Meeting with Dr. Sarkani and Dr. Mazzuchi / READ: Mobile Security Gaps Abound

I met with Drs. Sarkani and Mazzuchi today and expressed my progress and nervousness about my topic, what the advisors are saying, and the deadlines.  Dr. Sarkani told me I need to focus more on reading literature (10 he said) and forget the practical side of stuff.  He said they are interested in theory.  Dr. Mazzuchi took me to the computers and show me to search Gelman using two databases: Web of Science and Compendex.  He used the phrases "Mobile Security", "Risk Analysis", and "Policy Management" as titles and topics.  He pointed out how I can click the little number that takes me to how many people have referenced that particular article.  Interestingly he printed two out for me which he considered good and the second one I happened to glance at the last paragraph.  It reads:

"There's no doubt BYOD is off and running, yet security and management are not

keeping pace.  That gap creates a serious exposure for enterprises and one that CIOs

should be looking to get their arms around.  Unfortunately, the lack of a widely 

published mobile security failure has lulled executives into thinking that the

situation is well in hand.  Nothing could be further from the truth"

Basically the premise for my topic.  I told him I like to show him the last paragraph of the article he just printed as I had just glanced at it.  He read it and laughed.  Shortly there after as I was saying goodbye he laughed again and said "That was great you finding that paragraph!"  Let's hope it is a silver lining.

CITATION
Finneran, M. (2012). Mobile Security Gaps Abound. Informationweek, 26-29.


This article was the only one Dr. Mazzuchi could find; the other one he found was in Chinese.  Great article ad among other things it highlights my topic so clearly as mentioned above.  Here are some important points:

• Number 1 and 2 concerns regarding mobile security are loss of device containing sensitive data and infected personal devices connecting to corporate network
• Most user do not differentiate between Wi-Fi and 3G/4G access and carriers like it that way
• Today mobile security is user security is data security; maintaining two or three policies is a recipe for confusion and noncompliance
• The more unified the policy the easier to enforce
• Having users agree to follow policies is translated into "trust the user to do the right thing"
• Only 14% of mobile security survey respondents mandate hardware level encryption
•  If access from home Wi-Fi or public ones allowed, it must be through VPN
• A large smartphone security concern is risky user behavior
• To include malware on phones and users forwarding corporate data to cloud-based storage
• From a policy perspective, an MDM system is what gives your rules teeth
• Work with carriers and see what they can do for you
• Four undeterred capabilities
• Prevent installation of unknown apps
• Recognize unauthorized software
• Whitelist and blacklist applications
• Restrict or block app stores