January 20169 It is possible for corporates to enjoy the benefit of Enterprise Mobility without compromising their security and compliance posturespiece of business data gets to flow to your smart devices, and probably other places that are beyond the expectation of corporates (or data owners), such as third-party cloud services. The increase of data flow could also lead to more data leakage scenarios. While we are using the smart devices as if they are our personal computers or laptops, are they at the same level of security or at least configured in the same manner in terms of security?Corporates often under an impression that deploying and configuring Mobile Device Management (MDM) tools is the only way to secure employees' smart devices and the business data resided. This type of management tools allow the administrators of your corporate to manage both the smart devices and in-house apps effectively (e.g., remote wiping the enterprise apps on a leaver device). It is not uncommon to see in-house developers or application owners neglecting mobile application security due to the implementation of MDM, resulting in introduction of additional security vulnerabilities to their companies. These vulnerabilities, when exploited by malicious users or hackers, can result in reputational, financial and operational damages. It is possible for corporates to enjoy the benefit of Enterprise Mobility without compromising their security and compliance postures. Although there is never a silver bullet, the management of corporates may want to assess where their current Enterprise Mobility program stand in relation to people, process and technology. A number of triggering questions can be helpful in this process:1. Have we extended our existing data protection strategy to Enterprise Mobility?2. Are we able to visualise the underlying data flows associated with Enterprise Mobility and enforce appropriate controls to prevent unintended data flow (or leakage)?3. Are our people ready and equipped with adequate security awareness to detect and prevent specific social engineering attacks targeting smart device users?4. What are the controls we put in-place and what could happen if these controls are compromised (e.g., a malicious employee disables the "jailbreak/ root detection" of the MDM without approvals)?5. When developing/ acquiring mobile applications, are our developers/ vendors aware of security best practices in coding mobile apps and the associated risks (e.g., OWASP Mobile Top 10 Risks)?Felix
< Page 8 | Page 10 >