Where does your company stand on BYOD? Empowering employees to use their own devices on your enterprise network has its benefits, but also its dangers. In a recent interview with Enterprise Networking Planet, Chiranjeev Bordoloi, CEO of cyber security firm TopPatch, explained how Bring Your Own Device can quickly turn into Bring Your Own Disaster, and how enterprises can prevent that from happening.
Costs of security breaches to enterprises
First of all, though, how bad can a security breach be? Very bad, according to a 2012 NetDiligence study that Bordoloi cited during our interview. The NetDiligence study examined 137 cyber liability insurance claims to uncover the true cost of corporate security breaches and determined the average cost per breach to be $3.7 million and the average cost for post-attack crisis services to be $983,000 per event. And it only takes a single download to set a costly disaster in motion.
Mobile platforms as primary attack vectors
The danger these days, Bordoloi told me, comes primarily through mobile phones. In late 2012, TopPatch’s research identified a plethora of malware being offered on the Google Play store and third-party Android app providers. “There’s a lot of effort being paid by hacker groups toward using mobile platforms as a primary attack vector,” Bordoloi said. “Just as marketers track their target audiences and follow their moves to different platforms, cybercriminals have moved their focus to mobile devices. Non-company-issued devices are now being used to spread malware into company-controlled networks.”
This malware is becoming increasingly sophisticated. Hackers, Bordoloi said, now “program with the same efficiency and focus as legitimate programmers. They program things without a signature; antivirus only catches them about twenty percent of the time. Malicious programs don’t use much CPU power or disk space. They don’t affect system performance in any way, so they aren’t easily discoverable.” Once they’ve infiltrated your network, you’re vulnerable, and you may not know it until it’s too late.
Android apps: now with more free malware!
TopPatch’s research found more than 1,700 Android apps carrying malware, dangerous apps that are being downloaded at an alarming rate. Livelocker, a lock screen customization tool with over 100,000 downloads, steals user information and downloads other malicious apps. Photoshop Tutorials – Free, with nearly 700,000 downloads, sends sensitive mobile information to remote users. Do these sound like apps that an employee might be tempted to install? Livelocker and Photoshop Tutorials – Free aren’t the only ones, either. Others mimic the names and appearances of popular, legitimate Android apps, tricking users into installing the malicious fakes. In a BYOD environment, dangers to your network are everywhere.
TopPatch network security recommendations
So how do enterprises protect their networks from these threats? Bordoloi advocates user education. Communicate security precautions to your teams. “Let’s say someone goes to a trade show,” he told me, illustrating one common scenario. “Someone gives them a USB drive. They don’t know what’s on it, they stick it into their computer—a computer connected to your network—and there you go. Your network could be infected.” Reminding employees to exercise common sense can go a long way.
What Bordoloi doesn’t recommend is looking for a magic bullet to end all threats. “What security investments has your company already made?” he asked. “Are you maximizing the value of those investments? So you bought an antivirus. Is it configured correctly? Are your firewalls? You don’t need to buy more stuff. Use the stuff you’ve already bought, and use it well.” Only then, he said, should you make additional purchases: “Look for gaps in your products and buy based on those gaps.”
And whatever your patch management and security policies are, Bordoloi said, regular compliance audits and smart implementation are key. “A lot of times, policy is defined in the C-suite. But it’s admins that have to implement the policy. It has to be done at the tool level, configured correctly, deployed correctly, tested correctly.” If you want to help your admins secure your network, therefore, “they need simple, easy-to-use tools that they can manage that do their job right.”
BYOD can be a great thing. It can, as its advocates contend, save money and improve employee mobility, productivity, and job satisfaction. Unfortunately, lax security policies and poor implementation can compromise entire enterprise networks. Don’t let that happen to yours.
Jude Chao is Executive Editor of Enterprise Networking Planet. Follow her on Twitter @judechao.
