Proposed Practices To Mitigate Significant Mobility Security Risks

Abstract

Enterprise mobility is emerging as a fast-growing trend worldwide. Numerous risks originate from using mobile devices for business-related tasks and most of these risks pose a significant security threat to organisations information. Information Technology (IT) governance frameworks can provide guidance in managing these risks at a strategic level, but these frameworks do not effectively govern on a technical operational level. Implementation of these frameworks may also be inefficient, as they are generic and do not necessarily cover all the risks relating to a specific technology. This study provides organisations with guidance on how to govern these enterprise mobility security risks in an effective manner at both a strategic and an operational level. Using three IT governance frameworks, this study identified 12 practices that companies can employ to mitigate significant mobility security risks.

Security-Based Approach for Transformations of Mobile Accesses to ERP Systems

“…Different enterprise security approach patterns [24][25][26] describe steps of information security analyses. From the pattern of BSI [26] for the creation of a security concept, the authors derive a proposal (Fig.…”

“…From the pattern of BSI [26] for the creation of a security concept, the authors derive a proposal (Fig. 1) to combine this analysis with a two-stage feasibility check for transformations of the mobile ERP system access.…”

“…The increased requirements imply additions to the extensive security controls [26], which are already common for infrastructures that include stationary computing devices exclusively. The controls selection is intimately connected with the second stage of the feasibility check.…”

“…The expected level of security is calculated by a risk assessment [26,30]. For risk acceptance, risk tolerance of the company acts as critical value [30].…”

“…It shares the security risk also with the outsourcing provider. However, the partner often finds reasons to deny the compensation of occurring harms [26]. The greatest impulse for enhanced security of the mobile ERP access will be an outcome of the prospective ERP software offerings.…”