Look to the cloud for mobile protection

According to IDC’s Worldwide Mobile Worker Population 2007-2011 study, the number of worldwide mobile workers will reach one billion by the end of 2011. And just as the mobile workforce is growing, so are the threats to computer systems. Understanding how to stop mobile workers from becoming infection vectors will be a crucial challenge in the future.

Traditional security mechanisms may not be enough. Many road warriors will be away from the office for days, making it difficult to centrally manage computers and ensure that desktop anti-virus software is regularly updated.

Another option is gateway protection, where laptops are protected by a software appliance on the network. However, this can be difficult to manage in a mobile context. It requires roaming users to point to the corporate network from whichever external access point they are using. The corporate network then routes them back out to the internet. This can put a strain on corporate network resources.

Gateway protection also creates a single point of failure. If the appliance fails, or if the virtual private network software becomes overloaded, employees may find themselves without access.

The third option is software-as-a-service (SaaS), in which a third-party security provider manages protection against malware, spam and spyware using its own computers on the internet.

SaaS provides more protection than is possible on a single mobile device. With malware writers employing increasingly sophisticated techniques, IT departments need to dedicate more resources to threat analysis and protection, a challenge when headcounts and budgets are strained. SaaS enables organisations to outsource security to a team of security experts.

SaaS also makes it harder for malware writers to design ways around detection. Research reveals a sophisticated development model behind modern malware, in which writers test their products against current desktop anti-virus engines. SaaS-based systems make it harder for them to design undetectable worms and viruses.

Modern online criminals employ dynamic mechanisms to dodge identification, such as constantly changing domain names and IP addresses. They also spread malware by infecting legitimate sites. BusinessWeek, the New York Times and even some UN sites have been infected previously, and mobile users have no way of knowing which sites are dangerous at any given moment. It is far better to let a web security vendor update the list of taboo sites centrally.

When looking for a SaaS solution, consider these guidelines:

• choose a vendor that can offer you a service level agreement for availability, so that mobile employees will not be left exposed;

• look for a provider that can balance its traffic effectively and route through the closest datacentres to you;

• ask are there several different authentication methods available? Is authentication seamless and transparent?

• seek a partner that can also use its service to enforce your company policies in areas such as inappropriate content for mobile users.
  

Ultimately, the next generation of computing will be about the intelligent delegation of control. With security SaaS, you are making an implicit agreement to hand control of endpoint devices to the users carrying them on the road. To do that safely, content control mechanisms must follow mobile users wherever they go. Putting protection directly in the cloud makes it ubiquitous and creates an umbrella of safety that no modern organisation with a mobile workforce can afford to do without.

Mark Tickle is a BCS contributor