Why BYOD Security Matters

I was reading a story by Ian Paul on PCWorld on the Android Trojan NotCompatible. You can read it here. There is one reason this Trojan was written, to exploit BYOD (Bring Your Own Device). As Ian states, ”…it is not a threat if you use common sense..”. Every IT security expert can now sleep easy knowing their end users always behave this way, oh wait…they don’t.

Why did I bring up BYOD? BYOD is a hot trend that solves a lot of issues for IT directors and end users, and creates a lot of additional issues for companies that embrace BYOD without addressing the security requirements. What are the base level security measures needed for networked equipment? The devices need to be checked for viruses, malicious code, software exploits, and user rights.

This is hard enough to do if you have control of every device on your network, patch all the operating systems, keep the virus definitions up to date, keep all the other software patched (Adobe Acrobat, Office, Flash, Java, Etc.), control the users access to data and potential sites with malicious code, and stopping the end user from being the security hole by writing down passwords or sharing them.

Once you start allowing your end users to connect their personal devices to your business network, you have lost most of that ability. Without implementing proper security to handle these “un-managed” devices, you may lose control of your network and vital customer and business data.

Is BYOD bad? No, it is inevitable. So just like security measures had to be taken to make Wireless networks secure, measures need to be taken to make you employee’s devices safe to connect to your network. Don’t shortcut the process, horse and then cart. Security and then BYOD.

Monkey in the Middle

Imagine a monkey with a bunch of bananas. Now imagine a monkey with a bunch of bananas trying to defend them from another monkey. I’m sure he would put the bananas behind him and keep his eyes on the other monkey trying to steal his bananas. Well now imagine a monkey with a bunch of bananas and some other monkey friends helping him to try to defend the bananas from another monkey. The first monkey has his eyes on the monkey trying to steal the bananas, but who is watching the monkey friends? This is the problem with IT network security.

I saw an article today written about a security survey provided by Bit9. You can read the story here. There were a lot of interesting numbers in the survey that stuck out to me. Most interesting to me? Nearly 2/3rds of IT security professionals worldwide think Anonymous or another hacktivist group will attack them in the next 6 months, but only 1/3^rd of the same people feel an employee is a likely threat.

It seems to me we are watching the wrong monkeys. Not that we can ignore the “professional hacker”, of course we have to secure the network. Firewalls, NAC, VPNs, all play a part, but later in the article it is reported that only 11% of the security professionals worry about the common attack methods used by hactivist groups. The biggest fear of attack by 62% of the IT security professionals surveyed is targeted attacks. Targeted attacks are things like malware and Phishing attacks.

So unless an IT department is installing Malware, it seems to me that this is being loaded by the end user. So while watching the monkey trying to steal our bananas, and trying to keep our company off the evening news, we let the other monkeys steal our bananas, and put our company on the evening news.

Ford Motor Company used to have a motto in the 80s, “Quality is job one”. Today all companies should have the motto, “Security is job one”. Security is everyone’s job, not just the security division of the IT department. What do you secure? The PCs? The servers? Hardware? Software? I say the data. We live in a world of always on, always connected, always working.

So however we access the data, wherever we access the data, whoever accesses the data, we have to secure the data. Everyone has the secure the data, from the CEO to the janitorial staff. More sensitive data is viewed inappropriately because of passwords on sticky notes or non-shredded business documents than hactivist attacks.

Watch the bananas Monkey, watch the bananas…

On a Personal Note, Part Two

It was less than 2 months ago that I shared the news with you that I had decided to pursue a new career, leaving Autotask after nearly 6 years to join Bradford Networks.

The decision for me was not an easy one, as I had built many friendships and ties into Autotask, their customers, and the industry, but I felt the need to grow personally and professionally.

The great news was that I would get to build a brand new channel with my friends and peers in the MSP/IT Services space. This was a true win win for me.

The more I explored the needs of the SMB channel for the security features that a NAC solution could offer, compliance checks, guest management, dynamic vLans, etc.,  I saw a huge potential for Bradford and the channel as I have shared with many of you.

Sadly,I am no longer with Bradford.

To say I am disappointed is an understatement. I saw, and still see, such a need, as well as a business case for these solutions in our marketplace and for our customers.

My biggest disappointment? Not being given the chance to fail. By that I don’t mean that I would have failed, in fact I think it would have been a huge win, but the chance. Isn’t that all any of us want? A chance. To win or lose, succeed or fail, but just a chance.

This has left me with a hunger, a feeling of incompleteness that feels worse than failure. I have been feeding that hunger with lessons learned, the good and bad. So as in all things in life, the only path worth taking leads forward.

Now it is time to get back to work and feed that hunger with a new challenge, a new goal, a new position.

New Year New Post

This is my first post of the new year, even though it is the 4th day of the month. What does that mean? I’ve been damn busy. Most of you know I took a new position at the end of 2011, let me tell you a little more about that and how it fits my predictions for 2012.

2011 worked out the way I saw it, more cannibalization, more competition, more mergers, less profit. None of those issues were caused by the big guys. Microsoft didn’t screw the MSP with 365, Google didn’t put you out of business with a Chromebook, Dell didn’t sell to all your customers. The MSPs need to look in the mirror to see the problem. Too much setting prices without knowing costs.

So my predictions for 2012? Some of these trends will continue, especially in Mergers and acquisitions. Small guys want to get big, big guys want to get bigger, customer wants it cheaper. Security will go to the front of the new trends, especially in the mobility segment. MDM will get pushed hard by vendors, and not add as much true network security as we need.

So why am I so busy? The position I took with Bradford Networks is growing our partner base in the MSP and SMB space for our Bradford.cloud SaaS NAC offering. The interest has been more than we can keep up with, and we are not even out in the channel yet.

The ability to help partners add and deliver enterprise grade NAC to their clients put Bradford on the leading edge of the mobility security concerns. These are concerns that current solutions cannot meet.

So feel free to contact me if you believe you need to add NAC security to your offerings, and add to my workload.