According to CTIA (The Wireless Association), “There are more than 400 million connections in America, equal to 1.2 wireless devices for every person in the country.”¹ This is a more than 100% penetration rate, since many users have more than one mobile device. Citizens of China, India, and the European Union (EU) have even greater mobile phone usage than the United States.

Mobile computing has vastly accelerated in popularity over the last decade. Several factors have contributed to this: improved network coverage, physically smaller devices, improved processing power, better price points, a move to next-generation operating systems (OS) such as Google's Android and Apple's iOS, and a more mobile workforce have fueled the proliferation of mobile devices.

Mobile devices include laptops, netbooks, tablet PCs, personal digital assistants (PDAs) like BlackBerry, and smartphones, such as Apple's iPhone and those based on Google's Android platform. What used to be simple cell phones are now small computers with nearly complete functionality, and some unique communications capabilities. These devices all link to an entire spectrum of public and private networks.

A report by IDC noted that “By 2020 mobile workers will account for nearly three-quarters (72.3 percent) of the US workforce.” This significant shift to mobile workers has gained momentum as mobile computing capabilities have improved.²

With these new types of devices and operating environments come new demands for information governance (IG) policies and unknown security risks.³ “The plethora of mobile computing devices flooding into the market will be one of the biggest ongoing security challenges [moving forward] …” the Digital Systems Knowledge Transfer Network, a UK think tank, found. “With mobile devices connecting to Wi-Fi and Bluetooth networks, there are suddenly many more opportunities [for hackers] to get in and steal personal information.”⁴

The rapid shift toward mobile computing means that companies with mobile personnel like salespeople and service technicians need to be aware of, and vigilant toward, these impending security threats, which can compromise confidential information.

Securing mobile devices is critical: a 2018 study conducted by Ponemon Institute found that data breaches average $3.86 million in direct costs, a more than 6% increase from 2017.⁵

The reality is that most mobile devices are not designed with security in mind; in fact, some compromises have been made to enable new smartphone operating systems to run on a variety of hardware, such as the Android O/S from Google. This is analogous to the trade-offs Microsoft made when developing the Windows operating system to run across a variety of hardware designs from many PC manufacturers.

New techniques by rogue hackers include smishing, which is sending phishing text messages (Short Message Service [SMS], thus “smish”) to unwitting smartphone users, in an attempt to get them to reveal login credentials or to install malware. Smartphone virus infections are particularly difficult to detect and thorny to remove. A user may be unaware that all their data is being monitored and captured and that a hacker may be waiting for just the right time to use it. Businesses can suffer economic and other damage, such as erosion of information assets, or even negative goodwill from a damaged image.

The smartphone market is rapidly expanding with new developments almost daily, each providing criminals with a new opportunity. An International Data Corporation (IDC) report indicated that smartphone sales have outpaced PC sales since 2010, and in another report that nearly 1.5 billion smartphone devices were shipped in 2017.⁶ The growth in smartphone sales and new services from financial institutions—such as making deposits remotely by snapping a picture of a check—means that there are new and growing opportunities for fraud and identity theft.

Awareness and education are key. The first line of defense is for users to better understand cybercriminal techniques and to become savvier in their use of information and communications technologies. Holding regular security awareness training (SAT) sessions helps to reduce this risk. Using an entertaining, “gamified” approach, as some SAT suppliers have released, makes SAT training more engaging and fun, and helps employees to retain core concepts.

Biometric authentication technologies (those that use retina, voice, and fingerprint recognition) are mature enough to positively identify a user to ensure the correct person is accessing financial or confidential accounts. Biometric technologies for account access are much harder to hack than traditional passwords, but it is possible to, using sophisticated techniques.

Application suppliers for mobile devices are first concerned about functionality and widespread adoption, so security is not their top priority. Users must be aware and vigilant to protect themselves from theft and fraud. On a corporate level, organizations must step up their training efforts in addition to adding layers of security technology to safeguard critical electronic documents and data and to protect information assets.

Social engineering—using various ways of fooling the user into providing private data—is the most common approach criminal hackers use, and it is on the rise. Machines do their job, and software performs exactly as it is programmed to do, but human beings are the weakest link in the security chain, and as usage trends in the direction of a more mobile and remote workforce, people need to be trained as to what threats exist, and constantly updated on new criminal schemes and approaches. This training is all part of an overall information governance (IG) effort, controlling who has access to what information, when, and from where.

With more and more sensitive business information being pushed out to mobile devices (e.g. financial spreadsheets, medical test results, business contracts, strategic plans, and the like) and advancing and evolving threats to the mobile realm, IG becomes an imperative; and the most important part of IG is that it is done on an ongoing basis, consistently and regularly. Policies must be reviewed when a new device starts to be utilized, when new threats are uncovered, as employees use unsecured public WiFi networks more and more, and as business operations change to include more and more mobile strategies. IT divisions must ensure their mobile devices are protected from the latest security risks, but users must regularly be apprised of changing security threats and new criminal approaches by hackers.

Mobile device management (MDM) is critical to secure confidential information assets and managing mobile devices. Some available MDM technologies can wipe devices free of confidential documents and data remotely, even after they are lost or stolen. They can also provide mass security patch updates. These types of utilities need to be deployed to protect an enterprise's information assets in the mobile environment.

Gartner expanded their definition of MDM, placing it under the umbrella of enterprise mobility management (EMM). While most IG and IT professionals focus mostly on finding robust MDM solutions, the supplier marketplace has started using the broader term of EMM.⁷ MDM solutions are more limited in scope; most EMM solutions include not only MDM but also Mobile App Management, Mobile Content Management, App Wrapping, Containerization, and other features. The focus is more on the information being secured rather than the device itself, as more and more information is stored in cloud services.

Current Trends in Mobile Computing

With the rapid pace of change in mobile computing, it is crucial to convey an understanding of trends, to better know what developments to anticipate and how to plan for them. When a new mobile device or operating system is released, the best thing may be to first wait to see what security threats pop up. It is important to understand the direction mobile computing usage and deployment are taking, in order to plan and develop IG policies to protect information assets.

From CIOZone.com, here are some top trends in mobile computing:

1. Long-term evolution (LTE). The so-called fourth generation of mobile computing (4G) is expected to be continue to be rolled out across North America over the next several years, making it possible for corporate users to run business applications on their devices simultaneously with Voice over IP (VoIP) capabilities. Many areas offer full 4G capabilities.
2. WiMax [Worldwide Interoperability for Microwave Access]. As LTE and WiMax networks are deployed in the US, expect to see more netbooks and laptops equipped with built-in radio frequency identification (RFID) and wireless support. [The Microsoft Surface tablet, for instance, does not allow for direct connection.] (WiMax is [a communications] protocol … that provides … much faster speeds than WiFi for fixed and mobile Internet access. The [2011] IEEE 802.16m update pushed the speed to up to 1 Giga bit/second fixed speeds.)
3. 3G and 4G interoperability. [Various wireless providers have] developed a dual mode card that will enable mobile device users to work on both 3G and 4G networks.
4. Smartphone applications. Third-party software vendors will increasingly make enterprise applications available for smartphones, including inventory management, electronic medical records management, warehousing, distribution, and even architectural and building inspection data for the construction industry.
5. GPS. Global positioning systems (GPS) will increasingly be used to identify end users by their whereabouts and also to analyze route optimization for delivery workers and service technicians. [Without GPS, apps like Uber and Waze would not exist.]
6. Security. As new and different types of mobile devices are introduced, corporate IT departments will find it increasingly challenging to identify and authenticate individual end users. As such, expect to see a combination of improvements in both virtual private network (VPN) software and hardware-based VPNs to support multiple device types.
7. Anti-virus. As more third-party business applications are made available on smartphones and other mobile devices, CIOs will also have to be [more] cognizant about the potential for viruses and worms.
8. Push-button applications. Let's say a waste disposal truck arrives at an industrial site and is unable to empty a dumpster because a vehicle is blocking its path. Smartphones will increasingly have applications built into them that would make it possible for the disposal truck driver to photograph the impeding object and route the picture to a dispatcher to document and time-stamp the obstruction.
9. Supplemental broadband. As carriers implement LTE and WiMax networks, companies such as Sprint and Verizon are looking at potentially extending wireless broadband capabilities to small businesses that don't have fiber optic or copper connections on the ground….
10. Solid state drives (SSD). Corporate customers should expect to see continued improvements in the controllers and firmware built into SSDs in order to improve the longevity of the write cycles in notebooks.⁸

Security Risks of Mobile Computing

Considering their small size, mobile computing devices store a tremendous amount of data, and storage capacities are increasing with the continued shrinking of circuits and advancement in SSD technologies. Add to that the fact that they are highly portable and often unsecured and you have a vulnerable mix that criminals can target. Considering how often people lose or misplace their mobile devices daily, and what valuable targets they are for physical theft (this author had a laptop stolen in the Barcelona airport, right from under his nose!), and the use of mobile devices represents an inherent security risk.

But they don't have to be lost or stolen to be compromised, according to Stanford University's guidelines, intended to help mobile computing device users protect the information the devices contain: “… intruders can sometimes gain all the access they need if the device is left alone and unprotected, or if data is ‘sniffed out of the air’ during wireless communications” (italics added).⁹ The devices can be compromised with the use of keystroke loggers, which capture every single entry a user makes. This can be done without the user having any knowledge of it. That means company passwords, confidential databases, and financial data (including personal and corporate credit card numbers) are all at risk.

Securing Mobile Data

The first and best way to protect confidential information assets is to remove confidential, unnecessary, or unneeded data from the mobile device. Confidential data should not be stored on the device unless explicit permission is given by the IT department, business unit head, or the IG Steering Committee to do so. This includes price lists, strategic plans, competitive information, photo images of corporate buildings or coworkers, protected heath information (PHI), and financial data such as tax identification numbers, company credit card or banking details, and other confidential information.

If it is necessary for confidential or sensitive data to be stored on mobile devices, there are options to secure the data more tightly, like USB drives, flash drives, and hard drives that have integrated digital identity and cryptographic (encryption) capabilities.

Mobile Device Management (MDM)

Mobile device management (MDM), now sometimes conflated with the broader term enterprise mobility management, is software that helps organizations to remotely monitor, secure, and manage devices such as smartphones and tablet PCs.¹⁰ MDM improves security and streamlines enterprise management of mobile devices by providing ways to contact the remote devices individually or en masse to add, upgrade, or delete software, change configuration settings, and “wipe” or erase data, and make other security-related changes and updates. More sophisticated MDM offerings can manage not only homogenous company-owned mobile devices, but also those that employees use in the workplace in a bring-your-own-device (BYOD) environment.

The ability to control configuration settings and secure data remotely allows organizations to better manage and control mobile devices, which reduces the risk of data leakage, and reduces support costs by providing more uniformity and the ability to monitor enforce company-dictated IG policy for mobile devices.

Key vendors in the MDM marketplace include VMWare AirWatch, Apple (Profile Manager) Ivanti, BoxTone, Centrify, Citrix, Good Technology (acquired by BlackBerry), IBM (Endpoint Manager for Mobile Devices), Microsoft, MobileIron, SAP Afaria, Sophos, SOTI, and Symantec (Mobile Suite).

Rapid growth is expected in the MDM marketplace, and broader EMM market, which is estimated to grow to $2.2 billion by 2022, according to a 2017 study by Strategy Analytics.¹¹ According to Gina Luk, author of the report, “The two leaders in this space are VMware AirWatch, with 19 percent, and BlackBerry/Good Technology, with 18 percent. However, MobileIron, Citrix and Microsoft all displayed strong signs of growth…. Even SAP, IBM, SOTI, Sophos, and Symantec are challenging the top players in this space for market share.” Luk went on to say, “Mobile security and growth in BYOD (bring your own devices) are primary drivers behind EMM adoption.”

EMM platforms are transitioning from “tactical device management tools to broader unified end-user computing management (UEM) platforms, crossing mobile devices, apps, and data, as well as traditional computing platforms such as laptops and PCs,” according to the reports.

IG for Mobile Computing

Stanford University's guidelines are a helpful foundation for IG of mobile devices. They are “relatively easy to implement and use and can protect your privacy” and safeguard data “in the event that the device becomes compromised, lost or stolen.”

Smartphones and Tablets

• Encrypt communications. For phones that support encrypted communication (secure sockets layer [SSL], virtual private network [VPN], hypertext transfer protocol secure [https]), always configure defaults to use encryption.
• Encrypt storage. Phones approved to access confidential information assets must encrypt their bulk storage with hardware encryption.
• Password protection. Configure a password to gain access and or use the device. Passwords for devices that access confidential information assets should be at least seven characters in length, and use upper- and lowercase letters, as well as some numerical characters. Passcodes should be changed every 30 days.
• Timeout. Set the device so that it is locked after a period of idleness or timeout, perhaps as short as a few minutes.
• Update. Keep all system and application patches up to date, including mobile OS and installed applications. This allows for the latest security measures and patches to be installed to counter ongoing threats.
• Protect from hacking. Phones approved to access confidential and restricted data must not be jailbroken (hacked to gain privileged access on a smartphone using the Apple iOS) or rooted (typically refers to jailbreaking on a smartphone running the Android operating system). The process of rooting varies widely by device. It usually includes exploiting a security weakness in the firmware shipped from the factory. “‘Jailbreaking’ and ‘rooting’ removes the manufacturer's protection against malware.”
• Manage. Phones approved to gain access to confidential information assets must be operating in a managed environment to maintain the most current security and privacy settings and monitor use for possible attacks.¹⁴

Portable Storage Devices

• These include thumb drives or memory sticks, removable hard drives, and even devices like iPods that are essentially mobile disk storage units with extra bells and whistles.
• Create a user name and password to protect the device from unauthorized access—especially if lost or stolen.
• Utilize encryption to protect data on devices used to store and/or transport confidential information assets.
• Use additional levels of authentication and management for accessing the device, where possible.
• Use biometric identification to authenticate users, where possible.

Laptops, Netbooks, Tablets, and Portable Computers

• Password protect: This is the most basic protection, yet it is often not used. Create a user name and password to protect the device from unauthorized access; require that they are entered each time the computer is used.
• Timeout: Require that the password is re-entered after a timeout period for the screensaver.
• Encryption: Laptops, notebooks, or tablets used to access confidential information assets should be required to be encrypted with whole disk encryption (WDE).
• Secure physically: Physical locks should be used “whenever the system is in a stationary location for extended periods of time.”¹⁵

Building Security into Mobile Applications

While it is a relatively new channel, mobile e-commerce is growing rapidly, and new software applications or apps are emerging for consumers as well as business and public sector enterprises. These apps are reducing business process cycle times and making the organizations more agile, more efficient, and more productive. There are some key strategies that can be used to build secure apps.

As is the case with any new online delivery channel, security is at the forefront for organizations as they rush to deploy or enhance mobile business apps in the fast-growing smartphone market. Their priorities are different from those of the software developers churning out apps.

In the banking sector, initially many mobile apps limited customers to a walled off set of basic functions—checking account balances and transaction histories, finding a branch or ATM location, and initiating transfers—but “a new wave of apps is bringing person-to-person payments, remote deposit capture and bill pay to the mobile channel. Simply, the apps are getting smarter and more capable. But with those capabilities comes the potential for greater threats” (italics added).¹⁶

Security experts state that most of the challenges that could result from mobile fraud have not been seen before. Mobile e-commerce is relatively new and has not been heavily targeted—yet. But also industrial espionage and the theft of trade secrets by targeting mobile devices is going to be on the rise and the focus of rogue competitive intelligence-gathering organizations. So user organizations have to be even more proactive, systematic, and diligent in designing and deploying mobile apps than they did with web-based apps.

Software developers of mobile apps necessarily seek the widest audience possible, so they often deploy them across multiple platforms (e.g. Apple's iOS, Google's Android, TCL Communication's BlackBerry, and others) and this forces some security trade-offs: enterprises have to build apps for the “strengths and weaknesses intrinsic to every device, which adds to the security challenges” (italics added).¹⁷

A side effect of mobile app development efforts from the user perspective is that it can reshape the way they interact with core information management (IM) applications within the enterprise.

The back-office IM systems such as accounting, customer relationship management (CRM), human resources, and other enterprise apps that are driving online and mobile are the same as before, but the big difference comes in how stakeholders including employees, customers, and suppliers, are interacting with the enterprise. In the past, when deploying basic online applications for browser access, there was much more control over the operating environment; whereas with newer mobile applications running on smartphones and tablets, that functionality has been pushed out to the end-user device.

Best Practices to Secure Mobile Applications

Mobile computing is not going away; it is only going to increase in the future. Most businesses and governments are going to be forced to deploy mobile apps to compete and provide services customers will require. There is the potential for exposure of confidential data and e-documents, but this does not mean that organizations must shy away from deploying mobile apps.²⁰ There are some proven best practice approaches, which can help to ensure that mobile apps are secure.

There are some steps that can be taken to improve security—although there can never be any guarantees—and some of these should be folded into IG guidelines in the policy development process. BankTech magazine identified six best practices that can shape an organization's app development process:

1. Make sure your organization or outside development firm uses seasoned application developers who have had secure-coding training and use a secure software development life cycle (SDLC).
2. [Developed for banking apps, this approach can be applied to other vertical apps, too.] Follow the guidance suggested by the Federal Deposit Insurance Corp. (FDIC FIL-103-2005) regarding authentication in an Internet banking environment. The guidance describes enhanced authentication methods, such as multifactor authentication, that regulators expect banks to use when authenticating the identity of customers using the bank's online products and services.
3. Make sure that the customer (or employee) is required to re-enter his or her credentials after a certain time period to prevent someone other than the mobile device's owner from obtaining access to private account information.
4. Hire an information security expert to assess the security around your mobile application servers. Unfortunately, an organization's servers are often overlooked during a risk assessment, as they require a specialized skill set to test them.
5. Encrypt sensitive data that is stored on a mobile device and account data that travels from the handset across the Internet. Ensure that the encryption is implemented properly.
6. Hire a security expert to test the security of a mobile application before you implement it across your customer base. (all italics added)²¹

Developing Mobile Device Policies

Where do you start? Developing a comprehensive mobile strategy is key before you craft your mobile device policies. You will need input from a variety of stakeholders, and you will need to understand where mobile devices fit in your overall technology infrastructure and strategy. Here are some best practices for developing your mobile device policies:²²

1. Form a cross-functional mobility strategy team—you will need the input of primary stakeholder groups including IT, field business units, and human resources (HR, for policy creation and distribution). Your strategy development process should also tap into the expertise of your risk management, compliance, records management, and legal departments. The aim will be to balance risks and benefits to improve employee productivity and guard against risk while focusing on the goals and business objectives of the organization.
2. Clarify goals for your mobile strategy—start your discussion with the big picture, the broader view of the business drivers, challenges, threats, and opportunities that mobile computing provides in today's technology context and your business context. Draw a direct line from your mobile business needs to your planned mobile support strategy and infrastructure. Keep your business goals in mind and link them to the discussion.
3. Drill down into policy requirement details—you may want to survey other existing mobile device policies to inform your mobility strategy team. Those from peer organizations and competitors will be most relevant. Then start with the basics: which types of devices and operating systems make sense for your organization to support, what changes and trends are occurring in the technology marketplace, which sensitive e-documents and data you must protect (or disallow) on mobile devices, and what available security technologies (e.g. EMM, MDM, mobile virtual private networks, or VPNs, encryption, information rights management, or IRM) you might deploy. It may be helpful to segment your mobile users into broad categories and break out a list of their specific business needs related to mobile computing. Your strategy and policies for executives will be somewhat different than for users in field business units. And you will need BYOD policies if your organization opts to go this route.
4. Budgeting and expense control—Is the organization going to buy devices and pay all mobile expenses through direct billing each month? What cost controls need to be in place? Or will mobile device use expenses be reimbursed by a flat rate or by processing expense reports? What about BYOD? Roaming charges limits? Decisions on the financial and cost control aspects of mobile computing use must be made by your mobility policy team, under the guidance of an executive sponsor.
5. Consider legal aspects and liability issues—Consult your legal counsel on this. What key laws and regulations apply to mobile use? Where could users run afoul? What privacy and security issues are most prominent to consider? What about the private data that users may hold on their own (BYOD) devices? An overarching consideration is to maintain security for private information, and to have a policy in place for data leaks and lost or stolen devices. That includes your policy on remote “wipes” of sensitive data or perhaps all data.
6. Weigh device and data security issues—since most mobile devices—especially smartphones—were not designed with security as a foremost consideration, you must take steps to protect your sensitive data, and to secure the devices themselves, without impeding business or making operation too difficult for the end user. The world of mobile computing presents new challenges that were not present when IT had full control of endpoint devices and your internal network. So clear mobile security policies and controls must be in place.
7. Develop your communications and training plan—users must be apprised and reminded of your mobile device policy if they are going to adhere to it. They also need to know the consequences of violating your policies. Your communications and training plan should be creative—from wall posters to text and e-mail messages, from corporate newsletters to group training sessions. You may want to first pilot your new policy with a small group of users. But communication and training are key: a perfect mobile device policy won't work if it is not communicated properly and users are not trained properly.
8. Update and fine-tune—There will be some misses, some places where after you deploy your mobile policy that you find room for improvement. You will receive user feedback which should be considered too. And there will be changes in the technology marketplace and user trends. A program must be in place to periodically (every six months, perhaps) review your mobile device policy and any audit information to make improvements in the policy.