Mobile device security in the US military comes under fire

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

On March 26th, the Inspector General released a report on the effects of BYOD (bring your own device) on the U.S. military.

Among the report's findings:

Mobile devices were not secured to protect stored information.The US Department of Defense (DOD) did not have ability to wipe devices that were lost or stolen.Sensitive data was allowed to be stored on commercial mobile devices acting as removable media.DOD did not train users and did not have them sign user agreements.The Army CIO was unaware of more than 14,000 mobile devices used throughout the Army.

Ouch.

This from an entity that seems to have policies and regulations for everything.

The Army did implement a good policy regarding geotagging a while back, realizing the risk that came with soldiers taking pictures that automatically had location information embedded in metadata.

However, given the lack of management of the devices, how would the military know for sure that the geotagging has been disabled?

And if the United States Army, with all the endless policies, is having a difficult time with BYOD, how is a small or medium-sized business going to cope?

Why does this all matter?

Answer: Data loss. Stolen data is massive business for the bad guys. A phone left in a cab or at an airport can be a goldmine of sensitive information. Consider the case of the US Secret Service contractor who left two tapes of sensitive data on the DC Metro train.

What crook wouldn't have loved to have gotten a hold of two databases full of juicy personal information of agency employees, contractors and possibly informants? It's just another example that even the most "security conscious" people have forgetful moments, or moments of distraction and can easily leave something behind.

Last year, Sophos did an informal study and found that 42% of lost mobile devices aren't protected with any security measures.

Now of that number, 20% had access to business email, which could contain confidential information. Small businesses are even more at risk - just because you are small doesn't make you less of a target.

We have written several articles about handling smartphones in a business before and have provided some sage advice within about how to implement BYOD, but how do you create a BYOD policy?

Where's the best place to start? Sophos CTO Gerhard Eschelbeck outlines the following tips in a recent whitepaper.

7 steps to a BYOD security plan

Identify the risk elements that BYOD introduces. Measure how the risk can impact your business and map the risk elements to regulations, where applicable.Form a committee to embrace BYOD and understand the risks, including business stakeholders, IT stakeholders and information security stakeholders.Decide how to enforce policies for any and all devices connecting to your network including mobile devices (smartphones), tablets (e.g., iPad) and portable computers (laptops, netbooks, ultrabooks).Build a project plan to include these capabilities: Remote device managementApplication controlPolicy compliance and audit reportsData and device encryptionAugmenting cloud storage securityWiping devices when retiredRevoking access to devices when end-user relationship changes from employee to guestRevoking access to devices when employees are terminated by the companyEvaluate solutions. Consider the impact on your existing network and how to enhance existing technologies prior to next step.Implement solutions. Begin with a pilot group from each of the stakeholders' departments. Expand pilot to departments based on your organizational criteria. Open BYOD program to all employees.Periodically reassess solutions. Include vendors and trusted advisors. Look at roadmaps entering your next assessment period. Consider cost-saving group plans if practical.

Regardless of how big or small your 'army', securing your organization's devices and the data on those devices is at the front line of maintaining a strong IT security defense.

Follow @SophosLabs
Follow @NakedSecurity

Smartphone map and mobile note images from Shutterstock

View the original article here

Anatomy of an Attack comes to Melbourne, Australia

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Are you sceptical of "technical" and "educational" sessions promised by software vendors? You should be. They're often run by sales guys. No disrespect intended, but technical sessions should be led by technical people, don't you think?

Sophos's Anatomy of an Attack seminars are different.

They're not about products; they're about the threat.

They're not about showing off Sophos's technology; they're about teaching you to think like the Bad Guys.

The Australian Anatomy of an Attack series is an extensive live demonstration, led by well-known and experienced Sophos researcher and presenter Paul Ducklin.

The Anatomy of an Attack is followed by luncheon and an optional demo and Q&A session with Sophos product specialist Aaron Bugal. (Aaron's a techie, too, not a sales guy :-)

You will actually see - live, but off-line and in safety - how a range of cybercriminal technologies work:

* Ransomware
* Advanced Persistent Threats
* Search engine poisoning
* Command injection
* Advanced JavaScript trickery
* Fake anti-virus, aka Scareware

Know how your enemy thinks and operates and you will be much better placed to defend both yourself and others.

The next Anatomy of an Attack session in Australia takes place in Melbourne, Victoria, on Tuesday 22 November 2011. It runs from 09:00 to 13:30, includes morning tea and luncheon, and it's free.

The venue is the City Convention Centre, 300 Flinders Street, Melbourne 3000.

We'd love to have you along, but places are strictly limited so you must register if you want to come.

(Don't worry if you register too late to get into this one - we'll put you first on the list for next time!)

This event is eye-opening, entertaining and educational - and we promise not to subject you to any Death By Powerpoint.

If you're not from Melbourne but would like to get a feel for what the sessions are about, please check out our Anatomy of an Attack videos online.

Follow @duckblog

View the original article here

Motorola's Latest Phone Comes as No Friend to Hackers - Wired News

Motorola's Droid 3 debuted on Thursday, though phone modification enthusiasts aren't happy with its locked-down software. (Photo courtesy Motorola)

For phone modification junkies, the Android software platform comes with a host of mod-friendly features. It’s too bad, then, that Motorola’s latest Android phone lacks all of them.

Motorola’s Droid 3 features a locked boot loader, which is a program that loads the operating system software on every smartphone when it’s turned on. The company said it planned to change the policy this year.

The news first came from a Motorola support forums representative.

“As we’ve communicated, we plan to enable the unlockable-relockable boot loader in future software releases, starting in late 2011, where channel and operator partners will allow it,” said a Motorola spokesperson in a statement provided to Wired.com. “Droid 3 is not built on a software version that includes this feature.”

Locking down the boot loader is a big pain for those who want to modify their Android phone operating systems. Essentially, it drastically limits the extent of modification and customization you can accomplish on your phone. If you wanted to install a particularly popular piece of modding software like, say, CyanogenMod — a very popular custom Android build that optimizes a phone’s hardware performance and adds a number of nifty flourishes — with a locked boot loader, you’re out of luck.

In today’s smartphone landscape, handset manufacturers face pressure from wireless carriers like Verizon and AT&T to lock down phone boot loaders. This is done especially to prohibit the potential installation of software used to do things that carriers don’t want you doing, like, say, capture licensed streaming content. There’s also software available that lets you tether your phone to your computer — providing it with an internet connection for free — a feature for which wireless companies normally charge users. Bypassing that charge means cutting into a carrier’s bottom line.

Motorola doesn’t want to deal with the tech support nightmare that widespread phone hacks entail. “If you brick your phone messing with it” — which basically means rendering the device useless, like an electronic “brick,” as it were — “we don’t want to have to fix it under warranty,” a Motorola representative wrote in a message board post.

Because of all this, hacker-unfriendly phones aren’t uncommon. Motorola’s Atrix debuted with a locked boot loader, as have many of the company’s phones since the release of the Droid 2. Motorola’s upcoming Photon 4G smartphone will also be locked down.

Android modification junkies aren’t happy about Motorola’s decisions. In March, one Motorola smartphone owner started an online petition, asking others who don’t agree with the company’s locked boot loader decisions to sign and bring up the issue on Moto’s Facebook page. As of this post’s publishing time, the petition has over 10,000 signatures.

Given the hardware specs on the Droid 3, it’s especially disappointing for hackers to see the phone debut as mod-unfriendly. The Droid 3 has a beefy dual-core 1GHz processor under the hood, which, when used in conjunction with modding software, can be overclocked to faster speeds.

The future isn’t entirely grim for phone hackers. Motorola continually promises a change in locked boot loader policy come late 2011, and other companies like Sony Ericsson have even begun to court the modding community, providing a detailed list of instructions on how to unlock the company’s phones.

It seems as if the predominant feeling is “we’ll believe it when we see it.”

“There’s not a single reason to believe that Motorola has truly changed their views,” wrote an angry Motorola message board user in a post. “We’re not saying you have to unlock all our devices now, but a little sign of good faith would be much appreciated.”

Mike is a Wired.com staff writer covering Google and the mobile beat. He's written on a number of different tech topics, from startups to social media. Check out his Google+ profile here.
Follow @mj_isaac and @GadgetLab on Twitter.

View the original article here