Lack of built-in security shouldn't inhibit PDA use.

This summer, information security gurus from a variety of industry sector gathered to discuss how to solve the growing number of IT security concerns; securing mobile device was high on the list.

Unfortunately, some experts believe that the best way to protect your confidential information is no to put it on your PDA. Why? Because the devices lack built-in security. While this might work in industries that aren't reliant or constant data access to manage their businesses, it's simply not an option in healthcare.

As a former healthcare security administrator, I can tell you that this is the wrong approach, because, inevitably, someone with access to the enterprise will for get that what comes from the net work must stay on the network Further, mobility in healthcare is only now becoming a reality, and institutions beginning to reap the productivity benefits of wireless, technologies would experience significant setback if the data that could be transmitted on handheld devices were so severely restricted

Regardless of built-in security levels, doctors should not be forced to avoid transmitting or storing secure information on their handhelds when solutions exist to ensure the safety of both data and device.

Does Size Matter?

While small and compact, the new generation of handheld devices contains deceptively powerful enterprise computing tools. Further, PDAs are subject to the same basic vulnerabilities as other computing platforms and therefore require enhanced security. However because the handheld operating system is considerably smaller than that of a laptop, it is even more difficult for manufacturers to build in adequate security while maintaining computing power.

Mobile computing can be done securely with the right amount of risk management and the right application of security technologies. Securing information on a PDA, like any computing platform needs to be handled with forethought. There are a number of good tools available that can provide layers of security to protect sensitive data.

Use of personal firewalls, encryption of the data stored on the device and enforced passwords are all good ways to implement solid security protection for mobile computing without avoiding the transmission and storage of sensitive data on handheld devices. The most important factor in securing handheld devices without inhibiting their use or adoption is the development of strong enforced corporate policy.

Handheld Security Strategy

The healthcare industry is facing a major mobile security challenge: Leverage new wireless technologies to enhance mobility and improve productivity, but ensure that only authorized users make it through the front door. Meeting this challenge requires a well-developed security strategy for protecting handheld devices that connect to the enterprise.

Before designing a mobile security policy to meet the challenge, organizations should understand that using handheld devices does create a security risk. In fact, within minutes, a user can create an uncontrolled computing platform that can access an organization's proprietary information anytime, anywhere, opening a back door to the enterprise that unauthorized users exploit. What's more, because mobile devices are small and portable, they are easy to lose--potentially putting unprotected, sensitive corporate data into the wrong hands.

Additionally, it is critical to identify some key business issues-before setting forth on policy creation--including:

* Who should be authorized to use devices?

* Which types of devices should be authorized for use?

* Will the company provide the devices, or will users be authorized to bring their own devices and use them to access corporate resources?

* Which corporate resources will be available to handheld users?

* Which information is critical and needs to be protected?

* What implications will these decisions have on the organization's ability to ensure legislative policy compliance?

Follow Best Practices

When developing a mobile security policy in the healthcare arena, it is important to address the following issues:

* Supported technologies. This should include mobile device hardware, networking equipment (access points) and wireless applications.

* Confidential information. Specify which information is confidential and what can and cannot be stored on a mobile device.

* Privately owned hardware. Supporting mobile devices in the corporate environment will require policies that outline how to handle privately owned hardware versus corporate-owned hardware.

* Internet access. Using mobile devices to access the Internet and connect to the corporate infrastructure are key areas of concern. This includes allowing users to connect to the corporate infrastructure from a public access point, or connect from within the corporate infrastructure to the rest of the world. The same standard that applies to any other type of mobile user connecting remotely would apply to mobile devices.

* Device-level protection. Mobile devices are vulnerable to outside attacks, theft, damage or loss. Accordingly, an organization should implement the same type of security strategy that it would for any other type of computing platform on the network: strong passwords, file and directory level encryption, protection from attacks via outside networks, and security for file attributes and directory-level settings. A good information security process is implemented in layers, affording the maximum level of protection while still supporting the needs of the mobile work force.

Mapping Policy to Business Objectives

As with any emerging technology, the uses for and application of handheld devices will evolve with the organization's business needs and capabilities. Administrators in charge of creating and monitoring handheld security policies should revisit established guidelines frequently and adjust the policy based on usage trends, if the institution maintains and enforces timely procedures for handheld security, the organization can effectively minimize security risks and more fully reap the benefits that mobility offers to healthcare professionals and their patients.

Tom Goodman is the vice president of operations at Bluefire Security Technologies, Baltimore. Contact him at tom@bluefire security.com