Friday, January 31, 2014

6 trends that will impact enterprise mobility strategies in 2014 - InformationWeek – IT news & articles

 

There is no doubt that mobility is transforming the enterprise. Today, most mobility use cases centre on increasing productivity by equipping employees to do their jobs better on the go and enhancing revenue by offering an alternative channel for customers that includes new features like location and presence.

While this transformation is taking place, it is also disrupting the enterprise by creating new business models and also destroying old ones. The problem is that many businesses are scrambling to create a mobile strategy; hamstrung by unrealistic expectations, vague requirements and organizational inertia. Enterprises must adapt more quickly to the mobile revolution or run the risk of being left behind by flexible competitors.

Gartner believes the most important trends that will impact enterprise mobility strategies in 2014 are:

1) Identity and access management (IAM)

Enterprises must be able to authenticate users and grant access to appropriate business resources. There are three aspects of IAM to focus on: single sign-on, adaptive access control and privacy. Small device sizes make entering strong passwords difficult and users want to sign on once to access the resources needed to do their jobs. Adaptive access control, which uses additional contextual information such as user location, behavioural patterns and many other factors, can be used to increase identity assurance and reduce mobile usage risk. Although location data can strengthen authentication surety, it also can raise privacy concerns.

2) Security and risk

Mobile users often access sensitive applications and data that may be stored on the device or in a private/public cloud. There are many cross-platform security controls, such as authentication, encryption, device wipe and anti-malware. However, the number of different security capabilities supported across different operating system types and versions makes it difficult for security and management vendors to provide uniform policy enforcement across all devices. Cloud security must also be assessed as a component of an overall mobile strategy.

3) Mobile app development

User Experience (UX) has become the overriding measure of success for virtually every mobility project. Although most developers implicitly understand they must deliver a great UX for business-to-consumer (B2C) apps, the same is not true for business-to-employee (B2E). Often, employees must struggle with outdated, poorly designed apps they would never use if they had a choice. Some may work around IT so they can use a consumer app that is more intuitive than the "endorsed" enterprise version. "Shadow IT" activities may increase security risks, and IT may have little or no visibility into it.

4) Collaboration and content

Devices are changing how people communicate, collaborate, create content and use social software. Three issues IT departments commonly confront are:

Dealing with iPads in the enterprise – apps that users need may differ from those on a traditional desktop, especially as iPads tend to be used for text consumption, not creation.
Fixing the "Dropbox problem" – many employees use consumer-oriented file synchronisation solutions such as Dropbox, to ensure they have up-to-date files on all their devices, potentially putting enterprise information at risk.

The relationship between mobile and social software – most knowledge workers can benefit from greater use of mobile-enabled enterprise social networks.

5) Infrastructure

Many users are pushing IT to deploy a pervasive wireless infrastructure that serves both business and personal devices, while expecting wireless LANs (WLAN) to provide fast, predictable behaviour, just like a wired LAN. As enterprises increasingly rely on WLANs for mission-critical communication, challenges of network design, network management and problem diagnosis become more complex. Unfortunately, many WLANs were not designed to provide mission-critical services and are plagued with issues such as poor performance, insufficient coverage or lack of service for employee personal devices. Enterprises must also deal with unique demands that BYOD strategies place on site communications infrastructures. They may need to increase network capacity, manage bandwidth, segregate BYOD devices from enterprise devices, add IP voice services and expand site mobile access.

6) Management and BYOD

BYOD is the biggest change in client computing since the introduction of the PC. Gartner research indicates 38 percent of surveyed CIOs will cease to provide personal devices to their employees by 2016. However, IT is reluctantly embracing BYOD policies that satisfy the relentless employee demand to use personally owned devices. The implementation of BYOD programs exacerbates the challenges of information security, device management and workspace delivery. Unfortunately, endpoint security controls, MDM tools and workspace delivery mechanisms are inconsistently implemented across the myriad of mobile platforms. IT should collaborate with users and line of business managers to proactively create policies, implement programs and anticipate future requirements for BYOD.

6 trends that will impact enterprise mobility strategies in 2014 - InformationWeek – IT news & articles

Monday, January 20, 2014

New Phishing Research: 5 Most Dangerous Email Subjects, Top 10 Hosting Countries

 

New Phishing Research: 5 Most Dangerous Email Subjects, Top 10 Hosting Countries

December 10, 2013 7:44 am

Phishing-ResearchWith cloud infrastructure easily scalable and rented botnets coming on the cheap, the cost of conducting massive phishing campaigns continues to decline for cybercriminals. Even if the return rate is small or the campaign is poorly executed, phishing can result in serious money for criminals. Phishing will never simply go away—meaning ongoing headaches for security professionals.

To shed some light on how targeted attacks and user education awareness are evolving, Websense Security Labs researchers investigated current phishing trends. We found that the percentage of phishing attempts within all email traffic dropped to 0.5 percent in 2013 (down from 1.12 percent in 2012). This may sound like good news, but certainly does not mean the coast is clear for businesses.

Today’s phishing campaigns are lower in volume but much more targeted. Cybercriminals aren’t simply throwing millions of emails over the fence. They are instead targeting their attack strategies with sophisticated techniques and integrating social engineering tactics. Scammers use social networks to conduct their recon and research their prey. Once the intelligence is harvested, they use that information to carefully construct email lures and yield maximum success.

In addition to social engineering, geographic location also plays an intricate role in phishing. By rank, here’s a list of the top 10 countries hosting phishing URLs: (Based on research conducted 1/1/13-9/30/13)

1. China
2. United States
3. Germany
4. United Kingdom
5. Canada
6. Russia
7. France
8. Hong Kong
9. Netherlands
10. Brazil

Some interesting points about this list:

  • China and Hong Kong made their debuts this year, having never before been included in our lists
  • The UK moved up from the number six spot
  • The U.S. dropped out of the number one spot, for the first time in a long, long time
  • Russia moved up from the number 10 spot
  • Egypt and the Bahamas have disappeared from the list, after recent appearances

Five Most Dangerous Subject Lines

As you can see, where you are in the world can influence how much your organization is at risk. However, geographic location is only one piece of the puzzle for detecting and stopping unwanted emails. How the emails are titled also plays a significant role in the success of a phishing campaign.

To further investigate, our security researchers took a closer look and determined that the top five subject lines in worldwide phishing emails are the following: (Based on research conducted 1/1/13-9/30/13)

  • Invitation to connect on LinkedIn
  • Mail delivery failed: returning message to sender
  • Dear <insert bank name here> Customer
  • Comunicazione importante
  • Undelivered Mail Returned to Sender

The list above portrays how cybercriminals are attempting to fool recipients into clicking a malicious link or downloading an infected file by using business-focused and legitimate-looking subject lines. Scammers will use any means necessary to increase the likelihood of an inspire-to-click campaign.

Phishing Security Tips and Infographic

To combat phishing attacks, be sure to adequately prepare yourself with a security solution that can expose advanced threats and alert your security team in real time. You can protect your organization by implementing web, data, email and sandboxing security solutions that share crucial intelligence to analyze potentially malicious content in real-time. Promoting and adhering to these tips can significantly decrease your organization’s chances of becoming a victim of a phishing campaign.

New Phishing Research: 5 Most Dangerous Email Subjects, Top 10 Hosting Countries