Security Management Strategies for the CIO"...when Members use BlackBerry devices or cell phones while traveling overseas, especially in nations in which access to information is tightly controlled by the government, they are at risk of having their conversations or other personal information recorded or collected without authorization." Do BlackBerrys and other mobile devices put sensitive data at risk when used overseas? Is it an issue and how can it be mitigated?
Requires Free Membership to View
BlackBerry uses push-based technology to provide users with continuous wireless access to their email and PIM data. This means that messages are automatically delivered to the user's BlackBerry simultaneously with their reception at their corporate servers, eliminating the need for a user to log in and check for new messages as with regular email. To achieve this, all data transmitted to or from a BlackBerry device passes through Research In Motion Ltd.'s (RIM) servers in Canada before being forwarded on to its final destination.
This routing raises certain problems relating to privacy and security, as the data is being transmitted via a central third party server and passing through Canadian jurisdiction. For example, back in 2006, BlackBerry servers were found to be potentially vulnerable because they weren't encrypting user login data, and the database could be exploited through SQL injection via buffer overruns. Another problem is that although BlackBerry messages are encrypted, some countries prohibit or restrict the use of encrypted messaging. Canadian export laws actually prohibit their use in some countries.
As you can see, just the way in which a BlackBerry works means that you lose some control over your data. But a bigger problem arises when the technology is used abroad, since it may be operating on a foreign network that could be "government-controlled." China, for example, has full control over its telecoms and information systems. In fact, an Olympics fact sheet from the U.S. State Department warns that visitors should be aware that they have no reasonable expectation of privacy in public or private locations.
Before employees are allowed to travel overseas with a BlackBerry, they should receive training on how to use its security features and made aware of company policies and procedures regarding data security requirements. Such policies must cover data classification so that you can state what types of data can be transferred or stored on mobile devices. Encryption features must be turned on, with all sensitive data being encrypted. BlackBerry devices should be set up to use the Advanced Encryption Standard (AES) as well.
Another key aspect of protecting data on a BlackBerry is ensuring its physical security. A U.K. government aide in China for the Olympics had his device stolen after returning to his hotel with a woman he met in a disco -- a possible "honey trap." Your security policy should clearly state that mobile devices must be stored safely when not in use, and its loss should be reported immediately so that it can be locked and its data deleted or wiped remotely. I would recommend a policy of stripping down any mobile devices to a bare minimum when traveling overseas, or even using a surrogate device that is not connected to your systems on your return.
Also, sensitive data that isn't required for a specific trip should be removed and the rest encrypted and password-protected. Regardless of which country you are in, another way data can be stolen from a smartphone is via bluesnarfing. Using this attack method, hackers use the short-range Bluetooth wireless connection to access the device. As you can see, it is vital to ensure that any mobile devices are properly configured.
Finally always read and understand the small print when signing up for any service that handles your data. As a BlackBerry user, your organization has to provide an unlimited indemnity to RIM for loss or damages caused to RIM in connection with its users' use of BlackBerry. That could put your insurance policies at risk!
More information:
This was first published in November 2008
Join the conversationComment
Share
Comments
Results
Contribute to the conversation