How to keep your company data safe on public Wi-Fi

Wi-Fi securityCoffee shop Wi-Fi is evil. So is every other public Wi-Fi.

That’s because open Wi-Fi has no security. Full stop, period.

We’ve all heard that we should be careful about what we do on public Wi-Fi because there could be someone reading our emails or eyeing up our bank accounts in our neighborhood coffee shop or on an airplane. Some privacy advocates warn against signing into New York City’s public Wi-Fi, too.

Protecting yourself is easy: Don’t use public Wi-Fi. But in the age of mobility and the “always online” mentality, that can seem unrealistic for some. What can your employees do to protect your organization’s data (and their own private data as well) when they’re traveling or out of the office?

Here are five reminders and best practices for working on public Wi-Fi. Continue Reading…

Tags: , ,

How VMware is building a bridge to the mobile-cloud era

mobile cloudBank robbing used to be easy. If you could get past the main vault, you could get instant access to all the cash. Within today’s modern banks, the vault’s exterior provides just one layer of perimeter security.  Now banks incorporate an assortment of other layers of security, such as safety deposit boxes, which make accessing everyone’s cash at once incredibly difficult, if not nearly impossible. Continue Reading…

Tags: , , , , ,

Is your phone safe from mobile malware?

mobile-malwareA decade ago, Windows machines were perceived as the target of all malware. Today, malware is a threat to all platforms. Rather than one popular operating system being inherently more secure than another, it seems malware increases in tandem with the OS’s use. The more popular it becomes, the more targeted it is, and the more vulnerabilities are found.

Today, our smartphones connect us with social media accounts, banking services, and retailers. The important question for a mobile device is not just whether its operating system is secure, but whether it has an effective security patching strategy for when (not if) the latest malware eludes a device’s safeguards. Even mobile and desktop operating systems designed with security first have had problems that called for this kind of effective update management.

Security in the mobile world

The mobile device market is dominated by two operating systems. Android owned 81.5 percent of the market in 2014, compared to 14.8 percent for iOS (not unlike the Windows and OS X situation of years ago).

However, only Apple can patch its mobile operating system similar to the way desktop OS manufacturers patch security holes and shortcomings. Android’s openness is a strength, but also its greatest security weakness because Google doesn’t have the last say when distributing security updates and patches – the OEMs and service providers hold that power. In addition, controls that block the installation of unknown, third-party software are easily circumvented, providing an easy avenue of attack for cybercriminals.

Unsurprising then is our finding that the vast majority of mobile malware — 99 percent in fact — targets Android devices. The number of attacks and different kinds of mobile malware are growing at a staggering pace, and in 2014, the number of mobile malware attacks against Android more than quadrupled, affecting about one in five Android devices.

Most people aren’t aware that Google is virtually powerless to stop malware from compromising an Android device, unless the program comes through the Play Store. Only a small percentage of users are aware that mobile malware even exists and that they need protection software to defend against it. When you consider that mobile devices now often store critical information – credit card numbers, online banking logins, etc. – and are more vulnerable to a host of attacks, it’s critical to defend devices against malware.

Though we have battled malware on desktop operating systems for years, there’s still room for progress in some areas on mobile. Most users don’t get updates in time, or at all. Plus, users are installing unknown, third-party software left and right, but have no controls (e.g., security software) in place to detect malicious apps or activity.

Complicating matters is Apple’s controls for iOS. It’s true that software sources are more tightly controlled through the App Store, but protection software is banned, and it’s unclear how often iOS devices are compromised.

Moving toward better mobile security

Understanding the current threats to your mobile device is key. No matter what kind of mobile device you use, you must realize the importance of the data on it, and exercise commensurate caution when installing apps, opening URLs, or choosing whether to enable encryption.

If you are using an Android device, there is a significant chance (one in five, likely more) that you will be targeted by malware in the next year. This malware will likely try to steal financial information from your device, or abuse it in a way that hurts you financially. And it’s very likely that we’ll see even more ransomware – software that encrypts your files with an encryption key that will be revealed only after the payment of a ransom – being targeted at Android users.

To effectively protect a device from these threats, first pick an Android device whose updates are handled directly by Google, and make sure updates are installed when available. It’s also advantageous to block the downloading of third-party applications and install protection software that can ward off any malware.

If you are using an iOS device, you are likely safe — for now. If you install updates as soon as they are available, and avoid downloading and installing apps you don’t trust, there’s a very small chance you’ll be subject to malware attacks in the near future. But as iOS increases in market share, so will the number of potential malware attacks.

 

About the author

Michael Canavan is the Vice President, Sales Engineering, Kaspersky Lab North America. He is responsible for overseeing all pre-sales systems engineering activities in the region, including North America B2B sales product training, which includes a standardized onboarding initiative for the sales team as a whole, guiding senior sales management regarding technology and solutions, and acting as a solution evangelist for North America B2B sales both internally and externally. Michael brings more than a decade of engineering experience to his role. Prior to joining Kaspersky Lab in 2010, Michael held various roles at Trend Micro in Sales Engineering and Product Management.

Tags: , , , , ,

5 ways technology can increase sales for brick and mortar retailers

shopping mallThe majority of U.S. retail sales still occur in brick and mortar stores, but maybe not for long. Online shopping has drawn dollars away from big box stores, which continue to struggle to attract customers given the convenience and discounts online retailers have to offer.

The giants of e-commerce are also swaying business in their favor through ever-shifting pricing, big data analytics, and a restless approach to capitalizing on technology. But physical stores are starting to catch up, increasingly adding new technology and methods to better serve customers. While some are taking a piecemeal approach and adopting new technologies as they go, the stores that stand a chance of competing with online retailers will look to integrate solutions for a better overall customer experience.

Consider these five ways technology can get shoppers offline and back to your business. Continue Reading…

Tags: , , , , , , ,

The top 5 features all companies should look for in a mobile security solution

Cloud security has been a top concern ever since organizations first began to shift data into the cloud and away from on-premises solutions.

While many cloud providers offer robust enterprise capabilities, including encrypted content, passcodes, and mobile device management, many can still fall victim to a serious security risk: data leakage.

Blake Brannon Airwatch

Blake Brannon is a senior solutions engineer at AirWatch by VMware.

In an age where organizations and employees muddle the boundary between personal and private devices, employees can often access or transfer data to their unmanaged and unprotected devices. Providing employees with the ability to transfer and share sensitive data significantly increases the risk of data leakage.

The cloud leakage problem is one of the greatest threats to enterprise content security. While many cloud solutions secure enterprise content within the cloud infrastructure, they often lack the controls necessary to keep mobile users from downloading and walking away with critical information on personal, unsecured devices. However, there are powerful mobile security solutions that provide extra security for content in and out of the cloud. Here are the top five features companies must look for when choosing a mobile security solution that ensures content is secure.

Email protection — One of the easiest ways for employees to compromise content is by emailing secured cloud data to themselves on unprotected, personal email accounts. This not only leaks corporate content outside of an organization, but places it at greater risk of external hacks. Find a mobile security solution that can rein in rogue emailing and button up this source of content leakage by allowing only managed devices to synchronize with and download content from the cloud. These solutions also enable IT teams to monitor downloaded content, further securing your data.

Download prevention — The advent of the cloud means IT can no longer contain sensitive content behind four walls, and managing what devices can access company data has its limits with some cloud solutions. The easiest way to prevent employees from downloading sensitive data to personal devices is by forbidding external downloads onto unsecured devices altogether. But with some services, users can access content with phones that aren’t managed, creating a major backdoor into your data. Fixing this problem will take some integration between the technology and the particular ecosystem, but this issue will likely be addressed sooner rather than later. For now, find a solution that can limit what devices have access to content in the cloud. Continue Reading…

Tags: , , , , ,

What iOS 7’s Activation Lock means for the enterprise

One of the bigger stories out of Apple’s introduction of iOS 7 at its Worldwide Developers Conference (WWDC) was its Activation Lock feature. Law enforcement officials have been calling on Apple and other phone manufacturers to proactively deter theft of their products as cellphone thefts rise, and Activation Lock seems to be Apple’s answer.

Activation Lock, if you haven’t yet heard, allows a user to lock a lost or stolen iPhone. The phone can’t be reactivated or wiped and resold without the user’s Apple ID and password. Law enforcement and users seem to like the change, but what about enterprises? What does Activation Lock mean to IT? Here are two major takeaways:

  1. Activation Lock creates a small risk. The one problem with Activation Lock in the enterprise is its potential to be misused by a disgruntled or laid off employee, who could conceivably turn in his or her phone, put an Activation Lock on it, and leave the company a brick as a farewell gift. This is unlikely but possible based on what we know about the feature. Apple, however, is probably aware of the potential sensitivities, and the feature will likely have safeguards, like a reclamation feature that would restore a phone that was improperly locked. But, we still don’t know all the details.
  2. Activation Lock is for users, not businesses. While it makes sense that average iPhone users would want a way to lock their phone in the event it’s lost or stolen, enterprises are less concerned about the reselling of a stolen phone. Higher on the list of IT priorities is data loss or leaks. And these companies should already have MDM solutions in place to remote wipe devices that go missing. Continue Reading…
Tags: , , ,