BYOD: We can't repel malware of that magnitude! -- Admiral Ackbar
As I have mentioned in other articles, [http://exm.nr/x8dv4p] malware is not going away. If anything it is going to explode in the coming years due to the continued erosion of IT standards in the workplace. Technologies such as cloud computing, social media and memes such as BYOD (Bring Your Own Device [to the workplace]) are prepared to compromise enterprise security by:
1. Allowing devices that cannot be managed or secured into the workplace environment and allowing users to store company data on those devices. Such devices can easily be lost, stolen and the information vulnerable due to a lack of viable security measures or even the ability to be wiped remotely.
2. Devices such as smartphones or other mobile technology often has limited wireless security or protection, making grabbing data from such technology the next logical step from the cracking community. Do you remember Firesheep? A tool that allowed a remote hacker to grab information from Mozilla browsers in unsecure environments such as coffee shops. [http://en.wikipedia.org/wiki/Firesheep]
3. As the rise of BYOD continues and resistance to standardization grows, malware will continue to be a rising threat for Android and iDevices alike, [http://zd.net/w20FMG – Android users hit by scareware scam], for the simple reason that apps created for both devices, while monitored loosely, are not absolutely guaranteed of being without sinister purposes in addition to providing whatever resource information they APPEAR to be providing. So while it may be providing you a map to downtown Boston, it could also be monitoring your credit card or online bank information at different locations as well.
4. Social media has not stopped being both a productivity time sink, costing the nation billions in lost productivity (neither commenting for the good or the bad of this, noting it, nothing more) and a vector for virus transmission, personal information gathering, and credit information hacking. Facebook, Twitter, Sony, Google and Amazon have all experienced theft, leaks, loss or outright sale of personal data in 2010-2011 and this trend show no sign of slowing.
5. While the cloud offers the option of being a means of creating virtual environments that are claimed to be safer than your current environment, it means relying increasing on an internet whose services are either being turned into commodities (allowing their prices to be changed, usually higher, without warning or recourse) or those services will be subject to powerful new government interventions such as SOPA or Protect IP [http://en.wikipedia.org/wiki/Stop_Online_Piracy_Act], which may make working with materials and providers who will be forced to increase the costs of their service to offset their increases caused by having to improve monitoring of their technology for copyright infringement. This cost is always directed at the user of the technology.
6. Nor does SOPA actually ensure you are any safer from hacking, indeed it may simply be another way such activity is lost in the shuffle as hackers are far more agile in their ability to develop their responses to technology than mainstream users. During the transition to SOPA standards, systems will be more vulnerable than ever.
7. It appears IT is losing the battle for standardization as a means of protecting the enterprise. New technologies such as virtualization promise the ability to deliver the PC experience to any device but most of those are also dependent on the Internet as the deliverer of service. This only means one thing. The cost of protecting your enterprise will increase as the vectors — devices, browsers, clients, cloud, virtualization, continue to proliferate.
In summary: Our enterprise networks have never truly been safe. The threats ranged from:
- Inadequate layered defenses against attacks: There are still numerous environments especially in small to medium size businesses that do not have firewalls of any kind, any sort of data protection, backup, or redeployment procedure in case of equipment failure, anti-malware, or anti-virus technology in place.
- Social engineering: manipulating users in an environment to release information about the systems they use to make hacking easier
- Poor Password Management: Not creating standards for the effective use, configuration or dissemination of difficult to crack passwords
- Poor standardization of environments: reducing the number of potential holes in the environment by reducing the number of different versions of operating systems, programs and infrastructure support systems
- Poor policy management: The inability of environments to create usable, enforceable policies designed to make repair, replication, storage, service agreements, backup and responsible use of the office technology to protect company assets from theft, loss, or accidental erasure.
There are many other threats, but our environments have been safer than before many of these ideas were enacted, but the truth of the matter has been our virus software is always at least one day behind the release of any new virus, malware or exploit. Indeed, the zero day release of a virus or exploit could allow thousands or even millions of devices to be infected before anyone is aware the problem has occurred.
In days to come, the already existing suite of issues will only be added to with the continued threat of cloud computing downtime, legitimate accessibility as well as unwanted attacks from outside sources, rising costs both in terms of energy use and costs from service providers and the increasing vulnerability BYOD will bring to the enterprise as hackers/crackers begin to exploit the weaknesses of said devices while under-staffed, overworked and under-appreciated IT departments attempt to stem the tide while providing these new and highly desired services and technologies users feel empower them, without understanding the consequences of that empowerment. It empowers the Dark Side as well. [http://www.csoonline.com/article/print/696325]
@ebonstorm – Thaddeus Howze Atreides
A Matter of Scale 