Endpoint May 4, 2018
By Vivien Raoul 3 min read

Organizations in every industry, from banking to retail, healthcare and more, are required to apply mobile data protection rules set by governments that impose massive fines in cases of noncompliance.

Until the early 2000s, it was simpler to control data flows because information was mostly accessed from computers. Since then, companies have digitized their frameworks and services, creating a cloud-first and mobile-first world — and greatly increasing the amount of data transiting between mobile devices, computers and servers. As a result, corporate and personal data is now commonly accessed by smartphones and tablets, leaving it highly exposed to attacks targeting mobile devices.

Due to these changes in the way clients and other collaborators consume data, organizations now face the challenge of ensuring that their mobile frameworks do not conflict with data protection regulations. This means data must be collected accurately and securely for limited, clearly stated purposes. Furthermore, it must be stored for no longer than is absolutely necessary.

Four Steps to Properly Secure Mobile Data

Below are four steps security leaders should take to ensure that enterprise mobility does not infringe upon the privacy of the personal data your collaborators and clients handle.

1. Evaluate Mobile Exposure and Risk Levels

Whether an organization handles personal data, has a mobile fleet, allows mobile workers to connect to hot spots or develops mobile applications will determine the extent to which its mobile framework exposes data. During the evaluation stage, security leaders should list all the data handled by collaborators and clients to determine whether any of it is personal. Then, they should define the width of the mobile framework to quantify the risk exposure.

2. Assess Security Measures

You may have set a mobile security policy forbidding your employees to download applications from third-party stores and implemented enterprise mobility management (EMM) to secure your mobile fleet. But are these measures enough to truly understand your data exposure level? This stage is about diagnosing your mobile framework to make sure the personal data handled by your mobile users is efficiently protected against leakage and theft.

3. Adapt Security Measures to Risk

If your organization’s current level of security is not commensurate to your risk and exposure, it is noncompliant with mobile data protection regulations. Security leaders must implement new measures to meet legal privacy standards.

An EMM solution provides a single platform to manage mobile devices, apps and data. From a security point of view, this allows IT leaders to:

  • Enforce top-down security policy on devices.
  • Activate mobile threat defense (MTD) capabilities to fully protect the managed fleet against mobile threats.

The MTD technology smoothly integrates with management platforms, adding the security capabilities they lack. This enables security teams to identify and block threats in real time on users’ devices, and automatically update devices and applications’ compliance status in the EMM solution.

Mobile application security testing solutions reveal behaviors and vulnerabilities that could jeopardize data privacy from within internal applications. This gives analysts a clear understanding of what data applications collect and handle.

To protect enterprise data against external threats, an application self-protection solution secures mobile apps from the inside out by adding the security layer in their source codes. This in-app module builds self-aware and self-protective applications.

4. Prepare for the Inevitability of a Breach

Some regulations, such as the European Union (EU)’s General Data Protection Regulation (GDPR) and Australia’s Notifiable Data Breaches scheme, require organizations to keep track of events and actions performed on data in the event of a breach. To comply with these requirements, organizations should deploy a security information and event management (SIEM) solution and enrich it with mobile data.

Learn More About Mobile Data Protection

IBM and security firm Pradeo implemented several integrations to deliver complete, automatic management of mobile security and help organizations comply with mobile data protection regulations. Learn more here.

 |  |  |  |  |  |  |  |  |  |  | 
Vivien Raoul
Chief Technical Officer, Pradeo

More from Endpoint
July 25, 2023

Combining EPP and EDR tools can boost your endpoint security

6 min read - Endpoint protection platform (EPP) and endpoint detection and response (EDR) tools are two security products commonly used to protect endpoint systems from threats. EPP is a comprehensive security solution that provides a range of features to detect and prevent threats to endpoint devices. At the same time, EDR is specifically designed to monitor, detect and respond to endpoint threats in real-time. EPP and EDR have some similarities, as they both aim to protect endpoints from threats, but they also have…

April 24, 2023

The needs of a modernized SOC for hybrid cloud

5 min read - Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint (EDR) technologies can detect and often stop entire classes of threats. Now we are seeing the emergence of technologies such as attack surface management (ASM), which are starting to help organisations get more proactive and focus their efforts for maximum…

April 5, 2023

X-Force identifies vulnerability in IoT platform

4 min read - The last decade has seen an explosion of IoT devices across a multitude of industries. With that rise has come the need for centralized systems to perform data collection and device management, commonly called IoT Platforms. One such platform, ThingsBoard, was the recent subject of research by IBM Security X-Force. While there has been a lot of discussion around the security of IoT devices themselves, there is far less conversation around the security of the platforms these devices connect with.…

March 30, 2023

X-Force prevents zero day from going anywhere

8 min read - This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…

© 2023 IBM Contact Privacy Terms of use Accessibility Cookie Preferences
Sponsored by si-icon-eightbarfeature