Analysis

Smartwatch security advice from the People's Liberation Army

Davey Winder reveals an odd report warning that wearable devices are a risk to national security

Earlier this month a rather odd report appeared in the People's Liberation Army Daily, itself a rather odd 'newspaper' which acts as military mouthpiece for Chinese government policy.

The report - and I use that term very loosely as on closer inspection I suspect that 'work of fiction' would be more appropriate - seems to warn members of the PLA against buying or using wearable devices as they are a risk to national security.

Advertisement - Article continues below

The story itself is very confusing, as it relates to a soldier who was apparently using a smartwatch to take a selfie with his comrades in arms. Odd as it sounds, I think the People's Liberation Army may just have a point, and one that the enterprise might do well to at least consider.

The story itself goes on to warn about the use of any wearable device which has an ad hoc network capability and which, therefore, has the potential in a military scenario to divulge location and movement data to an enemy hacker.

Still not convinced that this should mean the CEO is told his Apple Watch isn't allowed in the building? There's little danger of your organisation going on top secret military manoeuvres any time soon.

Advertisement
Advertisement - Article continues below

However, researchers at Context Information Security have coded an app which can sniff the Bluetooth Low Energy (BLE) signals used by many wearables in order to track users within 100 metres. While it's not clear how that would be used in a military scenario, as a proof of concept it's interesting, although not enough to worry the CEO or the IT security bods in the enterprise truth be told.

Advertisement - Article continues below

Look at it from a different perspective: what if I were to rephrase the PLA warnings from "smartwatch classified photography" and "GPS tracking of troop movements by unauthorised parties" to passive collection of data and the ongoing unauthorised transmission of that data to a third party instead? Does that make you sit up and pay a little more attention? Just don't make me use the BYOD word...

Too late, BYOD is on the table now and so it should be. Wearables are devices, and even more likely to be brought by users into the workplace without the knowledge or approval of the IT department.

A pair of Google Glasses isn't exactly inconspicuous and a fitness tracker may not appear to present a huge threat to data security, but what about the increasingly clever generation of smartwatches?

The PLA have got one thing right and that is the potential for any networked device to be a security threat. Because of that, include wearables of all flavours in your BYOD policy.

Advertisement - Article continues below

If the user can install applications outside of organisational security and privacy policy control then it is a risk. If the user can share data between that device and an ad hoc network, including cloud storage applications, then it is a risk. If the device is covered by organisational policy and security controls then that risk is at least mitigated. 

If even the PLA knows this, make sure you and your IT department do too. 

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/mobile/mobile-phones/355088/apple-lifts-iphone-purchase-restrictions
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020