What is it all about?

For me, the trend really started to take off with the smartphones. Most companies tried to standardize the models but at the end of the day it was a lost battle for different reasons:

• The standardization process was always slower than the development of new devices.
• These devices were cool. Therefore the CEO bought a new one in the store around the corner and then came back to IT to enable it to read mails etc. If the CEO wants it, who pushes back?
• Different people have different needs. Do they all need the same device?

Based on this, a few companies tried a different approach: They gave selected people money instead of hardware and let them choose themselves. The idea behind it is fairly simple: We typically publish a “one-size-fits-all” image and do not take into consideration that IT-literate people might be more productive if they are able to customize their environment the way they want – as long as they follow certain policies.

Over the course of the last few years, the problem became much bigger as a lot of different form factors hit the streets: from iPhone to iPads, from netbooks to developer notebooks to slates etc.

The challenge

Once we accept that there are different needs and that this might (or better: will) help some users to be more productive, the next question then is: How do we enable access to our company data without compromising security, privacy and compliance? And what do we do if somebody leaves the company? How can we delete our company data/contacts/mails and keep the user’s private environment in place? … and a lot more.

And, by the way, the user wants access anytime and anywhere.

Unfortunately there are no silver bullets but some ideas and approaches. We just published the Consumerization of IT Test Lab Guides, which can help do address some of your challenges or at least give you some food for thought. Here is the description of the papers:

While Consumerization of IT (CoIT) has remarkable potential for improving collaboration and productivity, many companies are grappling with the potentially enormous security risks of introducing consumer technologies in their IT environment. Therefore, IT needs to strike a balance between user expectations and enterprise requirements for security, privacy, control, and compliance.

The Consumerization of IT (CoIT) series of documents comprises the following documents :

• A white paper entitled Consumerization of IT (CoIT), A Trend To Be Considered that introduces as its name indicates the topic;
• Test Lab Guides (TLGs) that allow you to get hands-on experience using a pre-defined and tested methodology that results in a working configuration for the most frequent and relevant CoIT scenarios. Each of these guides also covers how to test and demo each capability.

Different scenarios are covered:

1. Base Configuration – Provide secure corporate network access
2. Internet Proxy – Provide Internet access
3. Exchange Messaging – Provide email access and manage non-corporate devices security policies
4. Data Protection – Manage email security
5. Data Classification and Server Isolation – Manage sensitive server and application security
6. Remote Desktop Services Desktop Virtualization – Deliver applications to any devices
7. Remote Access Gateway – Secure remote access

I think that this is something you definitely should look into as it gives you approaches and guidance, how to align your architecture.

However, to start with: Know your data and know your data classification. There is a good chance that there are data sets, you want to give access only to users on machines you manage

Roger

Hacker’s Tiny Spy Computer Cracks Corporate Networks, Fits In An Altoid Tin

Fairly easy, isn’t it?

Roger

He just posted on his blog: 5 Common Types of Security Professionals

I really like this post. The way he categorizes them is:

• The NO-MASTER
• The By-The-Book Preacher
• The Dinosaur
• The Technology-Solves-It-All
• The paranoid

The reason, why I like it so much is that I am deeply convinced that security can only be successful if it is aligned to business needs and not necessarily to policies and to fear. So, thinking about where security can become a business enabler would often be worthwhile. Additionally, we probably should think about our risks as well. It might well be that the we think that the world might end if a certain risk materializes but it might not even make it in the Top-100 risks of your company…

So, maybe we should change our approach or at least be honest and look in which of the 5 buckets we fit…

Thanks Shoaib

Roger

Anyway, if you look at the article, it says:

Apple reported 91 vulnerabilities during the period, making it number one among the top 10 technology vendors in the industry, said the report, "Security in the age of Mobility."
Trailing Apple were Oracle (78 vulnerabilities), Google (73), Microsoft (43), IBM (42), Cisco (36), Mozilla (30), MySQL (28), Adobe (27) and Apache (24).
In addition, Trend Micro reported that Apple issued a record number of patches to its Safari browser in March during the period. A year earlier, March was also a mammoth month for patches, with Apple addressing 93 vulnerabilities, a third of them characterized as "critical," in its Leopard and Snow Leopard operating system.

If you set this into proportion to the size of the portfolio, it would look even better for us. However, this does by no means say that we feel good about 43 vulnerabilities but it shows that our Security Development Lifecycle pays off.

This is more or less consistent as well with what we see with customers: Typically they know today how to roll security updates out to their Microsoft environment but they are often challenged with the rest of their applications. However, if you look where the majority of vulnerabilities are, it is typically third-party code (and not “only” from the vendors stated above but in custom-written code).

Therefore I am still calling for customers to ask for a secure development lifecycle from their vendors

Roger

The reason for this post is, that I still see a lot of customers who developed a really good practice for handling Microsoft updates but not for the rest. I just read these two articles this morning:

• Security Updates Available for Adobe Reader and Acrobat
• Google Patches Chrome 18 for Flash Flaws

So, make sure you cover all your software including third-party apps and open source.

Roger

Therefore we made our answers to these questions publically available: Cloud Security in Office365. In the meantime the Cloud Security Alliance worked on a Security, Trust and Assurance Registry (called STAR) with the goal to have all these answers in one place. Kellie Ann Chainier (she works at Microsoft on a lot of these challenges) just published a corresponding blog post: Cloud Security Alliance makes cloud security more transparent with new STAR Registry – short and worth reading

Roger