How IT Can Prepare for Mobile Forensic Investigations

If your IT security team must comply with regulations like PCI-DSS or HIPAA, you need to know who accesses your data and what they do with it, even if they're using a mobile device to do it. But performing forensic investigations on mobile devices is trickier than it is on PCs.

By
Tue, October 16, 2012

CIO — As mobile devices proliferate in the enterprise, whether corporate-owned or part of a bring-your-own-device (BYOD) strategy, security organizations need to ensure they're prepared for the unique challenges of mobile forensic investigations.

This is especially true of organizations subject to compliance with regulations like PCI-DSS or HIPAA, but any organization could find itself in trouble if it can't get its hands on emails and SMS messages during an ediscovery process.

"If a company faces litigation or some other incident, do they have the capabilities to get the answers that these devices potentially hold inside them, whether through insourcing or outsourcing? That preparation is often an afterthought," says David Nardoni, a director in Pricewaterhousecooper's Forensic Services practice. "It has to be part of the implementation of your mobile policy."

[Related: BlackBerry CIO on Mobile Security, BYOD and the Modern CIO Role]

"Mobile devices really are a whole different world for investigations," he adds. "You could have guys that just spend all their time keeping up with the nuances of mobile devices, just like you have specialists in PCs that focus on network intrusions, etc."

Your Policy Needs to Give You the Right to Examine Employee Devices

Nardoni notes first and foremost that organizations should include a stipulation in their mobile policy that gives the security organization the right to examine an employee's mobile device whether the device is corporate-owned or brought from home.

"Companies need to ensure they have the right authority to be able to examine any device that is brought into their environment," he says. "People are using these devices in a different way than they use their PC. They consider these devices much more personal. Even if it's a corporate-owned device, they still communicate in much more intimate ways than they would if they were on a computer."

Embrace BYOD But Still Limit Authorized Devices

Mobile forensics provide many challenges beyond privacy considerations. The sheer number of devices and mobile operating systems present another key difficulty. There are now more than 800 Android devices alone, running many versions of the operating system. Forensic tools that work on one device or operating system may not work on another. Worse, the tools may be incompatible with new versions of devices or operating systems.

[Related: For BYOD Best Practices, Secure Data, Not Devices]

"When it comes to mobile devices, we are constantly trying to get a hold of devices as soon as possible to take a look at what's changed," Nardoni says. "We tell our customers: Before adopting the latest and greatest, make sure that your process and approach is going to be able to adhere to any device you want to use."

Continue Reading

Our Commenting Policies