Symmetrium Supports Deployment Across 5G Networks

Read more

Author: Inbal Meshulam

The Flaws and Costs of Mobile Security Policies and How to Instantly Fix Them

Posted on by Inbal Meshulam

The era of hybrid and remote work environments has given Chief Information Security Officers (CISOs) many sleepless nights as they struggle to ensure optimal protection for their corporate networks. With the frequency of cyber attacks targeting mobile devices and remote workers continuing to rise, implementing a comprehensive mobile security policy is essential to safeguard an organization’s work environment.

While there has been a rapid increase in the popularity of Bring Your Own Device (BYOD) policies over the past number of years, its inherent security flaws has seen organizations embrace other models in search of a better solution, such as

Choose Your Own Device (CYOD), Corporate-Owned, Personally Enabled (COPE) and Corporate-Owned, Business-Only (COBO). The truth is, however, that all of these policies leave networks and their data vulnerable.

However, there is another option available. Organizations can quickly and cost effectively implement a zero-trust data mobile access solution that enables productive collaboration while dramatically minimizing the risk of data breaches. This is achieved by turning any mobile device, managed or unmanaged, into a virtual extension of an organization’s network, with all its compliance, security, and IT.

So, let’s first look at the pros, cons and costs associated with traditional solutions, and then outline how organizations can implement a truly zero-trust mobile security environment that will immediately optimize data security using a minimum resources approach.

 

Bring Your Own Device (BYOD)

BYOD policies allow employees to use their personal mobiles, reducing the financial burden on companies, as employees bear the cost of purchasing and maintaining their devices. It promotes flexibility and mobility, enabling employees to work from anywhere, at any time. However, implementing BYOD requires proper security measures to protect company data, ensuring strong device management and encryption protocols are in place.

Pros:

  • Enables employees to work from anywhere, at any time.
  • Reduces need to purchase and maintain devices for employees.

Cons:

  • Increases security concerns, as personal devices may be vulnerable to data breaches or malware attacks.
  • Different devices and operating systems may pose challenges in terms of integration with existing IT infrastructure.
  • IT departments may face additional workload in terms of software updates, and troubleshooting.
  • Balancing employee privacy with the company’s need to protect sensitive data can be challenging.
  • Companies may have limited control over employee devices, making it harder to enforce policies and ensure compliance.

Costs:

  • Investment in security solutions, such as mobile device management (MDM) software, encryption, and remote wiping capabilities.
  • Additional resources may be required to provide technical support and address device-related issues.
  • Expenses may arise from ensuring compatibility with existing systems and software.
  • Companies must consider the costs associated with meeting legal and regulatory requirements related to data protection and privacy.

 

Choose Your Own Device (CYOD)

CYOD allows employees to select their devices from a list of approved options from their employer.

Pros:

  • Ensures that only approved and secure devices are used for work, reducing the risk of data breaches and malware attacks.
  • Limiting selection of devices ensures better compatibility and seamless integration with existing IT infrastructure and software.
  • Technical support is more streamlined and efficient.

Cons:

  • Companies need to invest in purchasing and maintaining a range of devices.
  • Introducing new devices may require additional training and support.
  • Upgrades and replacements will increase costs over time.

Costs:

  • Purchasing and maintaining devices.
  • Allocating resources for training employees on the selected devices.
  • Expenses may arise from ensuring compatibility with existing systems and software.
  • Device upgrades and replacements.

 

Corporate-Owned, Personally Enabled (COPE)

COPE provides employees with company-owned devices that can also be used for personal purposes.

Pros:

  • Greater control over device security measures, ensuring compliance with data protection and privacy regulations.
    Better compatibility and integration with existing IT infrastructure and software.
    Software updates, and technical support is more streamlined and efficient.

Cons:

  • Reduced device choice for employees, limiting personal preferences and flexibility.
  • Purchasing and maintaining company-owned devices.
  • Employees reservations about using company-owned devices for personal use.
  • Training and learning curve.
  • Employees may prefer using their personal devices.

Costs:

  • Purchasing devices.
  • Device management and technical support.
  • Training and onboarding.
  • Upgrades and replacements.

 

Corporate-Owned, Business-Only (COBO)

Corporate-Owned, Business-Only (COBO) is where companies provide employees with company-owned devices strictly for work-related purposes.

Pros:

  • Can enforce strict policies to protect sensitive data and ensure compliance with regulations.
  • Consistent hardware and software configurations across devices.
  • Minimizes the risk of data breaches, malware infections, and unauthorized access.
  • IT departments have centralized control over devices, making troubleshooting, and support more efficient.
  • Optimized for work-related tasks, promoting focused and efficient work.

Cons:

  • Concerns about privacy and potential monitoring by the employer.
  • Employees heavily rely on IT support for device-related issues, increasing workload for the IT department.
  • Employees may resist using COBO devices, preferring to use their personal devices instead.

Costs:

  • Device procurement.
  • Device management.
  • Training and onboarding.
  • Upgrades and replacements.

 

How to Solve these Security Flaws and Eliminate Associated Costs

The traditional solutions to mobile device access, detailed above, are far from ideal. Each has its flaws and ultimately leaves organizations vulnerable to security breaches to greater or lesser degrees. Each one also has associated costs and requires oversight. Organizations today, however, can quickly benefit from a solution created by Symmetrium that not only offers vastly superior levels of security, but also requires minimum resources.

The zero-trust environment needed to keep data private and protected is achieved by deploying Symmetium’s virtual mobile device (VMD) solution. When these virtual devices, which reside within the organization’s network, are remotely accessed by employees using their mobile phone or laptop, they act as extensions of all organizational security and compliance policies using end-to-end encrypted streaming. The result is a completely native mobile experience with seamless deployment and management.

Corporate data is accessed virtually and therefore at no time sits on the user’s actual device. The result is that data remains secure and is never put at risk.

Maintaining Full Control Over Mobile Data Access

Organizations using Symmetrium are able to maintain full control over the data accessed by employees through their mobile devices, safeguarding it from potential risks. This allows for the efficient management of multiple devices, regardless of their brand or operating systems, with minimal resource allocation, thanks to a centralized management console.

The integration seamlessly aligns with existing security and GRC (Governance, Risk, and Compliance) protocols through a unified application. As a result, organizations gain confidence in the security and protection of their data, irrespective of the device used for access.

Symmetrium instantly deliveries the following benefits:

  • Seamlessly maintains and enforces strict network policies to protect sensitive data and ensure compliance with regulations.
  • Works with all hardware and software configurations across devices.
  • Eliminates the risk of data breaches, malware infections, and unauthorized access.
  • Requires minimal resource allocation.
  • IT departments have centralized management via console.
  • Allows employees to use their own devices without compromising their experience and privacy.
  • Highly cost effective as it requires no investment in purchasing, maintaining or upgrading devices.

By using Symmetrium’s streamlined approach organizations can confidently ensure data remains secure at all times, reinforcing data governance and mitigating potential vulnerabilities.

Discover how easy it is to optimize your network security by booking a demo with Symmetrium here.

How to Overcome the Problems Achieving HIPAA Compliance for Mobile Devices

Posted on by Inbal Meshulam

Implementing and maintaining a secure and compliant HIPAA environment places a heavy burden on healthcare organizations, with current solutions failing to consistently meet the strict regulatory requirements. Symmetrium’s compliant-by-design mobile device management solution is now a game changer, ensuring HIPAA compliance through the use of a single, low maintenance application. 

The use of mobile devices has become a staple feature of every healthcare environment. But while they are transforming patient care, the security risks mobile devices pose to confidential patient information is a growing risk. This is why access to healthcare data via mobile devices has been specifically targeted by the Health Insurance Portability and Accountability Act (HIPAA), a federal law requiring the creation of national standards to protect sensitive patient health information from being disclosed.

 

Challenges Involved in Protecting ePHI

HIPAA protects electronic protected health information (ePHI) that is produced, saved, transferred or received in an electronic form. Every entity that has access to ePHI needs to be compliant to HIPAA rules. This applies to doctors, nurses, clinics, pharmacies, insurance companies and anyone accessing ePHI — they all need to be compliant. 

HIPAA states: “Healthcare providers, other covered entities, and business associates may use mobile devices to access electronic protected health information (ePHI) as long as appropriate physical, administrative, and technical safeguards are in place to protect the confidentiality, integrity, and availability of the ePHI on the mobile device and appropriate BAAs [Business Associate Agreements] are in place with any third-party service providers for the device and/or the cloud that will have access to e-PHI.”

However, staff mobility, remote employees, third-party contractors and BYOD policies are just a few of the reasons implementing adequate security and compliance solutions to meet HIPAA requirements is increasingly difficult. 

 

Vulnerabilities in Current Solutions 

With a heavy burden placed on the healthcare sector to be HIPAA compliant, the first line of defense is to ensure devices include the necessary safeguards to guarantee against theft and data loss through the use of a robust layer of security.
HIPAA regulations also require that ePHI data must be encrypted when transmitted over a network. The most popular way of doing this is to create a VPN through which VDIs (virtual desktop infrastructure) can connect to the data, therefore negating the need for it to be encrypted. This however raises problems.

Usage can be limited because a user needs to make sure no one else is using the VDI. This means they have limited flexibility and can be more difficult to scale as needed. This can be a problem for organizations with fluctuating user numbers or those looking to implement a bring-your-own-device (BYOD) policy. There are also security concerns as users operating in a VDI environment can as easily click on a malicious link in an email or on a web page as someone using a physical desktop. 

VDIs also require a heavy level of management and maintenance, which places a heavy burden for qualified IT staff where ongoing training and staff turnover can become problematic. To comply with HIPAA data encryption and data wiping tools may also need to be implemented and maintained. This can add to the management burden. 

 

Achieving HIPAA Compliance with One Solution

HIPAA compliance can be achieved using only one solution. Symmetrium is HIPAA compliant by design for mobile devices. Symmetrium creates virtual mobile devices (VMDs) that reside within the protected perimeter of a healthcare organization’s network and thus adhere to all existing enterprise network and HIPAA security protocols. This ensures that ePHI data is kept private and protected, avoiding security breaches and massive fines.

Symmetrium VMDs use P2P encrypted streaming, which allows healthcare workers to view ePHI data via a portal using their own devices. This view-only access means ePHI data never leaves the protected organizational network and therefore is never transferred to a user’s external device. This ensures the data at all times remains secure and compliant, never coming to rest on devices outside of the protected organizational IT environment.

The result is an easier life for regulatory officers and CIOs thanks to the less complicated management of ePHI data, because:

  1. Symmetrium’s VMDs become a virtual extension of all existing HIPAA compliance protocols, are seamless to deploy and offer a native mobile experience.

  2. They immediately ensure HIPAA compliance in BYOD environments using custom end-to-end encrypted streaming with no ePHI data at rest. This means that each mobile user is treated as an on-prem endpoint, which they can control when and where users can access ePHI data.

  3. Symmetrium’s minimum-resources mobile access solution needs very light operational requirements and delivers high security compliance demands that integrate smoothly into existing data access protocols. The result is HIPAA compliance using one single app. 

 

Isn’t it time you reconsidered your approach to meeting HIPAA requirements? Book a demo with Symmetrium here.

SEC Issues Over $2bn in Fines to Crack Down on Use of WhatsApp and Other Messaging Apps

Posted on by Inbal Meshulam

With financial institutions struggling to meet their regulatory obligations regarding messaging apps, the sector could have saved billions of dollars by using Symmetrium to minimize their exposure.

When JPMorgan was hit with $200 million in SEC fines in Dec 2021, for letting employees use WhatsApp, it should have been a warning sign. Less than a year later, the US Securities and Exchange Commission (SEC) struck again, fining 16 Wall Street firms $1.8B for using private text apps. 

This avalanche of fines was imposed on banks and financial institutions for allowing employees to discuss business via unapproved and unmonitored messaging systems, such as WhatsApp. Such discussions are legally required to be recorded, stored and available to government authorities to review when required.

The sector has been cracking down heavily on the use of unsecured messaging apps for business. In 2020, for example, a senior credit trader at JPMorgan was suspended for communicating via WhatsApp with colleagues at Jefferies, KPMG, and VTB Capital. 

 

Financial Institutions Struggling to Meet Regulatory Requirements

With the pervasive use of mobile phones as hybrid work policies become more normal, the exposure firms face has risen sharply since the time when only email was being used. All email messages could be stored and archived on corporate email servers to meet regulatory requirements, but now with BYOD (Bring Your Own Device) policies and the widespread use of messaging apps, banks are struggling to meet SEC requirements. 

WhatsApp remains the most popular messaging app, but more than a half dozen others are regularly used, such as Facebook Messenger, iMessage, WeChat and Telegram. Their prevalence is giving Compliance Officers at financial services firms sleepless nights as workplace smartphones and BYOD policies create a perfect storm for users to intentionally or even accidentally breach SEC rules. 

 

How The Sector Could Have Avoided Billion-Dollar Fines

Sharing data using unauthorized messaging apps and personal email accounts not only flouts SEC regulations but can also expose sensitive data to security risks. Symmetrium’s zero trust mobile access solution has been specifically designed to help organizations operating in highly regulated sectors to remain compliant by keeping data protected, particularly in BYOD environments. 

Symmetrium is device agnostic, and works by the creation of virtual mobile devices (VMDs) within the organization’s own IT environment. These VMDs sit within this protected environment and when remotely accessed these virtual devices act as extensions of all organizational security and compliance policies using end-to-end encrypted streaming. So when messaging using Symmetrium’s mobile access solution, all regulatory obligations are adhered to in this highly controlled environment. The result is a completely secure, compliant and native mobile experience with seamless deployment and management.

 

Ensuring All Data Remains SEC Compliant

With messages sent by authorized users virtually accessing Symmetrium via the organizational network, the messages and any associated data never sits on the user’s actual device. The result is that data remains secure and archived to meet SECs requirements.

Each mobile device acts as an on-prem laptop, allowing for full control over employee messaging to shield financial institutions from any risks associated with using messaging apps, such as WhatsApp. 

This allows for minimum-resources mobile messaging management via a central management console for all devices, OS and brands. All is integrated smoothly into existing security and GRC data access protocols through one single app. The result is organizations can finally be confident their data and messaging remains secure and compliant at all times, avoiding crippling fines and potential data breaches. 

Discover how Symmetrium can keep your data and employee messaging compliant by booking a demo here.

 

The Challenges in Creating a Secure Zero Trust Environment

Posted on by Inbal Meshulam

Most organizations will struggle to implement and securely manage zero-trust environments, due to the many challenges involved, without the adoption of Symmetrium’s Virtual Mobile Device solution. 

The traditional perimeter of organizational networks has been obliterated by the rise of remote work and SaaS services, forcing the implementation of zero-trust environments. This is necessary to cope with the unprecedented growth in endpoints and data sources operating beyond the confines of the traditional organizational network.   

Zero trust provides a more comprehensive approach to security than traditional methods. The core principle of zero trust is to trust nothing and verify everything. This means that all users, devices, apps, software and data both inside the network and outside must be verified and protected. Organizations can therefore, in principal, mitigate the attack surface nefarious actors target to steal data, compromise passwords and other malicious activities. 

 

Problems Implementing Zero Trust

While zero trust is a key strategic focus for most organizations to reduce risk, according to Gartner, very few organizations have completed the scope of their zero-trust implementations.

Many of the associated challenges to implementing a true zero-trust environment are linked to the hybrid work culture, which has become a significant obstacle in securing this model. With more employees working outside the boundaries of the corporate network, using their own devices to connect to sensitive business data, security vulnerabilities have spiked. 

The use of non-secured mobile devices has resulted in an entire stack of identities and end-points that require a full set of resources to continuously secure, protect and manage it. This requires mapping how users and their devices access and interact with sensitive data. Solutions focus on managing these users and devices to help increase cyber resiliency and remote access. 

 

Zero Trust’s Fundamental Flaw

This exposes a fundamental flaw in their approach — a focus on users and devices, and not on data. So once users are granted access the data they access using their mobile comes to rest on that device. Thus the data is no longer in the secure confines of the corporate network environment and is exposed and vulnerable on the device it is now residing on.

Security will always be maximized when there is no data at rest and therefore no data at risk. This is how Symmetrium, a zero-trust data mobile access solution, enables productive collaboration while dramatically minimizing the risk of data breaches. It achieves this by turning any mobile device, managed or unmanaged, into a virtual extension of an organization’s network, with all its compliance, security, and IT. 

 

The Only True Zero-Trust Approach

Using Symmetrium means organizations don’t have to ditch and replace technology to implement a secure zero-trust environment. This is because Symmetrium creates virtual mobile devices (VMDs) that sit protected within the perimeter of an organization’s network and therefore adheres to all existing enterprise network security protocols. 

These VMDs use P2P encrypted streaming to allow authorized remote and third party users to view data using their own devices. This view-only data never leaves the protected organizational network and therefore is never transferred to an external device. This ensures the data at all times remains secure and never comes to rest on external devices.

With zero trust now vital for organizations to survive digital transformation it is critical to overcome the associated challenges. In a world where data, resources and employees are outside the enterprise perimeter, the only true zero-trust approach is to ensure “no data at rest” and Symmetrium’s VMDs are the perfect solution to make this happen.

So, isn’t it time you reconsidered your approach to zero-trust security? Book a demo with Symmetrium here.

close-tag

We’re proud to be the ones making TPRO, CISO, IT and vendors - happy

by ramping up zero-trust mobile access.

Schedule a meeting