Description of major risks and control issues surrounding mobile devices: data losses, device security, application development, relevant control frameworks and auditing considerations

1. Control Issues and Mobile Devices ACC626 Term Paper SlideCast Prepared for: Professor Malik Datardina Sunny Cheung Due Date: June 30, 2011

5. Feature phonesDefinition of Mobile Devices

7. Improved customer service

8. Response to customer problems or question at any time

9. Improved turnaround times for problem resolution

10. Increased business process efficiency

11. Employee security and safety

13. Mobile devices form a significant part of the client’s IT environment, required for internal control review

15. Data Loss Risk

17. Financial, operational, and reputational damages

20. Biggest source of data loss

21. 1/20 corporate devices are lost

22. Financial consequences

24. Install anti-phone theft software

25. Develop clear procedures to be taken when a device is lost or stolenRecommendations

27. Can be intercepted if not protected or encrypted

29. Use SSL, VPN, or IPSec for transmission of sensitive information

30. Use Citrix Receiver or VMWare View to connect to corporate network

31. Make sensitive phone call through landlineRecommendations

34. Avoid easily guessed passcodes

35. Auto-lock after a period of inactivity

36. Restrict device connection and syncing with non-corporate computersRecommendations

38. Frequent data backup

39. Cloud backup

40. Educate employees about data loss implication and safeguard methodsCorporate-wide Policy Recommendations

41. Devices Software Security Risk

43. Malware imposter updates

44. Infected memory cards

46. Stealing classified information

47. Propagate other Trojans or viruses

49. Use mobile anti-spam filters

50. Update device firmware and apply patches in a timely basis

51. Restrict employees from downloading and installing applications

52. Devices should not be modified (i.e. jailbreaking or rooting)Recommendations

53. Application Development Controls

55. 39% of organizations already have custom apps with 30% planning to deploy within 2 years

56. 2 deployment optionsWeb-based applications Native applications

58. Advantages:

59. Use on multiple platforms

60. No new programming language (HTML/JavaScript)

62. Advantages:

63. Can use mobile devices’ hardware capabilities (GPS, accelerometer, camera)

65. Development process should be similar as other enterprise software

66. Follow software development models

67. Consult mobile specific guidelinesRecommendations

68. Other Control issues

70. Difficult to manage and monitor devices

71. Recommendations:

72. Set policy for allowable platform and hardware

74. Increase risk of malware infection

75. Recommendations:

76. Enforce stricter policy on personal uses

79. Mobile devices form critical part of the environment

80. Risk Assessment

81. Management must assess and understand risks that mobile devices bring

82. Control Activities

83. Safeguard the unique mobile device risks

84. Information and communication

85. Communicate usage and security policies

86. Monitoring

88. What kind of mobile devices can be used (type and ownership)

89. Who can use the devices (employees, contractors, others)

90. What information can be stored (customer information, sensitive, internal, public)

91. What applications can be used and installed

92. What security protection is required (access control, encryption)

93. Where they can be used (workplace, home)

95. Advantages:

96. Brings added value by supporting corporate processes

97. Deployed in a manner that addresses associated risks

98. Fits corporate culture and technical architecture of the enterprise

99. Considers external factors

100. Supported by appropriate resources

103. Mobile security policy in place including rules for appropriate physical and logical handling

104. Antivirus Updates

105. Verify regular definitions update

106. Encryption

107. Sensitive data are properly encrypted

108. Secure Transmission

109. Connected to enterprise through secured connection

110. Device Management

112. Data synchronization is not set to receive access to shared files or network drives

113. Awareness Training

114. Awareness program that addresses importance of securing devices physically and logically

115. Risk

117. Risk management is neither costly nor complex

118. Similar to current control in place for other IT equipment