Basic Security Measures Overlooked with BYOD

March 19, 2012   Absolute Software Blog
security-measure-two-factor-authentication
ESET recently conducted a survey on the bring-your-own-device trend (BYOD) and the associated security challenges. Most companies currently lack policies that address the use of personal devices often leaving security to employees. As we’ve addressed before, personally-owned device activations are reaching an all-time high, so it should be no surprise that more devices are flooding the workplace.The ESET survey found that more than 80% of employed adults use a personally-owned device for work (smartphone, tablet, laptop). Personally-owned laptops and desktops are often used to access or store company information; 41% and 47% respectively. 24% use their own smartphone to access and/or store company information and 10% use tablets, showing an increase in the use of devices that could potentially introduce data security risks.What’s troubling, from this data, is the lack of security precautions in place.
  • about one third of BYOD devices have encryption for company data
  • less than 10% of people currently using their own tablets for work have auto-locking enabled (25% of smartphones auto-lock, 33% of laptop users auto-lock)
  • less than half of laptop users use both auto-locking and password protection. The numbers decrease for smartphone & tablet users.
As ESET notes, “less than half of all devices in the BYOD category are protected by the most basic of security measures” and this is troubling indeed. When companies are lax on their BYOD security policies and training programs, it’s up to employees to determine the security on their own devices: they are not making smart decisions. It’s also likely that many companies have no idea of the extent of BYOD device use, the types of data being accessed, or when that data goes missing.
Read More

Smartphone Security Software Lacking

January 06, 2012   Absolute Software Blog

According to a new survey for the National Cyber Security Alliance (NCSA) and McAfee, found that mobile phone users have a false sense of security for their devices. For example, 75% of those surveyed in the US have never installed data protection applications or security software of any kind on their smartphones.

Consumers continue to use their smartphones more frequently, which should come as no surprise, with 75% of smartphone users saying they connect to the Internet more frequently this year than last. People do everything on their phones, from personal banking (more than 32.5 million Americans in 2011 Q2) to business transactions.

There is currently a false sense of security among consumers about their smartphones. 70% of smartphone owners say they feel their device is safe from hackers, malware and other types of cybercrime. As we know from all the security predictions for 2012, consumers may be rudely awakened by more frequent and sophisticated mobile attacks.

Security on consumers, however, is quite lacking. Here are some startling insights from this survey and others cited therein:

  • 24% of consumers store computer or banking passwords on their mobile devices
  • More than half of smartphone users do not use any password protection to prevent unauthorized device access
  • Only 26% of smartphone owners said they always read the developer policy on the use of personal information when downloading an app

In the U.S. alone, 113 mobile phones are lost every minute – are you taking steps to protect yours?

Read More

Increasing Healthcare Data Breaches Due to Lack of Smartphone and Tablet Mobile Security

January 03, 2012   Adam Quart   No comments
healthcare-data-breach-security

In health care, the efficiency of a physician’s workflow can be a matter of life or death. Under certain circumstances, this statement could be quite true for the most part. Workflow is an integral part of a physician’s job however there is the concern of privacy and security. A survey conducted by QuantiaMD, with results from 3,798 physicians, states 1 in 5 doctors utilizes a tablet for work in their practice. This coupled with a report by Manhattan Research about smartphone usage among physicians increasing from 72% in 2010 to 81% in 2011 shows that mobile usage is on the rise in healthcare. These are alarming facts for mobile security since in many instances, security processes can hinder or halt work efforts so often it is overlooked.

Although physicians are governed by HIPAA compliance, more doctors are concerned with workflow than being compliant. With traditional forms of communication such as requesting a diagnosis or paperwork, a physician may have to wait an hour for a response from a colleague. If a physician utilizes text messaging, they can communicate with a colleague and receive responses rapidly. However, mobile security is not always used in healthcare because of the lack of security concerns. With so many physicians utilizing smartphones and tablets, this could mean the possibility of a data breach.

Recent research by the Ponemon Institute states that data breaches have risen by over 32% in 2011. There is no research pointing towards mobile devices being the culprit of these breaches. It could be a coincidence or maybe hackers and crackers are finding new ways of compromising data. Traditionally, hackers find weaknesses and vulnerabilities to exploit which is probably what caused the rise in data breaches. With more physicians utilizing devices without mobile security measures in place, hackers may have spotted weaknesses and exploited them to cause data breaches. Whether through interception of confidential data during transmissions or unauthorized access to servers, the concern is patient privacy.

Protecting patient privacy starts at the point of access. If only authorized users are allowed to access the confidential data, the chance of data breaches can be reduced. Two factor authentication provides government compliant security for HIPAA compliance. Two factor authentication solutions are also inexpensive while providing two layers of protection. By utilizing a one-time password sent through SMS text message, not only is an out-of-band authentication method utilized but there is no extra hardware or software needed since most users have mobile devices.

An out-of-band network provides the strongest mobile security because the chances of successfully intercepting two factors of authentication are extremely difficult. If a time limit is placed on the life of the one-time password and if a hacker were to intercept the password, chances are that they would not be able to input it fast enough to access the network before the user. With a one-time password, the password is unusable after being used once. This prevents the likelihood of a malicious user being able to fraudulently access data.

It may be easy to correlate that data breaches increased because of mobile device usage. The facts say it all. Smartphones are being used by almost every physician and with tablet applications becoming more available for healthcare, the chances for fraud increases. Advancing technology should be protected through advancing security. The two factor authentication process is advanced security that is HIPAA compliant, inexpensive and best of all requires no special software or additional hardware. This makes it able to be used by anyone with a smart phone or mobile device.

Read More

US Hospital Data Breaches Rising

January 03, 2012   Absolute Software Blog

According to a new Ponemon study sponsored by ID Experts, the Second Annual Benchmark Study on Patient Privacy and Data Security, healthcare breaches continue to rise. The frequency of data breaches was up 32% over the previous year, averaging four data breaches per healthcare organization. To further complicate matters, 55% of healthcare organizations say they have little or no confidence they are able to detect all privacy incidents

According to the survey, 41% of healthcare data breaches of protected health information (PHI) are caused by ‘sloppy employee mistakes’. Other areas causing increased risk of breaches include not knowing where patient data is located, third-party mistakes, and lost or stolen data devices (49%).

As we saw with a previous study, healthcare organizations are doing little to protect mobile devices that are a source of many breaches. With so many devices being stolen, accounting for nearly half of all PHI data breaches, it is surprising that so few organizations are proactively protecting their mobile devices.

“Healthcare data beaches are an epidemic,” said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. “These problems are a direct result of our national economy. Healthcare organizations—especially not-for-profit hospitals and small clinics—have thin margins, are trimming staff and resources and are lacking sufficient security and privacy budgets needed to adequately protect patients. I don’t see this getting better anytime soon.”

The data from the study suggests that data breaches could be costing the US healthcare industry $4.2 billion – $8.1 billion annually. In addition to costs, 29% believe their data breaches lead to cases of medical identity theft, a large increase over 2010 figures.

Read More

2011 Year in Review: Online Security Highlights & Lowlights

December 29, 2011   Zone Alarm Blog

2011 was a big year in terms of online security. From well-publicized data breaches of major companies to the takedown of giant botnets, cybercrime made many headlines. And though hackers came up with more innovative ways to steal information and wreak havoc on the Web, the spotlight on online security vulnerabilities prompted both officials and average users to be more vigilant. Here, we recount the major online security highlights and lowlights of the year.

Rustock Botnet Takedown (March 2011)

Rustock, the Russian botnet that was the main source of global spam, was effectively crippled after law enforcement and Microsoft collaborated to seize control of servers and cripple the network. Officials were able to work quietly under the radar to make the takedown a surprise to the hackers behind it, paving the way for future collaborative efforts.

Epsilon Gets Scammed (April 2011)

The largest distributor of permission-based email in the world, marketing company Epsilon (utilized by big name companies like JP Morgan Chase and Capital One) was compromised when an attack on its servers accessed millions of consumer email addresses and other information shared by the company’s high-profile clients. Potential damage estimates totaled up to $4 billion.

Sony PlayStation Network (April/June 2011)

In possibly the most notorious breach of the year, more than 75 million Sony customers had their info stolen, including addresses and passwords, when hackers compromised the Sony PlayStation Network in April. The network was subsequently put offline for 40 days, and Sony estimated the damage would cost $170 million. Worse, just when they thought the coast was clear, two months later hacker group LutzSec claimed responsibility for an attack on Sony Online Entertainment group, resulting in the theft of another 25 million customers’ info. Though various suspects have been arrested, the company is still rebounding from the damage.

CitiGroup Is Targeted (May 2011)

Nearly 1 percent of CitiGroup’s North American customers had their financial information compromised when hackers infiltrated the bank’s system, stealing info from 200,000 members, including names, account numbers, and email addresses. The breach left many concerned about online security regulation for banks and financial institutions.

Anonymous Declares War On Cartels, Then Retreats (October/November 2011)

After a member of hacktivist group Anonymous was kidnapped, Anonymous warned Mexico’s Zetas drug cartel that if the cartel didn’t free a kidnapped member of the group, the group would release an alleged 25,000 Mexican government emails containing the names of Zetas members and associates. However, when the kidnapped member was subsequently released, the group announced it would not publish the information.

Malware Infects Androids (October/November 2011)

Smartphones (and mobile apps) continued to be vulnerable to malware exploitation, particularly Android phones, which have an open platform. This year the problem only grew. According to the Juniper’s Global Threat Center, Android saw a 472-percent increase in mobile malware from July to November 2011. Consumers are advised to be careful when downloading mobile apps.

Operation Ghost Click Nabs Botnet Masterminds (November 2011)

After several years and cooperation between international agencies, the FBI arrested six Estonian hackers charged with creating a powerful botnet that infected around 4 million computers in more than 100 countries, including 500,000 infections in the U.S. The botnet affected more than just average users’ computers; it affected “computers belonging to individuals, businesses, and government agencies such as NASA,” according to the FBI.

Read More