Security for the exploding Internet of Things ecosystem

For how many years now have federal CIOs and IT managers heard the bromide "security must be baked in, not bolted on?" It is one of those phrases that gets repeated so often that it's lost its meaning, but the fact that it's still considered wisdom today is itself meaningful.

The uncomfortable reality of cybersecurity is that it remains our nation's biggest technology challenge. Despite high-profile security breaches that have embarrassed agencies and corporations, keeping up with vulnerabilities and staying ahead of hackers from both a technology and user education standpoint isn't easy. This task is further complicated by the prevalence of siloed legacy technology, which drains agency budgets and limits their ability to make the most of mobile technologies. On average, agencies spend about 75 percent of their IT budgets operating and maintaining existing systems, leaving little opportunity to modernize, according to the Government Accountability Office.

This is finally changing, thanks to the Modernizing Government Technology Act and May 2017 Cybersecurity Executive Order. Cybersecurity is now topping agency agendas, and new funds are beginning to be allocated to address data protection. When approached thoughtfully and strategically by agency leaders, endpoint security can play a key part in government IT modernization and mobile transformation.

Strong mobile security makes it more feasible to equip federal employees and contractors with smartphones and tablets for their work away from agency offices, finally giving them the freedom and flexibility to be productive wherever the task takes them.

Locking the Gates

The universe of technology intended to protect endpoints encompasses several different strategic approaches: software-based, managed services and hardware. Often these are deployed in combination, building a custom solution that addresses an organization's unique needs.

This is really the key to endpoint security: No two situations are the same. Rather than adopting an off-the-shelf security package, agencies should consider engaging a partner who can combine best-in-class mobile technologies, technical expertise and partnerships to create customized mobile solutions that include well-integrated security.

Ideally, a mobile security solution should start with the devices themselves. A hardware-based security platform is the epitome of "baked in," in that it is integral to the device and can protect data from the instant the device is powered on. Add the right software and professional services to that base, and a truly robust mobile endpoint security solution can be created.

In evaluating the strength of an endpoint security offering, consider these features:

• Malware Protection: Once malicious code gets past the outer defenses, it can find a path to spread through the network and mission-critical systems. A solution should integrate and protect across multiple systems (app store, MDM, etc.) to block malware from infiltrating the device, applications and underlying operating systems, and detect threats as quickly as possible.
• Authentication and Biometrics: Mobile devices can be easily lost or stolen. Strong endpoint security includes features such a multi-factor authentication and biometric verification to ensure that the device can't be used by an unauthorized person.
• Mission Action Verification: Even when the user is authenticated, the agency may have policies about when and where certain data transactions are allowed. This function ensures the user adheres to those policies.
• Encryption: All data intended for secure transmission or storage should be encrypted.
• Cryptographic Digital Credentials: This feature can eliminate the need for physical Common Access Cards (CAC), so the user has one less item that is prone to loss or theft.
• Containerization: Containerization allows IT managers to set up "walls" on mobile devices to keep some apps and data separated from others. This is especially useful for, but not limited to, BYOD settings. Containerization can keep sensitive data separated from everyday apps, making it harder for attackers to reach. The ability to remotely wipe the device's memory is an added safeguard.

IoT Opens a New Threat Vector

Just as agencies begin to tackle BYOD and dual persona challenges, a new threat has emerged to disrupt the threat landscape yet again. We're now facing a new wave of endpoints in the form of the Internet of Things (IoT) and connected devices such as remote sensors, weapons systems, vehicles, wearables and appliances. All of these new mission-focused endpoints provide even more digital surface area for dangerous botnets, spyware, insider threats and DDoS attacks to exploit.

Industry and federal agencies alike are monitoring the IoT challenge, and it remains a classic balancing act between fast-paced innovation and retrospective security. In August, Sen. Mark Warner (D-Va.) introduced the Internet of Things (IoT) Cybersecurity Improvement Act of 2017 to establish ground rules and heighten security standards around IoT device security. While many applaud the move, others are concerned that the legislation does not go far enough. So while IoT applications can be transformative in government, it's up to agencies to ensure the IoT remains a major consideration in any agency's overall endpoint security strategy.

The Human Factor

Regardless of the endpoint, no technology is good enough to overcome human error. The final piece of a strong endpoint security solution is a set of strong, sensible policies that the agency enforces. Mobile devices and other endpoints should be considered just another part of the enterprise an included in overarching policies.

There are several questions to consider: What data will be stored on or transmitted through the devices? How are they managed now, and should that change? Who is authorized to use a mobile device, and under what circumstances? Can the agency allow employees to bring their own smartphones to the job, or would it be safer to allow only agency-issued devices?

However you answer these questions, the ultimate effectiveness of an endpoint security strategy depends on finding the right mix of policy, hardware security, software and services, and then adjusting it as necessary over time to keep pace with evolving threats. Working with a proven partner that understands this full landscape and the agency's unique challenges can be invaluable in deploying a mobile strategy that can fully harness forward-looking mobile capabilities, drive productivity and truly meet mission needs.

From with auditing vulnerabilities to defining endpoints within the organization, a solution provider can help an agency embrace a step-by-step multi-layered strategy for shoring up devices, strengthening the overall security posture and maximizing IT investments.