Government Agencies Slow to Secure Mobile Devices

Photo: Getty

Many U.S. government agencies — including the Defense Department — have been sluggish to adopt new security guidelines to protect their employees’ mobile devices, said one company executive.

Bob Stevens, federal vice president of federal systems for Lookout Mobile Security in San Francisco, said agencies need to develop new policies that can protect devices, keep rogue applications at bay and educate employees and stakeholders about mobile security best practices.

One area that needs improvement is application analysis, he said. Too often, agencies take too long — sometimes up to six or eight months — to determine whether an app is safe to use within their networks.

“I see the government sort of spinning its wheels when it comes to the applications that they want to download,” he said. “There are tools out there today that can analyze those applications within minutes, and provide data that the government needs to make a decision.”

When a client downloads an application to a mobile device, Lookout’s team can compare it to a back-end collection of over 35 million apps, Stevens said.

“We’re trying to determine if that application has risky behavior,” he said. That could include sending out the user’s contact information to a command-and-control server in another country, installed malware, or bugs and other vulnerabilities, he added.

Government agencies must also assess whether allowing employees more freedom to use mobile devices will encourage productivity and efficiency, he said. Restricting access to cell phones or specific applications is “not really making those employees more productive,” he added.

In order to promote mobile usage but keep devices secure, Stevens recommends agencies invest in encryption tools, such as a secure container application that insulates sensitive work data separate from personal information, in an authenticated area of a user’s cell phone or tablet.

Employers also have to consider access to WiFi networks, he noted. “When you’re walking down the street, your mobile device is trying to attach to every WiFi network that exists, whether you want it to or not,” he said. “You need to be conscious that there are bad people trying to get into your system via a bad WiFi network.”

Some assume that the Defense Department is more secure than civilian agencies and may not need to worry as readily about implementing new guidelines, Stevens noted.

“A lot of times, the DoD thinks, ‘we buy lockdown devices and produce lockdown devices, so they’re not as open to a breach as a civilian agency might be,’ but I would disagree with that conclusion,” he said.

Topics: Infotech, Cyber, Cybersecurity