by clicking on the page. A slider will appear, allowing you to adjust your zoom level. Return to the original size by clicking on the page again.
the page around when zoomed in by dragging it.
the zoom using the slider on the top right.
by clicking on the zoomed-in page.
by entering text in the search field and click on "In This Issue" or "All Issues" to search the current issue or the archive of back issues respectively.
by clicking on thumbnails to select pages, and then press the print button.
this publication and page.
displays a table of sections with thumbnails and descriptions.
displays thumbnails of every page in the issue. Click on a page to jump.
allows you to browse through every available issue.
FCW : September 30, 2015
BOB STEVENS is vice president of federal systems at Lookout. Commentary | BOB STEVENS It’s nearly impossible to find a recent article about federal cyber- security that doesn’t mention the Office of Personnel Management hack — and for good reason: It has raised some very serious questions about our nation’s cybersecurity practices or, more accurately, the lack thereof. Without question, there is massive room for improvement. Yet recent discussions have all but overlooked one critical piece of the federal security puzzle: mobile devices. Some might ask, “Why focus on mobile when in many areas of gov- ernment, smartphones aren’t even allowed?” After all, there’s no reason to believe the OPM hack involved a mobile component. Yet for that very reason, mobile devices remain sit- ting ducks as entry points for similar attacks in the future. In fact, after analyzing 20 federal agencies, Lookout recently discov- ered 14,622 personal devices associ- ated with government networks. That means people, permitted or not, are connecting their smart- phones and tablets to federal sys- tems. In this sample, those devices encountered an astounding 1,781 app-based threats such as spyware or Trojans. So government employees are not only using their smartphones to regularly access potentially sensitive government data and their agencies’ Wi-Fi networks, but those devices are encountering threats that could put the devices and the data they access at risk. Adding more fuel to the fire, a recent survey of more than 1,000 federal government employees (also commissioned by Lookout) revealed a sobering set of statistics: • 58 percent of federal employees are aware of the security conse- quences of using their personal mobile phones for work, yet 85 percent will use their phones for potentially risky activities anyway. • 50 percent of federal employees access work email on their personal devices, and another 49 percent use their personal devices to download work documents. • 7 percent of federal employees claim they jailbreak or root a device they bring to or use at work. Those practices introduce vulnerabilities that attackers can exploit, and they make it easier to download apps from third-party marketplaces that tend to have a higher number of malicious apps. • 18 percent of employees claim to have encountered malware on their mobile devices, including both personal and government-issued devices. Clearly, all federal agencies have some level of bring-your-own-device activity taking place, whether offi- cially sanctioned or not. And this shadow BYOD introduces countless risks for sensitive data leakage. This is not to say that more traditional entry points no longer pose risks or that mobile is a greater threat — but mobile is being completely overlooked. So how do you address shadow BYOD and minimize potential risks? For many government agencies, the answer is to institute more policies. But policies alone won’t address the underlying issues of why shadow BYOD is happening in the first place. In the aforementioned survey, nearly 40 percent of employees who work at agencies that have rules prohibiting personal smartphone use at work said those rules have little or no impact on their behavior. Employees want access to mobile technology to do their jobs, but the government is not moving at the speed of technology. The answer lies in embracing BYOD programs wholeheartedly, which involves having the tools and technologies in place that provide visibility into what’s really happen- ing on federal networks and offer protection against potential harm. If we wait for a mobile attack to cause a devastating government data breach before we start consid- ering how to tackle the significant mobile security challenge, it will already be too late. n Why shadow BYOD is your next big problem Mobile might not be the most serious security risk, but it needs far more attention than it has been getting All federal agencies have some level of BYOD taking place, whether officially sanctioned or not. September 30, 2015 FCW.COM 11 0930fcw_011.indd 11 9/8/15 1:37 PM
September 15, 2015