Tag Archives: iPod

  • 0

Secure Mobile-an Oxymoron? (Redux)

Category:EDUCAUSE,Higher Education,Information Security,Infosec Communicator,mobile device,Privacy,Risk,Uncategorized Tags : 

Responses to the #1 topic on IdeaScale, “Consumers dictate device usage, not IT,” indicate that MANY of you believe consumers will drive smartphone adoption in Higher Education, while the sentiment around the topic, “Get rid of the walls around your enterprise data,” indicates that quite a few of you believe that core university data should be accessible to smartphone users.

However, yesterday’s polls have shown that not even all of the attendees of yesterday’s webinar use PINS or swipe patterns on their smartphones. The inherent difficulties in entering a complex password on a smartphone increase the likelihood that users will rely on simple passwords, if any, to access their devices. At the same time, users are expecting access to more and more university resources through their smartphones, increasing the risk of a data breach.

Where does security fit into this picture?

In Thursday’s webinar, “Smartphone Privacy & Security, What Should We Teach Our Users?“, the speaker, Norman Sadeh, indicated that mobile users are three times more likely to fall for phishing attempts. That statistic implies that spear phishing against university communities, which already demonstrates more success than we’re comfortable with, will be even more effective against smartphone users. As we find ourselves more and more hurried, making quick decisions just to handle the ever-increasing stream of information flowing at us, we’re more prone to fall for these attacks.

I would guess that many of us who own smartphones are using them to access our university e-mail, if not other university resources. Most of us don’t have any control over whether someone may e-mail us private or confidential information. If our smartphones become the weakest link in protecting data, they will be targeted.

How many of us have misplaced our smartphones or left them sitting on our desk in an unsecured office? Have you left your smartphone in a taxi or on a shuttle bus?

Increased access to university data is a desirable convenience. Will we be able to get the right combination of security controls, user training, and policies in place to allow smartphone access without it leading to a security breach resulting in a notification event or embarrassment to the university? What kinds of security controls are you using to prevent this? What security apps do you recommend to your users?

Lots of troublesome questions. Where are the answers?

Ben Woelk
Co-chair, Awareness and Training Working Group
EDUCAUSE/Internet2 Higher Education Information Security Council

Policy and Awareness Analyst
Rochester Institute of Technology

ben.woelk@rit.edu
https://security.rit.edu/dsd.html
Become a fan of RIT Information Security at https://rit.facebook.com/profile.php?id=6017464645
Follow me on Twitter: https://twitter.com/bwoelk
Follow my Infosec Communicator blog at https://benwoelk.wordpress.com

This blog entry is part of the EDUCAUSE Mobile Computing Sprint and is cross-posted at https://www.educause.edu/blog/bwoelk/SecureMobileanOxymoron/227983


  • 4

Mobile Devices: Paradigm Shift or Just Another Content Delivery Mechanism?

Category:EDUCAUSE,Higher Education,Information Security,Infosec Communicator,Internet Safety,mobile device,Privacy,Social Networking Tags : 

I’m curious about whether you think the integration of mobile devices into curricula is a “game changer/paradigm shift” or whether you regard it as just another content delivery mechanism. As a technical communicator, I’ve looked at the mobile device primarily as an additional delivery vehicle; a channel that can be used to reach others. As an educator, I’m thinking of the possibilities of a course structured around mobile devices as the main education platform. As an information security practitioner, I’m wary of the privacy risks and potential cyberstalking.

Will mobile devices be a boon or a bane? Will they cause a profound change in learning? Are they just a stepping stone to the next big thing?

I’m not sure. Let’s look at a few recent game changers:

  • Personal computing has been and will continue to become ubiquitous. We have access to immense amounts of information. That has changed how we research practical information. Do any of you use printed maps? What about calling 411 for someone’s phone number?
  • The growth of E-readers may eventually sound the death knell of traditional print. Newspapers are scrambling to adapt to a digital audience as they find print circulation shrinking.
  • The transatlantic cable has been described as the Victorian Internet in the way it revolutionized communication.
  • The telephone and the elevator made modern skyscrapers possible.

What about the smartphone?

  • Access to banking is now available through smartphone apps and you either can or will be able to make payments directly from your mobile device. You can also store shopping card info and coupons.
  • Mobile devices have greatly increased the access to social networking.
  • QR codes connect mobile devices to Internet-based information

Do you agree that these are game changers? Are there mobile apps that you do consider to be game changers?

Addressing the educators in my audience, how do you see integrating mobile devices into your courses? Will you redesign your course to take advantage of their capabilities? Are they just “one more thing” to consider in your content delivery? Will you incorporate social networking with both a mobile and traditional computer interface?

I’m interested in your thoughts. I’m not an expert in this area, but I’m trying to adapt to the possibilities.

Please leave a comment so we can have a discussion! Some of you have contacted me individually. Please post here so we can learn from each other.

By the way, If we’re really lucky, maybe mobile learning will be the death of PowerPoint!

Ben Woelk
Co-chair, Awareness and Training Working Group
EDUCAUSE/Internet2 Higher Education Information Security Council

Policy and Awareness Analyst
Rochester Institute of Technology

ben.woelk@rit.edu
https://security.rit.edu/dsd.html
Become a fan of RIT Information Security at https://rit.facebook.com/profile.php?id=6017464645
Follow me on Twitter: https://twitter.com/bwoelk
Follow my Infosec Communicator blog at https://benwoelk.wordpress.com

This blog entry is cross-posted at https://www.educause.edu/blog/bwoelk/MobileDevicesParadigmShiftorJu/227783


  • 0

Higher Ed, Where’s the Mobile Content?

Category:Higher Education,Infosec Communicator,mobile device,Uncategorized Tags : 

In general, the pace of change far exceeds the ability of any large organization to adapt and adopt, be it a professional organization, an educational institution, or many companies. Mobile content is a good example. Although we’ve know that the rate of adoption is high, in a recent Chronicle of Higher Education Wired blog posting,  Kelly Truong stated that a research study at Ball State University found that about 90% of students were using their smartphones to access the internet.

At the Rochester Institute of Technology, we’re seeing some movement towards providing mobile content, including online coursework. The E. Philip Saunders College of Business has also designed a smartphone app for their students.

Do you use a smartphone to access the internet? Are you happy with the experience? Are any of your companies/colleges, etc. designing web pages for mobile users? Are you designing coursework for mobile users? Developing any corporate apps for iPhone, Android, Blackberry, etc.?

Enhanced by Zemanta

  • 3

Is “Secure Mobile” an Oxymoron?

Category:Information Security,Infosec Communicator,mobile device,Risk Tags : 

If you haven’t noticed, mobile device use is pretty much ubiquitous. Apple iPhone/iPod/iPad, Windows Mobile, Palm, Google Android, Blackberry–all of these device families have their own Operating Systems that could be exploited by an attacker.  Yet, we’re seeing more and more mobile device use in business settings.

SMobile published a white paper yesterday (6/22), Threat Analysis of the Android Market,  about the ~20% of apps available from the Google Android Market that are granted permissions to potentially exploitable features/information when they’re installed. As they point out, it’s pretty easy for an attacker to encourage a potential target to install a seemingly innocent application when that application is available from the Google Market and was never vetted for security issues.

Another big issue is how easy it is to lose a mobile device. If the device is not encrypted, any confidential or private information you’ve placed on the device is at risk. If you’ve cached login credentials to your institution’s network, an attacker has easy access.

We’re working on developing mobile device security guidelines for use in accessing our university data. Because almost all devices are individually-owned and pose their own unique security risks, it’s hard to develop a one-size-fits-all policy. We’re looking at both general and device-specific guidelines.

I’ve included a preliminary draft below, parts of it based on materials developed by EDUCAUSE member institutions.  What would you add or subtract? Is it a good approach?

General Guidelines for Mobile Device Use

  • Configure mobile devices securely. Depending on the specific device, you may be able to:
    • Enable auto-lock. (This may correspond to your screen timeout setting.)
    • Enable password protection.
      • Use a reasonably complex password where possible.
      • Avoid using auto-complete features that remember user names or passwords.
      • You may want to use a password safe application where available.
    • Ensure that browser security settings are configured appropriately.
    • Enable remote wipe options.
      • If you’re connecting to the university email with ActiveSync for email and calendaring, you may be able to wipe the email and calendaring information from your device remotely.
      • Third party applications may also provide the ability to remotely wipe the device.
    • Ensure that SSL protection is enabled.
  • For improved performance and security, register your device and connect to the university WPA2 network where available.
  • Disable Bluetooth (if not needed). This will help prolong battery life and provide better security.
  • Keep your mobile device and applications on the device up to date. Use automatic update options if available.
  • Install an antivirus/security program and configure automatic updates if possible. Like computers, mobile devices have operating systems with weaknesses that attackers may exploit.
  • Use an encryption solution to keep portable data secure in transit and at rest. WPA2 is encrypted. 3G encryption has been cracked. Use an SSL (https) connection where available.
  • Take appropriate physical security measures to prevent theft of mobile devices.
    • Never leave your mobile device unattended.
    • Report lost or stolen devices and change any passwords immediately.
    • Include contact information with the device.
      • On the lock screen (if possible). For example, “If found, please call 585-475-HELP.”
      • Engraved on the device.
      • Inserted into the case.
  • Know your mobile vendor’s policies on lost or stolen devices. Know the steps you need to take if you lose your device. Report the loss to your carrier ASAP so they can deactivate the device.
  • Use appropriate sanitization and disposal procedures for mobile devices.
Enhanced by Zemanta

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,235 other subscribers

Categories

Support Introverted Leadership on Patreon

Blubrry affiliate banner