Mobile Data Security Blog

Home  »  Articles posted by Nick Banks


Death, Taxes, And Being Hacked


There are some things in life that are inevitable – death and taxes at the top of the list.  To this list, I’m adding another modern day inevitability – being hacked!

You can be phished, clickjacked, spied on or attacked by a worm – the list of deadly attacks goes on. The types of malware and new attack vectors are growing at a frightening pace and trying to fight them off has become a daily concern.

Defending against cyber attacks and repairing the damage caused by hackers who break into security systems costs UK businesses a whopping £34 billion a year, according to the Centre for Economics and Business Research.  Around £18 billion of this comes from lost revenues, whilst the IT department spends the remaining £16 billion on trying to shore up defenses.

Then there are the fines.  In 2014, for example, holiday firm Think W3 suffered a serious hack in which 1,163,996 credit and debit card records were stolen. The ICO described the incident as a “staggering lapse” and issued a fine of £150,000.

And earlier this year, Barclays had to compensate 2,000 customers when their personal details were discovered on a stolen USB device – highlighting that data.

There is no escaping it – data breaches are on the increase and fines are only going to get bigger under sweeping changes to EU legislation. But all it takes is some common sense and a robust security strategy to ensure you aren’t in the firing line.


Don’t leave the doors open

When it comes to securing devices, the obvious option is encrypting and password protecting data. IT needs to install tamper-proof encryption software at the endpoint so that all data on the devices is encrypted by default. Solid security policies, when paired with advanced device management features such as remote lock and remote wipe, go a long way in protecting sensitive business data from falling into the wrong hands.


Act now

The clear message is that businesses need to get their houses in order when it comes to security. When the EU data protection regulation comes into force next year, businesses will not only need to be confident in their file transfer policies, but they will also need to be able to show a very clear audit trail.

It is not if you are going to be hacked, but when. And unlike death and taxes, this is something you can actively work to avoid.



Keeping Patient and Hospital Information Safe

In September 2014, Forrester Research published a brief titled “Stolen and Lost Devices Are Putting Personal Healthcare Information at Risk”. Amongst the findings were two important trends:

Healthcare is becoming more mobile – approximately one-third of healthcare employees now work outside the office or clinic at least once a week.

Healthcare records are five times more likely to be lost due to device theft or accidental loss.

Today, personal healthcare information (PHI) records are more accessible than ever before. These PHI records contain important personal information such as social security numbers, medical history, and insurance information. Technological progression in the medical world is giving us advancements such as real time medical data on our smartphones and mobile messaging systems so hospital staff can get to patients faster. Although this progression is exciting, with all of this patient information floating around in technology, it makes it harder to keep our data safe.

With so much mobility, it’s not surprising that data protection has become a big problem. Mobile devices are simple to carry from one workplace to the next, but they can be easy to lose. To protect our data, we need a way to prevent unauthorized people from accessing the content of a lost or stolen device.

The solution is to use encrypted USB or external hard drives, such as the new IronKey™ S1000 3.0 USB. These secure storage devices combine encryption, which encodes data, making it unreadable to all but authorized users, with cloud-based management functionality that enables an organization to remotely wipe data from a device even if it is no longer in their possession.

Healthcare facilities need to address the realities of mobile work practices but they also need to protect the information in their care. The task is made a lot easier with a good device policy and the right tools.


The Age of Hacking

In today’s digital age, teaching children to code seems like a fantastic idea. Children are already spending huge amounts of time using technology, whether it’s a laptop, smartphone or tablet device and these IT skills can be essential in their future careers. However, whilst we must help a new generation of competent workers prepare for the digital world, how can we make sure that children will use their coding and programming skills for good and not evil?

Over the past years we’ve seen a number of technological innovations aimed at equipping children with basic programming and coding skills – from the Raspberry Pi to the recently launched Hackaball, a programmable ball aimed towards 6-10 year-old children. This demographic has been a key target for the UK government who have dominated the primary computing curriculum since September 2014.

However, with these skills being so easily transferrable to illegal activities such as hacking and cybercrime, how can we ensure that the lure of mischief, malice and money won’t sway children to ‘the dark side’? In January of this year, a seven-year-old girl hacked a public Wi-Fi network in just over ten minutes by learning how to set up a rogue access point to activate what is known as a ‘man in the middle’ attack. We know that this is already happening – hackers as young as 16 years old have been arrested for cybercrime, and the Home Office has warned that young video game hackers could be the next generation of cybercriminals.

So how can we tackle this? When it comes to children and young adults, the first place to start is at school and at home. Responsible adults, teachers and parents have a duty to ensure that their children, or pupils, are not engaging in criminal activity, and this is no different in the cyber world.

However, the problem we encounter here is the massive gulf between adults and children when it comes to understanding technology. An Ofcom survey released in August last year found that younger people have a far more advanced understanding of technology devices than adults – with 6 year olds having the same level of knowledge as the average 45 year old. In fact, teenagers aged between 14-19 years old are the most digitally confident in the UK.

If teachers and parents are to monitor and guide young people’s use of technology and make sure they’re not becoming involved in cybercrime, they must first be able to understand the technology themselves.

Secondly, we must consider the types of devices and technology that young people are using and put appropriate security measures in place to limit the possibility of malicious use. Technology like the Windows To Go USB Flash Drive would give young coders a replica desktop, just like the one they have at school, that they can take home and use on any device, without affecting or accessing the data and operating system sitting on that device. With a Windows To Go device it’s very easy to manage activity. The school can control the transfer of information and wipe, delete, monitor actions on the device, this way, the youngsters can hone their coding skills without being able to get in trouble by conducting activities outside the school’s remit.

What is clear is that we must not discourage children from learning these skills – they are absolutely essential for future employment and also play an important role in their everyday socialising with their peers. We must also accept that we cannot stop this evolution. Children are already learning these skills, with or without your knowledge and input, so the best we can do is to help shape that knowledge and put them on a good path.


Whistleblowers: Data Theft or Public Service?

A Perspective from the UK

Over the past few years there have been a number of high profile cases where whistleblowers have leaked information to the public, highlighting wrong-doing, corruption and malpractice amongst trusted institutions. Whilst some of these cases have clearly disclosed information that is in the public interest – for example the recent inquiry into the fatalities at Morecambe Bay Furness Hospital – other whistleblowers have disclosed sensitive corporate data leading some to question whether the information is truly in the public interest, or is in fact a data breach.  

What is clear, is that whistleblowing can have huge financial repercussions – in fact, The Pentagon has recently said that it may cost billions of dollars to overcome the damage to military security by Edward Snowden’s release of classified intelligence documents.

From a corporate perspective, unfounded whistleblowing is essentially another type of ‘insider threat’, and we know that this issue is climbing higher on the risk agenda for IT departments worldwide. Organisations must assess the threat that this form of data leakage can have on their business and put measures in place to protect their businesses.

Firstly, businesses can use an array of solutions to protect corporate data on computers, laptops, wireless networks and in the workplace. For organisations seeking extra security, an Enterprise Management System, with a command centre whereby device activity can be viewed from all over the world, provides a robust and highly secure solution. Data can be securely stored and if an employee fails to return to work, a device can be destroyed remotely.

There are however, many other complex regulations to consider when it comes to the issue of whistleblowing.

Under the Enterprise and Regulatory Reform Act 2013, whistleblowers have to show that they “reasonably believe” that the disclosure they are making is in the “public interest”. Unfortunately, what amounts to “public interest” is not defined in the legislation and it will be left to the courts and tribunals to lead the way with their interpretation.

The law states that an individual is permitted to declare information/whistleblow if someone’s health and safety is in danger, if there is damage to the environment, if the employer is committing a criminal offence, if the company is failing to honour legal obligations or if the company is covering up a wrongdoing.

Many of these exceptions will pose no threat to the everyday corporation, therefore the key threat is the possibility of an ex-employee sharing sensitive information.

Although the Data Protection Act gives businesses additional protection when private data is at stake, there is still a concern that ex-employees will speak out about historic events such as previous data breaches experienced whilst employed.

A ‘Compromise Agreement’ is becoming a common solution to the problem around employee trust. Organisations are adding a clause in contracts to ensure that all confidential information remains confidential, and employees are then prevented from making defamatory comments or disclosing sensitive information, even after they have left a company.

This month, Sir Robert Francis QC announced a ban on the ‘Compromise Agreement’ for hospital staff. In the health sector, where lives are at stake, it is clear that the act of whistleblowing must be protected.  Some incredibly shocking stories have been revealed highlighting horrendously poor care and unacceptably high mortality rates. This has of course had a positive outcome and forced trusts to introduce new regulations to improve patient care.

For the corporate world, however, whistleblowing poses quite a different risk and can cost organisations hundreds of thousands, or even millions of pounds to repair. Businesses must reduce this risk by protecting their data, which lives both inside the building and outside on employee mobile devices and in the cloud.  This way, they can put themselves one step ahead of the game.

Organisations need to ensure that they have permissions and privileged access in place to protect sensitive information to avoid the potential for these to be breached.

Businesses need to keep account of and collect any devices that may have been issued such as mobile phones; tablet, laptops, proprietary software or data, failing to do so could have detrimental repercussions.

Ensuring intellectual property and sensitive data remain secure is an on going challenge, and if businesses are failing to protect this information, the threat from whistleblowers will endure.


The Value of Encryption

With high profile security breaches such as the iCloud hack and the leak of celebrities’ private photographs hitting the headlines, the concern for the security of our own personal information and sensitive data is mounting. Apple’s response to the data breach was to increase the level of security following the incident with the introduction of default encryption on phones, demonstrating the importance of encryption as a safeguard to protect data.

Encryption is simply the translation of data into code, using a defined algorithm, and is considered one of the most effective means of ensuring data security. Access to encrypted files requires a key or password that enables you to decrypt it by restoring it to its original form. Whilst most data transmitted over a network is sent in clear text, by incorporating encryption algorithms, users can protect data and make sure that only the intended recipient can decode and read the information.

Although there are many different types of encryption, they all serve the same purpose: to keep our data protected and secure. Storing any sensitive information is inherently risky, but in order to do this effectively, action must be taken to reduce the risks of inappropriate disclosure.

Given that a large amount of data can be stored on USB’s, smartphones and tablets, there is a real danger that personal information could be compromised should such a device end up in the wrong hands. We recently published research which found that over one third of respondents would look at, or try to open/access a device if they found one , showing that even when mislaid devices are found by conscientious members of the public, the devices may be examined and opened.

The problem is that users want devices that are easy to manage, hassle-free and allow them to go about their lives securely. Measures such as optional encryption do not fit into this lifestyle. Users will not hunt down new security features, either because they don’t know they need them, or perhaps think they already have them.

Whether it is personal or corporate data, security needs to be a necessity, and users should be provided with everything they need to protect their intellectual property.

For businesses, encryption can be a simple and effective means to protect sensitive information. Being able to manage and track the encrypted data, knowing who has accessed it, from what location and on what devices that information resides is also essential.

A Windows To Go device is a securely encrypted, IT-managed USB drive that gives businesses control over what happens to sensitive data, and is easy to use. It contains a fully functional corporate Windows desktop. Employees insert the Microsoft certified USB drives into their home computers, hot desks, or tablets that feature USB ports, and they receive a secure desktop and secure access to all applications and data they use in an office setting.

Unlike a virtualised or online remote access solution, the portable workspace offers full host computer isolation, meaning documents cannot be saved to the host machine but are saved to the USB drive, which can be locked down and remote wiped if required, and all data will remain secure without the threat of a potential data breach.

Encryption is a valuable and essential tool for securing your data. Don’t give users the opportunity to be unprotected; security needs to be a default – not an option.


Thwarting the Insider Threat


Autumn is returning, reluctantly we’re turning our back on summer, and we are looking forward to the Holiday season. Undoubtedly, this comes with increased people taking vacations, working remotely, and the unlucky few taking their laptops on holidays. For many organizations, this is pretty risky business because the sensitive corporate information is now travelling along with their employees. Although many organizations rarely expect their loyal employees to steal company data, many are prepared for security attacks.

Following the Edward Snowden revelations in 2013, IT departments are now tasked with monitoring potential insider threats. Snowden’s work with US intelligence agencies put him in the position of a highly trusted employee, providing him with everything he needed to accomplish what he set out to do. There were no measures in place to prevent what was possibly the biggest information leak in the history of the US.

The risks come from those who intentionally misuse their access to data to cause a detrimental impact on the confidentiality and integrity of sensitive information.

Although there are a number of routes to secure intellectual property, if the authorities, from whom Snowden was stealing from, had a manageable and encrypted flash drive, such as an IronKey™ Windows To Go drive, they could have tracked the information from anywhere. Any activity on the drive could have been monitored from an on-premise or cloud-based management service. This would have ensured them the ability to restrict where the device could be used, or resort to remotely locking it down, so no one could access the data.

If data isn’t encrypted, its integrity can easily and quickly be compromised, and therefore it is essential to know where, and who, is accessing information. This can be difficult across a fragmented IT environment, however, companies need to be confident that if a device is considered to be compromised, they can remotely lock it down, wipe it, or initiate a self-destruct sequence to remove the data, to protect themselves and their stakeholders.

Protecting intellectual property should be a priority for all organizations. Disabling outdated user accounts when employees exit an organization, implementing policies with privileged account passwords, updating them regularly and limiting access to corporate systems, are all crucial to keeping data secure. That’s where the Windows to Go Drive comes in:  a secure, IT-managed, Microsoft certified USB drive that contains a fully functional corporate Windows desktop. Employees insert the Microsoft certified USB drives into their home computers, hot desks, or tablets that feature USB ports, and receive a secure desktop  as well as secure access to all applications they use in an office setting.

Unlike a virtualized or online remote access solution, this portable workspace offers full host computer isolation, which means documents cannot be saved to the host machine, but are saved to the USB drive.

This way, all data will remain secure without the threat of a potential data breach ensuring safety for all!


IronKey Workspace W700


The Cost of Cybercrime


Hackers are holding the world to ransom with cyber-attacks costing the global economy more than £238 billion a year¹. These attacks damage the global economy almost as much as illegal drugs and piracy, with financial losses from cyber theft resulting in a potential 150,000 European job losses.¹ Cybercrime is a growing menace which is proving to be an ever growing challenge for individuals and businesses. US retailing giant Target saw its earnings drop 46% after an attack that leaked more than 40 million customer credit card details², whilst eBay and Office have also been ‘hit’ this year, with customer data compromised.

Despite these devastating implications, the public, corporates and their employees continue to be careless with their valuable and highly confidential data –residing on laptops, tablets and mobile devices. Cyber espionage and theft of individuals’ personal information is believed to have affected more than 800 million people during 2013¹, and our mobile working culture has made data security an even greater challenge.

With IDC estimating that over one million smartphones were shipped last year³, someone somewhere in your company is using a personal, mobile device to connect to a corporate network and download sensitive data – making your organization a sitting target for cybercriminals. Companies must equip their employees with the means to protect corporate data from threats such as identity theft and cyber espionage, whilst mitigating the dangers associated with unsecured devices and free Wi-Fi hotspots.

Mobile devices need to maintain the same high levels of security as office-based desktops and servers, with only IT provisioned laptops or tablets connected to corporate networks. But, the best way of ensuring hackers can’t gain access to your company data, is by storing all your data on a secure fully encrypted Windows To Go USB flash drive. It provides employees with an IT managed and provisioned Windows workspace that replicates their secure office desktop environment, on any device that the USB is plugged into. This also means IT departments do not need to deploy individual computers but rather can deploy the Windows To Go workspace on USB drives which saves time, resources and introduces vast cost savings.

Staff awareness plays a crucial role in protecting the company network against cybercrime. Often under-estimating the inherent security risks of using personal devices in the office, employees must be educated to handle these responsibly – on a proactive, ongoing basis rather than waiting until a security breach occurs, when it’s too late.

With so many high profile security breaches making the headlines, organizations want to know that corporate data is secure at all times, regardless of where it resides, whilst employees need the flexibility to work remotely. Cybercrime can have a devastating impact on your business in terms of cost and reputation. Your organization can’t afford to be tomorrow’s headline…



¹McAfee report, June 2014 – Net Losses: Estimating the Global Cost of Cybercrime


³ International Data Corporation (IDC)Worldwide Quarterly Mobile Phone Tracker, Jan 2014








Will the World Cup Result in a Red Card for your Business?


With the ‘Hacktivist’ group Anonymous having announced they were preparing a full scale cyber-attack on the World Cup’s corporate sponsors during the tournament, and an influx in World Cup related malware, security threats are likely to be the topic of choice for all those looking to protect against potential breaches and attacks during the tournament.

IT managers will have been steeling themselves for a potential spike in lost corporate devices, such as USB’s, tablets and mobile devices, during the World Cup. Whether it be a flight to Brazil, a booze fuelled train journey home, or live streaming a match from your laptop, the potential for a security breach, and the resulting consequences, could be more excruciating than a bite from Luis Suarez!

Whilst the tournament might be coming to a close, the risks associated with remote workers and mobile devices are still an inherent danger to corporate data. Many of us undertake work while commuting, with little regard for the security of the information we are working on, so whether you are lucky enough to have flown out to watch a match, or simply travelling home after watching the game in the pub, the need to secure your devices is never more crucial.

With shrinking boundaries between work devices and work-enabled personal devices, the risk of corporate data falling into the wrong hands is a huge possibility. Employees dropping memory sticks, leaving files on trains, and laptops in bars, are all high probabilities, and inevitably, these devices will contain data not meant for prying eyes.

Failing to protect the vast volumes of information they carry and not equipping employees with the IT tools required to securely manage and handle information while travelling could result in a ‘red card’ for your business.

No computer or tablet not ‘locked down’ by IT should ever be connected to the corporate network, either from inside (fixed line or BYOD) or outside (VPN of VDI). Allocating employees a corporate computer for use inside the network and an IT secured USB device for outside would simplify security and avoid frustrations typically related with tight security policies such as these.

Whether your data is in transit or at rest, encryption is absolutely essential to safeguarding confidential company information. Whether you use strong authentication or hardware encryption will very much depend on your organisation, you need to be able to manage encrypted devices in order to ensure that if there are any concerns that data integrity has been compromised it is possible to remotely wipe the device.

Accidents will happen, but being vigilant in your security practices, and, educating and enabling your employees could be as easy as knocking England out of the Cup altogether.


Security Policies – The Importance of Getting It Right


Last month I was chatting with a journalist and he asked me what my top three security tips for an organisation would be. I started answering his question by saying that companies had to look beyond ‘good enough’ security, consider whether passwords in their current format were really secure, and just as I was about to deliver my third tip, I realised that these were all superseded by the need for a comprehensive security policy, which if approached correctly would address these points.

By comprehensive I don’t mean that companies need to create an enormous document with sub sections of sub sections. What I do mean is that any security policy needs to take into account new developments, disruptive technologies and the ongoing evolving, sophisticated nature of cyber attacks. A security policy cannot be a static document and yet all too often it is. Security is a constantly changing market and, as such, companies cannot afford to be complacent/fall behind.

Not sure? Well just think about the IT environment just five years ago. How we work, the devices we use and where we store content has all changed. Previously companies could be confident that sensitive data was stored only on PCs, but now that information sits on smartphones, laptops, tablets and cloud. The associated security risk is wide ranging. That’s why your security policy needs to be continually evolving – taking changes in working practices, not just the security landscape, into account.

Here are my top five tips for ensuring you create a robust security policy that, rather than gathering dust, provides tangible value to your business:

1. First of all, you need to ensure that you understand your business’s operating environment so that the policy effectively mitigates the threats and risks you face, as well as looking after the assets that you’re seeking to protect. Could lives be lost or just corporate data? Are you subject to the risk of corporate espionage and insider threats on top of cyber attacks? This might seem like an obvious point, but is often overlooked by companies. There is no one size fits all approach when it comes to formulating a security policy – it should be as unique as your business.

2. It’s unlikely that without the aid of metal detectors and full body searches you’ll be able to completely ban or prevent the use of portable storage devices within your organisation. Especially as more and more employees work from increasingly disparate and varying locations. Therefore, a key element of any security policy should seek to protect the data on those devices and state that only password protected USB devices should ever be used to store corporate data.

3. No computer or tablet that’s not ‘locked down’ by IT should ever be connected to the corporate network – either from inside (fixed line or wireless) or outside (VPN or VDI). Equally though, your security policy needs to actually enable your business. So, in order to ensure you can accomplish this without causing a lot of user frustration, consider allocating employees with a corporate computer for use inside the network and an IT secured USB device for outside.

4. Encrypt your data. Whether your data is in transit or at rest, encryption is absolutely critical to safeguarding confidential company information. Whether you use strong authentication or hardware encryption will very much depend on your organisation, but don’t make the mistake of thinking that encryption is a silver bullet. You need to be able to manage encrypted devices in order to ensure that if there are any concerns that data integrity has been compromised, it is possible to remotely wipe the device.

5. Human error is a huge potential vulnerability when it comes to security and your policy should seek to mitigate the risks associated with human nature. Passwords in their current format are inherently insecure, so don’t rely on them alone. Use multi-factor authentication such a voice, retina or biometrics – something unique to the individual. This might all sound a bit ‘Minority Report’ now, but in five years’ time, such implementations will be commonplace.

Does your organization have a comprehensive security policy in place?


When It Comes to the Cloud, What do Small Businesses Need to Think About?


The move towards hosting applications in the cloud shows no signs of petering out. More and more companies are keen to realise the operational benefits that a cloud-
based model has to offer; not to mention the possibility to reduce some CAPEX spend. While many emerging technologies can feel like they are exclusively for the ‘big
boys,’ the great thing about the cloud is that whether you are one person or several thousand, there is a platform out there to help you meet your requirements.

The one downside to being a small business however is that often you don’t have the in-house IT knowledge to understand what, if any, security issues you could be
opening up your business to by opting to store data in the cloud. Here are my top tips to helping you make the most of the cloud, while remaining secure:

* Most small businesses aren’t all that concerned about cloud security and are keen to tap into the benefits that the cloud has to offer. However, as a note of caution, think
carefully about your cloud strategy. While providers might proclaim their offering to be “secure enough”, SMBs shouldn’t accept this assertion at face value – especially if
you intend to store customer data in the cloud as there are strict laws that govern how data is stored, managed and protected.

* Many SMBs can be confused about the best way forward, but take a look at larger companies operating in your sector, what lessons can you learn from them? Are they
using public or private clouds to give employees access to shared data? In the context of your organisation what are the pros and cons of each?

* While it can be tempting to think that your cloud provider ‘has everything covered’ it pays to know what is happening ‘under the hood’ of your cloud security offering. For
example, if the cloud service is responsible for the encryption of data, there is a risk that your keys can be compromised either internally by an employee or by a hacker
who is able to breach the management system and retrieve the keys. To be as secure as possible SMBs, and not their provider, should own and control the encryption

* For the director of a SMB all this talk of encryption and keys might sound a bit daunting, but the key piece of advice here to mitigate the risk of cloud services is to ensure
that if you are storing data in the cloud that you encrypt the data before it reaches the cloud and apply an enhanced level of key management to avoid it being
compromised. And ensure that the data and the encryption keys aren’t stored together!

SMBs need to think carefully about their security strategy, how it can enable their business and if software encryption is right for them. “Good enough” security in today’s
rapidly evolving cyber security landscape will not protect your organisation – or your customers – from persistent and sophisticated attackers. Hopefully the above pointers
are a good starting point for ensuring that, when it comes to the cloud, you’ve got the right security measures in place.