AT&T Networking Exchange Blog » Ed Amoroso

Small Business Mobile Security And A River Named Denial

Ed Amoroso — Fri, 30 Nov 2012 12:10:20 +0000

As Chief Security Officer of AT&T, I can see clearly that cyber security threats are constantly evolving and becoming ever more sophisticated. And nowhere is this more apparent than in a business environment that relies on mobile devices and BYOD.

It may be easier to see mobile security as a concern for those of us responsible for the real-time protection of massive enterprise networks, but the threats are no less real for small businesses. In fact, according to Price Waterhouse Coopers, seven in ten small businesses go out of business within a year of a severe data loss.

Earlier this week, we released results of a survey, conducted by AT&T and the Center for Interdisciplinary Studies in Security and Privacy (CRISSP) at NYU-Poly, looking at the attitudes and current practices of small business owners regarding mobile security.

Although 82 percent of small businesses have taken steps for securing company laptops, only 32 percent are taking measures to secure smartphones – which are now more often than not, employee-owned. Unfortunately, all the well-publicized cyber security threats known for laptops and desktop computers are eclipsed by the emerging cyber security threats on mobile devices.

Hackers are turning their attention to wireless platforms to exploit their popularity and any potential vulnerability. Unfortunately, the unique capabilities of mobile devices – GPS, mobile applications, WiFi, Near Field Communication (NFC) – all compound potential new threats and come with multiple new points of entry for cyber attackers.

Take the example of tablet computers, which are rapidly replacing the PCs that busy executives carry everywhere as their mobile business desktop. Because these devices are relied on for extremely sensitive transactions, including confidential business discussions and preparations, and also banking, mobile payments, and other private personal business, they are increasingly attractive targets for cyber criminals.

With 59 percent of small businesses saying they rely exclusively on mobile devices, it’s more than troubling to see so many of them don’t have the necessary security protocols in place – or they’re unaware of the security concerns introduced by BYOD.

Many small businesses look to a Managed Security Service Provider (MSSP) for help because they don’t have the internal expertise to deploy and manage security controls that can quickly morph and adjust to the constantly changing threats. Just trying to understand the full extent of your risk profile can be a major challenge for a small business without a dedicated security team.

Partnering with an MSSP can help compensate for the lack of internal security expertise and keep your organization ahead of the changing landscape. At AT&T, we see a trend among SMBs toward cloud-based services due to their advantage of simplicity, no required capital expense, ease of maintenance and access to security experts.

This short video provides more detail on the study results:

As a small business, what are you doing to shore up mobile security?

4 Key IT Concerns about BYOD

Ed Amoroso — Wed, 09 May 2012 14:09:45 +0000

Today, Juniper Networks released the results of its Trusted Mobility Index. From my perspective as a chief security officer, the most significant insight from the report highlights the concerns of IT managers regarding mobile security. These individuals are charged with protecting company networks and information in this new mobile environment where perimeter control is becoming more and more difficult.

According to Juniper’s report, IT feels pressure from both senior management and other employees to support the Bring Your Own Device (BYOD) trend. However, IT pros reported concerns about the following consequences of BYOD:

Security breaches due to stolen devices – 41%
Knowledge required to manage devices – 40%
Knowledge needed to manage security protocols – 37%
Employees introducing malware – 32%

I’m not surprised at all to see this kind of response from IT. Our team at AT&T encounters these concerns almost daily with our customers.

The greatest challenge we see with BYOD in the enterprise is the massive distribution of security responsibility. We know it’s an unreasonable expectation to ask every employee to be a security administrator, configure proper personal settings for protection, and remain vigilant on updating the latest malware software. It’s an assumption we, as an industry, made with PCs – and we’re still paying for it.

That’s one reason why AT&T is lifting the responsibility of mobile security off the shoulders of individual employees and into cloud-based, corporate managed gateways – where our security experts can manage and administer consistent policy control over how and where data is accessed, stored, and moved across our mobile environment.

Another reason is that many of the types of attacks that are emerging in the mobile ecosystem can only be stopped via real-time policing and filtering at the network-level. Simply loading a security app onto the device is not sufficient, especially now that employees have mobile access to enterprise applications and data stored in the cloud or other virtual environments.

Before we had desktop PCs, computer terminals accessed information on mainframes and this model provided significant security benefits. There was no need for end-user software patching and no end-user platform for targeted malware. Similarly, a central cloud-based gateway, for all Internet and enterprise traffic means a central gathering place for policy-based routing and security intelligence for accessing corporate resources.

The virtualization of security resulting from increased enterprise mobility was also a major focus of this year’s RSA Conference. Here are my key takeaways from those conversations:

How about you? What do you see as concerns for the BYOD trend? How should they be addressed? We look forward to your comments.

Ed Amoroso, Chief Security Officer, AT&T Services

Ed Amoroso — Sat, 17 Dec 2011 20:49:48 +0000

Dr. Edward G. Amoroso serves as Senior Vice President and Chief Security Officer for AT&T Services, Inc. His responsibilities include real-time security protection of AT&T’s network and computing infrastructure – including mobility services; security policy, planning,and architecture for AT&T’s enterprise; security support for AT&T’s IPTV initiatives; and leaddesign, development, and operations support for AT&T’s managed and network-based security services.

Ed’s twenty six-year career at AT&T began at Bell Laboratories, where he worked on securing the Unix operating system, as well as numerous federal government security initiatives. More recently, he has championed AT&T’s network-based security strategy, centered around emerging in-the cloud protection services such as Network- Based Firewall and DDoS Defense.

Ed has authored numerous research papers, articles, and five books on information security, including the recently published “Cyber Attacks: Protecting National Infrastructure”.

He is the 1999 winner of the AT&T Labs Technology Medal for his contributions to large-scale intrusion detection and in 2010, Ed was elected an AT&T Fellow.

Ed holds M.S. and Ph.D. degrees in computer science from the Stevens Institute of Technology and is a graduate of the Senior Executive Program at the Columbia Business School. He has served as an Adjunct Professor in the Computer Science Department at Stevens for the past twenty two years, and his work has been featured by the Wall Street Journal, CNBC, Network World and the New York Times.

Hybrid Clouds Need Security Models [Video]

Ed Amoroso — Thu, 03 Nov 2011 09:06:26 +0000

Many security professionals are questioning the models which are necessary for Hybrid Cloud and Enterprise security. In this thought-provoking video, Ed Amoroso, AT&T’s Chief Security Officer, raises some important questions you’ll need to consider now and into the future. Watch this 1:34 video and gain some insights you might not have considered before.

View more security tips on AT&T’s Tech Channel

The AT&T Tech Channel is a video portal for the technophile in all of us. The site features shows that span today’s technological ecosystem, including in-depth examinations of industry pioneers, hands-on product reviews and the late night talk show-style “Hugh Thompson Show.” There’s something here for everyone, from the curious newbie looking for a laugh to the Twittering network engineer who wants the latest tips on securing a network.

Describe Complex Security Issues in Non-Technical Ways – An AT&T Security Tip [Video]

Ed Amoroso — Fri, 19 Aug 2011 10:59:30 +0000

Ever have trouble explaining highly technical issues to senior management? This difficult, but extremely important, communication issue is the subject of Ed Amoroso’s video this issue. Ed is the Chief Security Officer for AT&T and in this 59 second video you’ll hear a great analogy that helped before and can help facilitate your communication process today — and in the future.

View more security tips on AT&T’s Tech Channel

Phishing Requires Rethinking System Management [Video]

Ed Amoroso — Fri, 12 Aug 2011 10:22:37 +0000

The traditional mass email alert sent to inform users of a threat, a vital notice or other information has to change. Phishing has changed this process and it it time to rethink this process now. Ed Amoroso provides helpful ideas for you on this video (1:23).

View more security tips on AT&T’s Tech Channel

Removable Media Can Cause Information Leakage [Video]

Ed Amoroso — Fri, 29 Jul 2011 16:34:42 +0000

Those handy — and convenient — USB drives and other removable media can make life easier.
However, there is a challenge with data leakage that needs to be addressed for security purposes. Watch this video (0:49) from AT&T’s Chief Security Officer, Ed Amoroso, and get his perspective which can help you in your organization.

View more security tips on AT&T’s Tech Channel

Role-based Access Controls Are Effective [Video]

Ed Amoroso — Fri, 22 Jul 2011 10:41:19 +0000

Ever feel confused about roles and how to identify and clarify these in your organization?
Ed Amoroso, AT&T’s Chief Security Officer, has a valuable tip for you that can help security teams and process teams to understand the organization. This 1:11 video can give you a key to demystifying complexities in large organizations.

View more security tips on AT&T’s Tech Channel

Security Tip for Passwords [Video]

Ed Amoroso — Fri, 08 Jul 2011 11:09:42 +0000

Have you ever wondered what the #1 mistake is that people make in selecting a password? Watch this short (1:02) video from AT&T’s Chief Security Officer, Ed Amoroso, and find out what it is and how to avoid it.

View more security tips on AT&T’s Tech Channel

Colleges and Universities Should Review Networking Policies [Video]

Ed Amoroso — Fri, 01 Jul 2011 10:20:18 +0000

Ed Amoroso, AT&T’s Chief Security Officer, has an important consideration for all colleges and universities who wrestle with “open” vs. “closed” networks. There are some serious considerations and in this short (1:10) video you will discover some issues for both sides to think about.

Let the thinking begin!

View more security tips on AT&T’s Tech Channel