This article is sponsored by Booz Allen Hamilton.
Organizations across all industries have made mobility a centerpiece of their strategies. Federal organizations are no exception: in a 2016 survey by Market Connections, 86 percent of respondents said that a mobile device is critical to performing their job. However, when a device holds or has access to highly sensitive data that could literally walk out the door, the threat to national security is the paramount concern. Enabling mobility and enforcing mission-critical security are a challenge. Thanks to new technologies, it is not an insurmountable one.
Sponsored content from Booz Allen Hamilton: Learn more about enforcing mission-critical security with District Defend™.
The March to Mobility
The same Market Connections survey found that three-quarters of defense and civilian agencies feel that it is very or extremely important to have mobility. In fact, nearly all offer some form of mobility options to their employees. Broadening mobile access brings a number of benefits, especially as organizations both inside and outside of the government compete for talent. Thanks to mobile devices, individuals are better able to strike the right work-life balance by being more flexible in where they work. The result? Increased productivity and higher retention across the workforce. Mobility can also lower per-employee costs associated with IT investment, real estate and facilities, and employee welfare.
While the items above are compelling enough, the overriding fact is this: mobility is how work gets done. Work has steadily evolved from desktop to laptops and tablets. This transition has taken place in parallel with transformations in digital proficiency, working styles and worker expectations. Agencies have invested heavily in workplace initiatives to achieve these transformations. To tether workers to a cable is to fall behind. A sound mobile strategy is critical for future preparedness.
Lost or stolen devices pose a significant threat to national security. In a 2015 survey of IT leaders from global enterprises, IDG reported that 95 percent agree that mobile access to data increases the risk of a security breach, and 74 percent state that their organization experienced a data breach as a result of a mobile security issue. A 2014 Ponemon Institute study found that among those responsible for security of mobile devices, 81 percent report that stopping employees from using insecure devices is difficult, 67 percent say that they can’t detect employees who use insecure devices, and among those who do implement security controls, more than half state that employees circumvent or disable them. Market Connections reports that even among defense and civilian agencies that work with highly sensitive and classified data, 43 percent experience issues with securing and monitoring mobile devices.
Granting access to highly classified data calls for stringent security that enforces role-based policy access without interfering with less-sensitive or personal uses. However, the potential for loss or theft that could compromise national security cannot be ignored. IT must be able to remotely wipe the missing device to prevent data loss. Yet this level of security remains elusive. Market Connections reports that among defense and civilian agencies, 27 percent lack measures to prevent physical hacking, 32 percent do not have control over device location, and 19 percent cannot automatically enforce protocols.
The Solution for Mobile Data-Loss Prevention
The challenge at this extreme level of security is to maintain the advantages of mobility while closing the security gaps by adapting the level of security to mission needs. Conventional endpoint security solutions are software only. Being resident in system memory makes them vulnerable to being bypassed, overwritten, or otherwise disabled.
A solution that senses, executes, and enforces appropriate security policies before the device is allowed to boot provides fail-safe security for the most critical mobile deployments. This type of secure mobile device platform is location aware and can protect both the device and the data it contains depending on the situational context. Zone-based security policies, for instance, allow specific types of access only in designated physically secure areas while granting different levels and types of access appropriate to locations elsewhere.
The hardened, context-aware platform can prevent the device from booting while traveling to prevent it from being operated or tampered with if it falls into the wrong hands. Multilayer encryption protects any confidential data stored at rest within the device. If the device is lost or stolen, remote forensic wipe automatically clears the device and renders the contents unreadable and the device unusable, withstanding the most sophisticated and persistent attempts to resurrect it.
With such a solution in place, the traditional security concerns that come with a mobile deployment become a nonissue. Organizations instead devote 100 percent of their attention to implementing the ideal mobile strategy that best supports the mission.