutions are reassessed periodically to ensure performance is meeting expectations and all data is protected.

Edited by Ashley Caputo

TMCnet's Online Communities™

TMCnet Magazines

TMCnet Events

TMCnet's Technology Sites

Browse News by Topics

TMCnet BLOGGERS

TMCnet Resources

About TMCnet

Subscriptions

Follow Us Your Way

CHANNEL BY TOPICS

QUICK LINKS

TMCnews

TMCnews Featured Article

Even the U.S. Military Needs MDM

Technology Marketing Corporation

IMPORTANT

SUBSCRIPTIONS

STAY CURRENT YOUR WAY