Beyond Policy: How to Protect Devices You Don't Own

As mobile devices proliferate on campus, IT staff build lines of defense to secure hardware and information.

With seemingly every member of the faculty, staff and student body packing at least one mobile computing device, IT managers at colleges and universities increasingly wrestle with the kind of security issues UNCW faces.

Simply reminding staff and students to use safety locks and strong passwords can be an effective first line of defense. But no matter how successful an institution is at instilling good security practices, such behavior must typically be augmented with technology, says Rodney Petersen, director of the cybersecurity initiative at EDUCAUSE.

Petersen says that while good security starts with policy, most IT staffs can't rely on policy alone. He suggests using encryption and other forms of general device security, such as auto-lock and stronger password protection.

“Colleges have an extra challenge in that they're often trying to protect mobile devices owned by individual students or faculty,” Petersen says. “They don't have a lot of control at the point of purchase.”

For UNCW, its security strategy starts with Absolute Software's Computrace LoJack for Laptops included with the mobile computers that the university offers through its discount program. The university urges students to purchase the LoJack for Laptops license or to use another tracking tool.

LoJack for Laptops, like other tracing services, embeds a software agent on the device that communicates with a monitoring center if the hardware is missing. The agent offers information about the physical location of the computer and network traffic in and out of the machine. Depending on the version installed, tracking software also makes it possible to remotely lock down the missing device and delete sensitive information from it.

Recovering stolen hardware often­ comes with collateral benefits, Mitcham points out.

“You often find that the thief has more than the notebook you traced,” Mitcham says. “When you recover the hardware, you're likely to recover your television and maybe some items that belong to other people.”

Smart Security

As for smartphones, encryption and password-protected access controls are musts, says Mitcham, who also recommends that users take advantage of tracing programs offered by phone
manufacturers.

At College of the Holy Cross in Worcester, Mass., BlackBerry smartphones issued to staff are secured through Research in Motion's BlackBerry Enterprise Server middleware, says Becky Chickering, senior technology support specialist. The BES server delivers Secure Sockets Layer encryption and enables remote security precautions for missing phones.

“If someone calls and tells me that a device is lost, I can issue from the server either a lock or a wipe, and within seconds that phone is locked with a password, or it's erasing the contents of the device,” says Chickering. She adds that it's also important to wipe a phone clean of information before turning it in to a provider for a new model.

Encryption is also important for notebook hard drives, as is using some form of tracking software to help retrieve errant hardware, says Chickering.

Holy Cross's Senior Technical Services Engineer David Shettler says his greatest mobile security worries focus on the information on the portable devices.

“The information is the real gold – people's identities, Social Security numbers, financial information, even medical records in some departments,” says Shettler, who is also the vice president and lead developer of the Open Security Foundation.

Holy Cross installs McAfee Endpoint Encryption software on mobile hardware owned by the college, which protects against unauthorized access to information in standard applications, including calendars, contacts and e-mail, Shettler says.

Encryption is part of Holy Cross's overall security strategy, which relies on classifying data, knowing where it's located and protecting it on the move and at rest, says Shettler. Encryption is too costly to be a standard application in the college's student notebook program, but the school encourages policies to protect mobile devices from loss.

“The cost of the notebook or smartphone is pretty significant to a student or their parents, so we get good cooperation. But no policy is going to prevent theft entirely or mean that no one will ever leave a device on a bus or the backseat of a cab,” he says.

Tracking Apps

St. Norbert College in De Pere, Wis., also uses Computrace LoJack for Laptops on many of the notebook computers purchased by students or assigned to staff. So far, the college has not had to trace a missing machine, but uses the software agent to track which applications are installed on college-owned notebooks, says Microcomputer Support Specialist Chris Brown.

The college is also implementing encryption on a limited number of devices, weighing the security benefits against some loss of performance, Brown says.

Unlike LoJack, which has no learning curve for users, encryption also requires an extra password, making the technology a little less convenient to use, Brown says.

“I'm sure people will use it once they understand what's at stake when they lose a device, but it's a harder sell,” says Brown.

Raising awareness of security is a big part of the job, says Brown. Even at St. Norbert, a small college with 2,200 students situated in a peaceful lakeside community, vigilance matters.

“We try to foster a safe environment in all ways, and we want people to feel relaxed,” Brown says. “But they have to understand that a portable device is portable for somebody else, too, and there's the danger – it can walk away. You have to take some steps to protect them, whether it means cabling them to a table or just changing your password every month.”

Security almost always requires a price paid in convenience, which is particularly true with mobile devices, says Petersen of EDUCAUSE.

“We love these devices precisely because we can carry them around and use them anywhere, so it's the ultimate trade-off to give up some of that convenience,” he says.

Gartner analyst John Pescatore sees a future in which mobile­ device users almost exclusively consume services and information from the Internet cloud, reducing the risk of data breaches when a device is lost or stolen. For now, he recommends some basic steps to secure mobile devices.

“Enforce password policies, support and enforce the timeout function on the device, encrypt the contents, and for smartphones particularly, enable a kill switch so the device is disabled as soon as it shows up on the wireless network,” he says. “With those minimal requirements, you know the data is safe. You still have to take all the usual precautions to protect the hardware.”

Security specialists like Mitcham at UNCW will take the usual precautions and more, continuing to bolster their ­defense of mobile devices along with the institutionwide security they provide on their networks.

“Bad people sometimes look at universities as easy targets,” Mitcham says. “That's not the case here, and we want to keep it that way.”