Is mobile security finally getting some respect?
Connecting state and local government leaders
While other aspects of IT security have been ratcheted up over the years, mobile security has proven a much tougher nut to crack and has lagged in the race for attention and funding.
It looks like mobile security may at last be getting some attention in government, and it’s long overdue. While other aspects of IT security have been ratcheted up over the years, for some reason mobile security has proven a much tougher nut to crack -- and has lagged in the race for attention and funding.
Mobile security has proven a pain for most agencies, particularly with the once-hyped bring-your-own-device trend, in which government employees used their personal phones and tablets to do government work. With access and data security much harder to employ in mobile than for desktop devices, that threw up all kinds of concerns for organizations.
So much so, in fact, that some agencies simply tried to mitigate those concerns by banning most BYOD altogether. Well, no one expected that was going to work for the long run. And as a recent survey by mobile security firm Lookout found, many employees use their own devices no matter what the agency policy is. Fully half of the employees the company surveyed used their own devices to get government email, and nearly as many used them to download work documents.
In its Oct. 30 memo laying out a “Cybersecurity Strategy and Implementation Plan” for the civilian side of government, the Office of Management and Budget directly addressed mobile in a section on new cybersecurity shared services. Mobile devices, it said, have become as powerful and connected as desktop and laptop computers and require the same level of security attention.
But mobile security “has unique challenges that require different solutions than existing programs offer,” OMB said. “This service (or services) could address authentication, application management, device management, and encryption, and may include approved tools, best practices, and implementation support.”
Bob Stevens, vice president for federal systems at Lookout, said he’s encouraged by OMB’s statement, and by the formation of a forthcoming cybersecurity shared service center. “Until now," he said, "most legislation and mandates around cybersecurity have been looking to solve problems that existed in 2009, not the problems that plague us today.”
A few days after OMB published its memo, the National Institute of Standards and Technology chimed in with a draft guide for securing mobile devices, based on a “typical” scenario drawn up and tested by engineers at NIST’s National Cybersecurity Center of Excellence. Examples in the guide show how organizations can configure a trusted device and, equally important, how to remove device details from IT systems if those devices are lost or stolen.
Public comment on the draft, part of the Center’s new Special Publication Series 1800 Cybersecurity practice Guides, is open through Jan 8, 2016.
These initiatives won’t be enough by themselves, given that agencies are so far behind the curve on mobile security. But at least now they’ll have a good place to start.
NEXT STORY: GovRAT: Digitally signed malware