We have been discussing the risks personal devices can pose for business data corruption, loss or theft quite a bit of late.  These issues were also highlighted at the RSA Security Conference (a gathering of security industry experts) and we have focused our attention to online security, personal information privacy, and business data risks. 

So, let’s review.  In IBM’s Plan to Manage Smart Phone Security Issues – Not Just About “Is Siri and Apple Spy?”, we reviewed different protocols and procedures for managing employee use of personal electronic devices.  We talked about the need for businesses to recognize and adapt to a corporate life with BYOD because – let’s face it – personal devices are here to stay.   We firmly believe that with policies, education and training  employees should at least gain a minimal understanding of the potential security danger of commingling personal and business data, the vulnerability of unauthorized electronic intrusions (See our post: And Yet Another Security Risk to Mobile Devices . . . Malware), and the ultimate cost to a business for lost or stolen data, including trade secrets.  These steps can also protect your organization should you be required to remote wipe a device that is lost, stolen or “removed” by a departing employee. 

What we have seen, unfortunately, is that even with the best policies, education and training, no service or device is fully secure – whether the result of state sponsored hacking of U.S. companies by other governments, or cyber intrusions by groups like Anonymous.   Security vulnerabilities exist.  This is but a short list of some of the recent security breaches:  Google’s two-step login verification process was bypassed allowing control of a user’s account; Evernote, a Web-based note-sharing service, reset 50 million users passwords following an attack into users’ accounts; Facebook, Apple, Microsoft and Twitter have reported recent cyber-attacks;  Like Evernote, Twitter reset the passwords for 250,000 accounts whose encrypted passwords may have been accessed; and Dropbox, an electronic storage service, reported a large loss of data for a number of subscribers. (For more information, see NBC News, Evernote resets 50 million passwords after hackers access user data, Google patches ‘loophole’ in two-factor verification system, and His firm accused China of hacking the US; now he awaits the consequences).

The problem is that once an employee removes corporate data from the network, protecting and securing that data becomes much harder.  “My peers are killing me,” John Oberon, information technology chief for Mashery, a 170-employee company that helps other companies build applications, reported to the New York Times, Where Apps Meet Work, Secret Data Is at Risk.  “[T]here’s only so much you can do to stop people from forwarding an e-mail or storing a document off a phone.”  (This is still one of the main ways employees take data…)  And employees will find their own ways to connect with one another.  Indeed, Netflix recently found its employees using 496 applications for data storage, communications and collaboration.  Yikes.  “People are going to bring their own devices, their own data, their own software applications, even their own work groups,” said Bill Burns, director of information technology infrastructure at Netflix.  The question becomes what are you doing as an organization to monitor, limit or otherwise control what employees are doing on their devices?  Is it enough?    

And what if the security dilemma is really not the employee’s fault?  HTC America, a global manufacturer of devices, recently settled a complaint with the Federal Trade Commission.  The FTC alleged that HTC America failed “to take reasonable steps to secure software” in its Android, Windows Mobile and Windows Phone smartphones and tablets.  According to NBC News, HTC subject to 20 years of security reviews because of holes, the FTC reported that “[t]he company didn’t design its products with security in mind.”  “HTC introduced numerous security vulnerabilities that malicious apps could exploit to gain access to sensitive data and compromise how the device worked.”  Even worse, the FTC alleged “HTC pre-installed a custom app that could download and install apps outside of the normal Android permission process.”  To settle the FTC matter, HTC America agreed to create and push software patches to millions of its mobile devices, and to accept independent security assessments for the next 20 years.  This case represents the first time the FTC has pursued a mobile device company over security concerns, or ordered a company to create and push a software fix as part of a settlement.

In the end, whether caused by employees or by device manufacturers, security issues cost businesses money.  Security concerns can waste valuable IT time and money, and more importantly hurt a business’ reputation with its customers.  So, what are you doing?  I have been talking with CIO’s and industry experts to gain different perspectives and options for addressing data protection and security concerns.  I will post some conclusions and suggestions in the weeks to come.  In the meantime, we would love to hear what you are doing.