Mobile devices are delivering huge boosts to productivity, especially for deskless workers. Mobile enablement, for roles from field sales to patient care nursing, has streamlined daily tasks. In addition, many new, highly efficient applications are totally reliant on mobile devices; operations ranging from plant floor ticketing to dynamic fleet management could not exist without them.
Mobile devices also present companies with new risks to confidential data. Cyber attacks can use them as entry points for data breaches into corporate systems. Most management teams recognize the need for enterprise mobility security and have responded with cyber security measures, some more effective than others.
While malware and ransomware tend to get the most visibility when it comes to cyber attacks, the potential loss or theft of the physical device still remains a major contributor to overall risk While companies certainly need to build and maintain an extensive set of digital defenses for data protection, they should also keep in mind the threats that come into play when a hacker physically possesses a device. Let’s take a look at the issues involved and what you can do to address them.
Physical Data Breaches and Mobile Devices
Physical data breaches refer to the theft of documents, specialized equipment or devices that contain confidential or sensitive data. The data could be from customer accounts, hospital patient records, corporate financial transactions, or dozens of other sources. It could even include passwords for corporate applications, emails or bank accounts, which would open up more potential data breaches. Physical breaches can occur when someone illegally enters a facility with access to a computer system, but usually, it happens when a device is stolen or when a cybercriminal somehow gets possession of a lost or misplaced device.
There are many examples of a physical breach via a stolen device. When a healthcare provider inadvertently takes a restricted device from the healthcare facility to a car, that device is vulnerable to theft during a break-in. Or a security guard leaves his company mobile device, with access codes and patrol route information, on a desk, accessible to almost anyone. In both these cases, getting to the information stored in the app or on the network is as easy as getting past the passwords, which is a lot easier than most people realize (a hacker can crack an 8-character password in only 4.2 hours, after all.)
Sometimes a physical breach involves confidential data that is actually on a device. In 2020, Oregon’s Medicaid coordinated-care organization, Health Share of Oregon, reported that a laptop was stolen from a transport vendor. The theft resulted in Health Share of Oregon having to notify roughly 654,000 that their PHI was potentially compromised.
How to Double Down on Mobile Security
Most mobile device policies include security basics i.e., password protection of the device and IT notifications if the device is lost or stolen. However, policy alone won’t do the trick. Policies must be accompanied by comprehensive communication and education surrounding cybersecurity and physical breach threats. But, of course, people are vulnerable to both forgetfulness and crime, so you’ll need to supplement that policy with proactive solutions.
An important capability, well within the skill set of most IT organizations, is to ‘brick’ or ‘wipe’ a device remotely. While these words are sometimes used interchangeably, ‘brick’ usually refers to a process that makes a device completely unusable, while ‘wipe’ is the process of remotely deleting all the data on a device, erasing it in a way that prohibits any possible recovery.
Even with the ability to ‘brick’ or ‘wipe, there is still one last hurdle; IT needs to know the device is missing before they can take the right steps. Devices can be equipped with location services, but they may not work if the device is turned off and even semi-skilled thieves know how to disable them. A more rigorous approach is to use a Contextual Mobility Management (CMM) solution.
CMM software uses context and situational triggers, like data from IoT sensors, to enforce your mobile device policy. It knows if a device is not where it is supposed to be and can take a real-time approach to deal with a situation, including alerting the device holder as well as security that the device is leaving the premises (think of clothing tags in a department store triggering an alarm) up to initiating an automatic ‘brick’ or ‘wipe’ process. Best of all, if that device is returned to the appropriate location, the apps can be immediately reinstalled. And all without IT intervention.
Conclusion
With mobile field enablement comes the need for advanced mobile security. As you consider your mobile device security policies, don’t overlook the threats posed by physical security breaches. There are serious risks to any business if a connected device falls into a hacker’s hands.
You can mitigate those risks by combining a CMM solution with a proactive IT capability. Learn more in our eBook: “Context is Everything: Embrace the Benefits of Mobility, Without Sweating the Risks”.