Federal BYOD: The mobile security conundrum

There are currently more than 7.7 billion mobile connections around the world. Thanks to the Internet of Things, it is predicted that the number of connected devices will reach an astounding 20.8 billion by 2020. With the average number of mobile devices owned per person currently estimated at 3.64, those devices are becoming necessary equipment for today’s workers.

Yet while the private sector has been quick to establish Bring-your-own-device policies, the public sector has lagged behind because of security and privacy concerns. Despite several initiatives -- including a White House-issued BYOD toolkit and two National Institute of Standards and Technology documents (800-124 and 800-164) giving guidance on securing devices that connect with government networks -- many federal agencies are still reluctant to establish BYOD policies. 

This is largely due to a number of common threats linked to mobile devices, including:

Potentially unwanted software (PUS) -- Social media applications can consume valuable bandwidth within an agency and expose government networks to malware and the potential loss of sensitive information. PUS often poses as antivirus software and adds itself to a mobile device through deceptive advertising or social engineering attacks that deceive the victim into installing it. Depending on the type of access given, PUS can use capabilities on a phone to siphon off contact lists or send information to unknown parties, which is especially concerning given the sensitive information on a mobile device used to communicate government business.

Ransomware -- This type of cryptographic threat holds files or documents hostage and demands a ransom payment before releasing the data. Ransomware is usually self-inflicted, often caused by users seeking out and installing pirated or otherwise suspect mobile applications from shady websites or unsanctioned app stores. Unfortunately, the damage is already done before users realize what has happened. Ransomware poses a real threat to the federal government. As of March 2016, the Department of Homeland Security said it had received 321 reports of possible ransomware infections from government agencies since the summer of 2015. Without the proper protections in place, the addition of mobile devices on a network will only exacerbate those numbers.

Information leakage -- Applications residing on mobile devices may be observing and reporting information about how they are being used. Internet-connected apps transmit information each time a web request is made and, because of app design or encryption failures, can be visible to anyone monitoring the network or Wi-Fi environment. Some smartphone apps transmit information back to the app creator or to advertisers, web statistics companies or unknown third parties for performance measurement. Information leakage represents one of the key challenges associated with mobile device protection.

In order to meet their mission, government agencies must employ technologies that help personnel communicate with each other, as well as with the citizens they serve. In addition, staff members must be able to safely and securely access applications and sensitive information on multiple devices across a variety of platforms, in any location.

Federal CIOs will have a better success rate when designing and implementing a BYOD policy if these safety tips are considered:

• Agencies must protect their networks against data loss and malware attacks, while enforcing acceptable use policies via a network-based approach. Seek security solutions from trusted vendors that provide threat protection and policy controls for mobile devices on or off of the agency’s network. At a minimum, the solution should provide accurate web filtering and malware protection, anti-virus scanning and enterprise-grade encrypted connection methods.

• Integrate security functionality directly into the mobile device management solution the agency is using to ensure compliance and enhance risk mitigation. MDM solutions can deploy certain mobile device security protocols, enabling encrypted communications and blocking malware and other malicious content.

• Deploy granular application controls that can direct the way users interact with web and mobile applications. Policies can be established, for example, to prevent posting of comments to certain web pages, uploading of photos/videos or downloading of files. These policies can be issued to groups or even down to the individual end-user level.

• Monitor and measure the effectiveness of the policies and controls in place. Maintaining visibility into the security program is essential to ensuring its viability -- hacking techniques don’t remain static, so neither should an agency’s security program. Update and enhance these measures on a continuous basis for greater success.

• Train users about common infection threat vectors they are most likely to encounter. Remind them not to download apps from unofficial sources, search for free versions of popular apps or override the inherent security of their mobile devices. Limit connections to free or unsecured Wi-Fi networks.

Moving forward

Although there are inherent risks to pushing the BYOD agenda and increasing the number of mobile devices connected to government networks, the benefits are too good to ignore. Agencies must understand those risks, but also appreciate that there are technologies and procedures available to mitigate the threats against an expanded network footprint. If done properly, BYOD can help federal agencies  make huge strides in more effectively delivering on their mission.