By Marc Solomon, Fiberlink.

“Google hacked.”  “Google Hack Hits 33 other Companies.”  Headlines like this are a not-so-subtle reminder that security is not fail-proof.  If Google and some of the biggest companies can be compromised, so can any company.  There is a debate about whether the hack exploited a flaw in Internet Explorer or one in Adobe Acrobat.  Does it matter which one is to blame?  Either way, companies need to protect their systems.

The defense-in-depth strategy that most companies have deployed has been effective, but not perfect.  Of all the layers of security employed, the hardest to manage and control has been the endpoint (and the users using them).  Make that a mobile endpoint and the problem becomes amplified.

Mobility is changing the way we think about IT.  Endpoint security was adequate when the devices were always on the network.  However, when they leave the network, the efficacy of traditional tools reduces significantly.  Not only from the ability to reach them to ensure applications are running, up-to-date, and protecting the system, but also from the ability to report and provide evidence of coverage.  A brief illustration of the problem:  when analyzing laptops, it is not uncommon for a company to find between 30 and 50 percent did not have their anti-virus definitions up to date!

So how do you protect the endpoints, especially mobile laptops?  The following list of software and actions is one that you have seen many times, but it does have some tweaks.   End user training and education is not on the list, but is obviously critical.  Adding tools to your images like McAfee’s SiteAdvisor can help educate end users about dangerous places to surf.

The new fundamentals of (mobile) endpoint security:

1.      Ensure all Windows critical patches are applied correctly. Even with automatic updates, there are instances where patches get corrupted.  Windows will see the patch as applied, but if you analyze the actual files associated with the patch, some may not be the newest patched version.  Make sure you have a patching tool that analyzes patch application at the file level.

2.      Ensure common applications are updated. This one is newer. We have been talking for a decade that companies need to patch their systems.  And for all that time, the focus has been on patching Windows.  However, current headlines tell it all – “Skip Microsoft’s critical patch, focus on Adobe’s, experts urge.”  The bad guys are compromising systems any way they can . Applications, not the OS, are a common target these days.  Companies need to make sure common applications are patched and updated.

3.      All devices need to have anti-virus software.  Companies need to make sure that anti-virus software is installed and running, with up-to-date definitions.  End users sometime complicate this.  When installing software, many programs request that anti-virus and firewall software to be turned off.  The problem is that many end users forget to turn them back on after installation is complete.

4.      All devices need to have a personal firewall.  Companies need to make sure that personal firewall is running.  As stated above, some software installations can request a user to turn off anti-virus and firewall applications.  Sometimes the end user does not turn it back on.

5.      Ensure you have centralized management and reporting.  For 1-4 above, companies need to have centralized management and reporting.  Without this, a company cannot see where there may be issues and take action.  Without centralized reporting, they cannot respond to management or an auditor and provide evidence that all is working correctly.  For example, if a company is using Microsoft firewall or WSUS, they would be deficient in this area. 

6.      Ensure you can reach all devices, both on- and off-LAN.  Traditional management tools were built to work on the LAN.  However, devices are spending more time on the Internet and being mobile.  The best way to reach these mobile devices is to treat the Internet as your corporate network.  There are many X-as-a-Service companies out there.  Mobility as a Service is key to the new mobility age of computing.  Being able to reach and report on all devices quickly, from anywhere.  Now that is taking control.