Secure end points key for mobile computing

Computers and mobile devices using wireless networks or other end points by company employees are posing increasing threats to their organizations’ computer systems, although there are ways IT managers can reduce risk, according to an analyst Thursday at the Gartner IT Security Summit 2005 in London.

IT managers do not have much control over end points, and even the devices used on those end points may be employees’ home computers, said Jay Heiser, research vice president with Gartner Inc. Those employees are also demanding more services and flexibility for an ever wider array of devices, increasing demand on IT departments, he said.

“IT doesn’t want to be nursemaiding a bunch of users on laptops,” Heiser said. “The risks seem to be expanding faster than our ability to deal with them.”

Heiser’s presentation came during the last day of the two-day conference, which focused on a range of information security issues such as authentication, mobile security and access.

Several methods can be employed to reduce the risk of users on questionable end points, Heiser said. Patching, protecting portals and gateways along with an awareness of an organization’s system architecture are key.

Authenticating with user names and passwords isn’t reliable, since sniffer programs can pick up new ones despite long lengths or frequent expiration dates, Heiser said. If a user can’t be authenticated on a system, then “you might as well live with the worms,” Heiser said.

Limiting the software on end point machines helps reduce the complexity, Heiser said. “Only allow what is absolutely necessary to get the job done,” he said. Also, the tighter the configurations are, the lower the chance for a security failure.

It’s expected that as mobile phones and personal digital assistants become more complex, they are more likely to suffer the same ails, although now it is expensive to encrypt them. “Tomorrow, we expect to see worms on mobile phones,” Heiser said.

Encryption can help preserve data loss, but that data should also be backed up, he said. The trend is moving toward automated back-up in clear text, he said.

Other options for more secure end points entail pushing lightweight code to the end points, treating those machines as just terminals. Programs can run Active X or Java, but would be shielded from the host system, ideally isolated from them, Heiser said.

A universal configuration management system — one that ensures every machine is up-to-date rather than a sporadic “vitamin” approach — will help ensure integrity, he said. All it takes is “one bad apple to ruin the barrel,” Heiser said.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now