5 Ways to Keep Your Data Secure While Traveling to Interop NY

By Patrick Oliver Graf, General Manager, Americas of NCP engineering When people travel, securing their data is often the last thing on their minds. However, the fact is that mobile devices, and the data contained within them, are extremely vulnerable to security breaches. By connecting to Wi-Fi hotspots in-between flights at airports and working on potentially unsecure wireless connections in places such as coffee shops, travelers leave themselves and their sensitive data open to attacks. Fortunately, there are several effective methods that Interop attendees can use to keep their devices and data secure as they travel to the Big Apple. 1.       Employ Strong Passwords A 2012 study by Joseph Bonneau of Cambridge University showed that password-cracking software is so efficient that using a cracking dictionary based on the 1,000 most common passwords would crack 8 percent of users’ passwords. Because modern hackers use cracking dictionaries that are based on a specific language and common password combinations, having a long password by itself isn’t enough. To ensure that your password isn’t compromised, choose one that is at least eight characters long, with upper- and lower-case letters, numeric and special characters. Choose uncommon words that are unlikely to be included in cracking dictionaries. 2.       Avoid Unencrypted Connections Yes, connecting to that free coffee shop Wi-Fi is tempting. It costs nothing, it’s in a comfortable location, and as you look around, you see that other conference-goers are connected to it and working away. However, it’s important to remember that public connections often require no authentication or password to log into, meaning that they’re completely open for anyone to access them, including hackers....

Do You Plan to Use the Per App VPN Feature in iOS 7?

Despite the rise of the bring-your-own-device (BYOD) movement in recent years, Apple’s popular iPhone and iPad haven’t really been geared toward making the lives of enterprise IT administrators any easier. However, with several new business-centric features now included in the upcoming iOS 7 release, that could all be about to change. Apple is billing the new iPhone 5S as the “most secure mobile phone ever.” Whether that proves true or not remains to be seen, but so far, the iOS 7 updates are a bit more interesting. Chief among them is the new per app VPN feature. According to Apple’s website, “Apps can now be configured to automatically connect to VPN when they are launched. Per app VPN gives IT granular control over corporate network access. It ensures that data transmitted by managed apps travels through VPN — and that other data, like an employee’s personal Web browsing activity, does not.” With reports that 76 percent of enterprises are now formally supporting BYOD, IT administrators are sure to welcome such granular control. Not only does such a feature have the potential to improve data security, but it could also make company-wide app rollouts significantly easier and lighten the traffic load on corporate networks. But, perhaps the most important thing to remember is that enterprises cannot afford to become complacent when it comes to remote access policies and best practices. As mobile device manufacturers and application developers work to make their products more enterprise-friendly, they are ultimately designing them for convenient use by consumers. IT teams must remain vigilant when it comes to managing these devices and how they connect...

Developing a Comprehensive Remote Access Security Framework

As previously discussed, mobility and bring-your-own-device (BYOD) programs have become staples of today’s working world. As such, it is more important than ever to recognize that the overall integrity and security of IT networks is ultimately determined by the weakest links in the communication chain. Ironically, the weakest links tend to be the same mobile endpoints spurring the BYOD movement – laptops, tablets, smartphones, etc. There are several reasons why these mobile endpoints are particularly vulnerable, including: They lack many physical access control mechanisms They attract malware They are often used while connected to unsafe networks, such as public Wi-Fi hotspots or unsecured hotel networks Of course, if mobile endpoints are vulnerable, so too are the networks they access. Developing a comprehensive security framework that allows IT teams to assess and monitor these endpoints is a formidable challenge. In this series of posts, we’ll discuss why comprehensive remote access security is so important, and how it can be achieved.  To start, we’ll examine the current state of BYOD and how unsecure mobile devices accessing corporate networks jeopardize sensitive company data. The Current Situation Increasingly, people are conducting transactions on-the-go while connected to unsecured networks in airports, coffee shops, restaurants, etc. Even with a basic out-of-the-box VPN solution, users may be opening themselves and their corporate networks to severe security threats, including viruses, spyware or bot infections, and Advanced Persistent Threats (APTs). APTs are arguably the most damaging, due to their stealthy nature and narrow focus. They are usually designed and executed with a very specific target in mind, such as the pending sales agreements of financial institutions. (We’ll take...

The Need for Network Security in the Face of Android Vulnerabilities

We’ve given Android at lot of attention over the past year, and rightfully so. The operating system is, after all, the most widely used in the world. Yet, with each version and new feature that Google rolls out, the security of mobile devices with older Android releases falls farther down the priority ladder, and unfortunately for IT executives, this means their enterprises become more susceptible to potential attacks. Recognizing this, the Department of Homeland Security (DHS) and the FBI have issued a warning to police and fire departments, as well as emergency medical service providers that mobile devices with outdated Android versions pose a serious security risk to their organizations. ThreatPost reported that the warning came via an unclassified memo distributed to the aforementioned organizations back in July, though it was only recently made public. Citing unspecified industry statistics, the memo stated that 44 percent of Android users are currently running Gingerbread, which was originally released in 2011 and is now significantly less supported. Improvements have been implemented in more recent versions of the operating system, but Gingerbread has had quite a few security vulnerabilities, such as premium-rate SMS Trojans, rootkits and fake Google Play domains that attackers use to trick users into installing malicious applications. The obvious concern here is that employees that have not updated their personal mobile devices are exposing critical networks and sensitive information to unnecessary risk. The FBI and DHS have urged their employees to regularly update their smartphones and tablets and to only download applications from the official Google Play store. But will those precautions be enough? What happens when someone attempts to...

The Role of People-Centric Security Systems and Defense in Depth

Is it possible that IT administrators are actually doing too much to secure their corporate networks? Given the rate at which the enterprise security landscape changes, it almost seems like a rhetorical question at first. However, there’s growing concern that all of the remote access policies and procedures in place are doing more harm than good. In fact, at the recent Gartner Security and Risk Management Summit, Research Vice President Tom Scholtz went so far as to say that we have “lost the race in our attempt to throw controls at everything.” Could he be right? A recent ZDNet article makes a strong argument to back Scholtz’s claim. At its simplest, the problem with current controls is that they very rarely speak to individual users in a way that resonates with them. If employees working remotely don’t understand why certain protocols are in place, they probably won’t feel inclined to follow them. But what if companies did a better job explaining the dangers of not adhering to remote access policies? Would that provide the necessary incentive for remote employees? Scholtz certainly thinks so. According to the article, the key is to have companies adapt a people-centric security (PCS) system. In order for this system to be successful, the entire organization must be security-focused, and the best way to accomplish this is through employee education and awareness. It’s a concept that Scholtz compares to the “shared spaces” idea made famous by Hans Monderman, a famous Dutch road traffic engineer and innovator. Despite how dangerous the idea of vehicles and pedestrians sharing roadways with minimal signage may sound, it actually causes...