The global hype around Nintendo’s new game, Pokémon GO, is unprecedented. But apart from being a fun attraction, it also carries with it an array of implicit risks to any organisation.
The first risk is that of the fake Pokémon GO apps, which was already identified by ESET and ProofPoint in the last few days. This risk can be mitigated by forbidding ‘side installations’ of applications that didn’t originate from the official application stores of Apple and Google, and through monitoring and identifying the existence of those fake apps on connected devices.
The second security risk is less intuitive and commonly overlooked. It is a risk inherent with every augmented reality game or application: the “Unintentional Shoulder Surfing”.
Wikipedia defines Shoulder Surfing as “using direct observation techniques, such as looking over someone’s shoulder, to get information”. Part of the thrill of the new Pokémon GO application is taking pictures of spotted Pokémons and sharing them with your social circles, such as in the following image:
Or in this image that was posted on a recent VentureBeat blog post:
Without being aware of it, proprietary software code, financial data, personal information and other sensitive data may be exposed and compromised through what seems to be a naïve, fun and social activity.
How to Block Pokémon Go at the Office
To mitigate this risk, organisations that care about their data are strongly advised to block the use of Pokémon GO in their office spaces and raise awareness by explaining the risks to employees.
Blocking Pokémon GO in the office can be achieved by using an application-aware firewall (e.g. NGFW) where a rule to block the Pokémon GO application traffic can be set.
Multi-site organisations that manage their security using on-premise NGFW appliances will need first to have their local application database updated (once Pokémon GO signatures are available from their FW vendor), and later define the blocking rule for each site of their organisation.
Multi-site organisations who have already transitioned to use Firewall-as-a-service, will only need to specify one blocking rule in only one administration application. This new security policy will be immediately enforced on traffic from all their sites and users.
Moving the perimeter to the cloud, enables organisations to push new security policy quickly, and to enforce it on any network, users, and devices – on the corporate network, or off.
As with all security risks, technological capabilities must be augmented with employee awareness of the potential risks associated with the game to mitigate them and prevent potential data loss.
Ofir Agasi is Director of Product Marketing at Cato Networks with over 12 years of network security expertise in systems engineering, product management, and research and development. Prior to Cato Networks, Ofir was a product manager at Check Point Software Technologies, where he led mobile security, cloud security, remote access and data protection product lines. Ofir holds a B.Sc. degree in Communication Systems Engineering.
