People use the term consumerization of IT when discussing the effects of user-owned and managed devices being increasingly used within an enterprise environment. Approaches to enterprise information security haven’t yet caught up to this trend. The urgency with which we need to account for consumerization is particularly great with respect to modern mobile devices—powerful handheld gadgets such as smartphones and tablets.

Mobile Device Forensics

The majority of tools and techniques for mobile device forensics presently focus on examining the device belonging to a suspected criminal to recover evidence.  Another scenario, which is currently not being addressed, is how to examine a mobile device that was infected while being used by a non-malicious employee. With the increased popularity of mobile devices, it won’t be long until an infected mobile device provides the attacker a gateway to the user’s enterprise network.

Eric Huber highlighted this trend in his must-read article on the topic of forensics in the era of mobile devices, where he noted:

“The incident response and penetration testing world will need to rapidly adjust to the mobile device era given how the criminal element will be increasingly targeting these devices.”

Adjusting the Security Architecture

Enterprises are coming to terms with the idea of employees connecting to the corporate network over a VPN from personal laptops and home workstations. However, most organizations haven’t look at the effect that the proliferation of powerful mobile devices has on the enterprise security architecture.

Mobile devices sometimes have VPN-like access to the corporate network and in most cases have access to the company’s email contents, calendar and address book. The devices are as powerful as laptops were just a few years ago. Yet, their operating system’s security has not benefited from the test of time, and lacks most of the security controls we’d expect to find in a “legacy” workstation OS.

We need to understand how to model the threat vectors related to model devices and how to adjust the security of the enterprise architecture accordingly. The measures will probably involve:

• Greater segmentation of the company’s network
• Treating any device device that users interact with, whether it’s a desktop or a mobile phone, as an untrusted node
• Standards and tools to lock down the configuration of mobile devices
• Practices and technologies for managing vulnerabilities in applications and the OS of mobile devices
• Incident response plans that incorporate not only “legacy” IT infrastructure assets but also mobile devices

— Lenny Zeltser

• Apple’s iOS devices meet many enterprise security needs
  Apple's iOS has reached the point where iPhones and iPads can be safely deployed for most enterprises, according to a new report from Forrester Research. View full post on Computerworld Security Ne...
• What Does the Consumerization of IT Mean to You? (An End-User Survey on Personal and Business Smartphone Trends)
  More than ever before, smartphones are keeping us connected both personally and professionally. Because most of us have a preference as to the ideal smartphone, IT departments are increasingly being t...
• Mobile Security Tips
  CES 2011 kicked off the year with a preview of what's upcoming in mobile computing. Expect more releases of high-spec smartphones and tablets, possibly powered by a dual-core CPU such as NVIDI...
• Gaping security flaw exposed on anti-tamper devices
  Security devices used in transportation, packaging and even in accounting for nuclear materials are very vulnerable to attack, two security researchers are warned on Tuesday at the Black Hat security...
• Remote Home Automation Controller – ADT Pulse & Mobile Devices
  CSA DISCLAIMER: This video taken from YouTube. As well as any other video found on this site is not hosted here, it just embedded, and it taken randomly by our system from video hosting services lik...
• Dr.Web Enterprise Security Suite – centrally managed protection of all hosts in a corporate network
  DrWeb — Doctor Web presents a new Dr.Web product line for corporate customers — Dr.Web Enterprise Security Suite. The new product line incorporates Dr.Web software products which support centralized ...
• Top Hacker Targets Include Mobile Devices and Mac (NewsFactor)
  NewsFactor - McAfee is making security predictions for 2011. The firm outlines its top threats for next year in the 2011 Threat Predictions report -- and Android, iPhone, Foursquare, Google TV, and M...
• TSO Mobile | GPS Tracking, Security & Logistics
  CSA DISCLAIMER: This video taken from YouTube. As well as any other video found on this site is not hosted here, it just embedded, and it taken randomly by our system from video hosting services lik...
• Kaspersky Mobile Security: lo spot
  CSA DISCLAIMER: This video taken from YouTube. As well as any other video found on this site is not hosted here, it just embedded, and it taken randomly by our system from video hosting services lik...
• May 2010: Mobile Phone Security
  CSA DISCLAIMER: This video taken from YouTube. As well as any other video found on this site is not hosted here, it just embedded, and it taken randomly by our system from video hosting services lik...