Security software maker Websense is making use of the malware hit list that helps keep Facebook malware-free, to take on data security and malware on tablets and smartphones in the office.
iPhones and iPads have thoroughly infiltrated the workplace. (Even Microsoft's Office now has a serious business case to bury its hatchet with Apple and launch an iPad app.) It's the phenomenon that security firms have dubbed the "BYOD" era.
And, for them, it arrives with great concern.
Security keepers at Websense believe that these new devices are entering the workplace faster than enterprise IT pros can rule them out as potential threats to corporate security. The iPad and iPhone cleared the way here. "It really became an avalanche after that," Websense CEO Jason Clark tells Fast Company. In response, Websense thinks it's developed a gateway system for this BYOD age.
First, to make its case, the group commissioned a study from the Ponemon Institute to gather employers' reaction to this shift and take stock of how they were dealing with security on the new devices in the workplace.
Of the about 4600 IT professionals from 12 countries surveyed, 77% said that mobile devices are useful business tools, but 76% believed that these same tools posed a risk to their organizations. As for taking measures to block malware or secure their data, only 39% said they had activated security controls.
Many of the reported run-ins with security issues were "alarming," Clark says. Fifty-one percent of the companies polled experienced data loss because of unsecured mobile devices, including laptops, smartphones, USB devices, and tablets. 59% saw an increase in malware infections because of ill-protected mobile devices in the workplace, and an equal portion reported that their employees circumvented or disengage security features such as passwords and key locks.
It's not just attacks by malware, either, Clark says (which, with the proliferation of hackers, has become a more pernicious affair). Companies are also worried about losing sensitive data through misplaced smartphones or leaky emails.
So, a traditional approach, where a company's IT department installs a virus block and malware filter on a company computer--kind of like resident bouncer--is no longer sufficient. Mobile OSs get updated constantly, malware shows up on trusted websites for short periods of time. To tackle this dynamic threat landscape, Websense is launching a cloud-based security system for mobile devices: not just smartphones and tablets, but also laptops and USB drives. Their new Triton Mobile Security, Clark says, addresses the issue of data loss and data theft as well as malware threats.
Much of this infrastructure is already in place. As a malware blocker, Websense's new platform draws on the artillery Websense uses to protect clients with massive traffic, like Facebook. There, the company checks every link a Facebook user clicks against Websense's databases of known suspects. If the link looks fishy, Websense props up an alert message, only then is the Facebooker allowed access to the external website. Key to the success of this approach, and their effectiveness as a malware blocker, is Websense's library of known threats. Which, Clark assures Fast Company, is vast. "We're leveraging our knowledge of what bad things look like, smell like."
On mobile devices, the new system will examine every bit of data entering or leaving the device--an attempt to plug, or at least filter, the flow of data streaming into smartphones or tablets, say, via email. Clients can flag sensitive data as out-of-bounds for mobile devices-- earnings statements for example, or financial documents--and any attempt to get such info on a smartphone, say by email, will be blocked.
On iOS devices, a first visit to the Websense site activates a built-in element. Once this comes alive, the device's web access is routed through Websense's buffer in the cloud. (Android users need to download an app to be able to connect with Websense's cloud.) Because Websense's service is cloud-based, it intercepts client devices whether they reach the web through Wi-Fi or cellular data. In real-time, Websense checks the website being accessed, or the email being downloaded, for threats or blocked content.
Other security checks, Jason Clark says, "They're just looking at the driver and gauging, 'Where are you headed and where do you come from?' and does that look suspicious." Websense's Tritron conducts a thorough check. "Every bit of data, all conversations--everything goes through us first," Clark says. "When it hits our infrastructure, we're opening up every single bit of every single payload. We're looking in the trunk in the engine, in the passenger seat. We look at that and say, is this phone trying to take important data out."
Websense is launching their Triton Mobile system at the RSA conference currently underway in San Francisco, and its expected to be on sale on March 15.
Nidhi Subbaraman writes about technology and science. Follow on Twitter, Google+.
[Image: Flickr user Mike Vadala and Maxim Trudolubov]