The document discusses the growing importance and risks associated with mobile technology in business, highlighting that data breaches are a significant concern due to the potential loss of valuable data stored on mobile devices. It emphasizes the necessity for organizations to implement a Mobile Technology Risk Strategy (MTRS) to address governance, security requirements, and execution roadmaps while calculating the financial implications of data breaches. Additionally, it outlines the benefits of mobile technology in enhancing business efficiency and workforce capabilities.

1. Managing Mobile Menaces A Strategy for Managing Mobile Risks By Nalneesh Gaur, CISSP [email_address] Diamond Management & Technology Consultants

2. Mobile Technology Space is Crowded Wide Area (CDMA, WiMax, 3G) Plugged Special Purpose Connectivity Multi- Purpose Device Tablet PC Smartphone PDA Memory stick Local Area (Wi-Fi, BT) Digital Camera Notebook PC Mobile technology refers to the plethora of portable solutions that enable organizations to conduct business from anywhere at anytime Mobile Phone OnStar Next Slide MP3 Player GPS Slide 2

3. Mobility is Everywhere and Growing Mobile voice and data spending represented almost a quarter of FY 2005 telecom budget 1 Two-third of US households and businesses now have wireless networks 1 A seventh of the US households have a Smartphone 1 The smartphone market grew over 70 percent in 2005, and will grow significantly during the next five years 2 Microsoft estimates that there are nearly 12 million smartphone devices in use 1 – 2006, Forrester Research 2 – 2006, In-Stat Research Next Slide Slide 3

4. Mobility Risks Stem from Data Breach Often the data on the mobile device is far more valuable than the device itself and must be appropriately protected Breach of Personally Identifiable Information (PII) is governed by several state, federal and industry regulations, for example – HIPAA, GLBA, California SB 1386 and PCI 32 US states have passed laws requiring businesses to notify businesses in the event of a breach More than 54% of all security breaches resulted from the loss of a laptop, mobile device or electronic backup – 2006 Ponemon Institute Report Last year, antivirus vendors detected more than 200 phone viruses Attack vectors such as spyware, phishing, pharming, malware, zero-day browser attacks, and botnets are climbing rapidly According to Trend Micro, almost 30 types of malware have been found for the Windows smartphone device alone Next Slide Slide 4

5. Data Breach is a Business Issue Loss of PII, trade secrets and business documents in a data breach is a business issue beyond the IT department A data breach results in both direct and indirect costs to the business Direct costs resulting from legal, correspondence and personnel costs Indirect costs resulting from lost sales, legal liabilities and loss in customer trust Negative publicity is expensive and drains the confidence of buyers, partners, customers and investors A study by McAfee finds that a third of respondents in the study believe that a major data-loss incident involving accidental or malicious distribution of confidential data could put them out of business Next Slide Slide 5

6. Combat Mobility Risks with MTRS Next Slide Slide 6 M obile T echnology R isk S trategy (MTRS) Governance Execution Roadmap Business Case Security Require-ments

7. Develop Business Case by … Assessing the threat of a data breach and its impact on the business Quantifying the direct costs of the impact: The direct incremental cost of a data breach is $54 per lost record, according to an August 2006 Ponemon Institute report Typically, the amounts are higher for smaller data breaches because the legal, correspondence and personnel costs are spread across a smaller base Identifying other indirect consequences: Fines and penalties—including civil and criminal penalties 1 for company officials found negligent in protecting customers' personal information Class-action lawsuits, damage to market value, loss of business relationships and even bankruptcy [1] HIPPA non-compliance entails civil penalty of $100 per violation and up to $25,000 per year for same violation; Criminal penalties of up to $250,000 and 10 years in prison for disclosure under false pretenses with intent to sell or use for commercial gain or malicious harm Next Slide Slide 7 M obile T echnology R isk S trategy (MTRS) Governance Execution Roadmap Business Case Security Require-ments

8. A Business Case is Based on Risks ARO = Estimate of frequency at which a threat will occur with in a year and is characterized on a annual basis. A threat occurring once in 10 years has an ARO of 0.1; a threat occurring 50 times in a year has an ARO of 50 PII = Personally Identifiable Information Financial Risks Business Risks Drop in stock price: On Feb. 1, TJX stock closed down more than $1 – 3.6 percent – to $28.49 a share, on volume that was three times the daily average owing to the data security breach Loss of Business Relationship: Visa USA Inc. and American Express Co. stopped doing business with CardSystems Damage to Brand Reputation: Study by Ponemon Institute finds that the loss due to customer churn averaged $2.6 million for companies with breached data. Next Slide Slide 8

9. Develop Governance Structure by … Identifying relevant business units likely to be impacted Communicating the business case to the concerned business unit leaders Establishing a steering committee by soliciting participation from: Marketing Legal Customer-relationship departments Chief Security Officer (CSO) and other risk managers Defining the goals and objectives for managing the mobility risks Writing a mobile policy Next Slide Slide 9 M obile T echnology R isk S trategy (MTRS) Governance Execution Roadmap Business Case Security Require-ments

10. A Mobile Policy addresses … Types of devices Permitted technologies Trusted devices Data protection methods Accessible information Lost devices Line-Of-Business (LOB) applications Slide 10 Next Slide M obile T echnology R isk S trategy (MTRS) Governance Execution Roadmap Business Case Security Require-ments

11. Develop Security Requirements by … Taking stock of your mobile assets Who uses mobile technology, and for what purposes? What types of mobile technologies are being used? How often and where? Understanding the information on mobile devices What data is stored on devices What types of information are exchanged between a device and business systems? Understanding existing protection measures What authentication mechanism protects the device? What data is encrypted? Understanding existing processes What software is used to synchronize or back up mobile devices? What process is in place to retire or dispose of the equipment? Tracking emerging mobile technologies Next Slide Slide 11 M obile T echnology R isk S trategy (MTRS) Governance Execution Roadmap Business Case Security Require-ments

12. Develop Execution Roadmap by … Developing and prioritizing the technical, procedural, and organizational solution in concert with requirements Developing a project schedule in accordance with identified priorities Identifying and evaluating vendor technologies in accordance with the project schedule Next Slide Slide 12 M obile T echnology R isk S trategy (MTRS) Governance Execution Roadmap Business Case Security Require-ments

13. Business Derive Benefits from Mobility Efficiency: Drastically reduces the use of paper and results in improved accuracy Workforce Enablement: Due to flexible data input options, smaller form factor, mobility and real-time access to information. Example use-cases include: An attendant at a car rental agency uses a PDA to process a vehicle return A remote diagnostic center sends a patient's EKG to a physician's Smartphone A retail store sales person uses a PDA to perform inventory and price checks A physician uses a tablet PC to review a patient chart, annotate X-rays, collect patient data, check lab results and write prescriptions An insurance-claims adjuster uses a Smartphone to photograph and instantly file evidence in an incident Next Slide Slide 13

14. Questions? Click on the questions tab on your screen, type in your question (and name if you wish) and hit send.