Technology Consumerization

BYOD advice for IT managers: is consumer mobile technology as secure as you thought?

Posted by Cesare Garlati in BYOD, Mobile Security Jul 24th, 2012 | 10 responses

Video post based on Trend Micro interviews at the Mobile Convention Amsterdam 2012 – Part 2.

PREVIOUS: BYOD advice for mobile users: have you thought about security?

An increasing number of companies are opening corporate networks and data to consumer mobile technology. The resulting trend, usually referred as the Consumerization of enterprise mobility, assumes even more disruptive connotation when the employees are allowed to use their own smartphones and tablets to work – commonly referred as BYOD or Bring Your Own Device.

Consumer technology is convenient, easy to learn and fun to use. However, consumer technology is generally not as secure and manageable as required by the enterprise. Consumer technology brings real business value in terms of productivity and business agility. However, the lack of a strategic approach to the consumerization of IT creates security risks, financial exposure and a management nightmare. Rather than resist it, organizations should embrace Consumerization to unlock its business potential. This requires a strategic approach, flexible policies and appropriate security and management tools.

A strategic approach to consumerization starts with a clear understanding of the security and management capabilities of each mobile platform. While no mobile platform is immune from security vulnerabilities and management limitations, some platform are more mature than others with regard to supporting the most appropriate set of policies required by the different mobile roles within the organization.

The analysis of the mobile security experts reveals that today’s mobile platforms widely differ in terms of security and manageability capabilities. As a group, modern mobile platforms provide substantially better security than traditional desktop operating systems when it comes to built-in security mechanisms, authentication and data protection; even though they are vulnerable to attacks that don’t affect desktop PCs. Application security, device management and corporate email support are somehow sufficient although offer room for improvement. The feature sets that IT managers should give high consideration to include security certifications, device firewall and support for virtualization, which is largely still missing.

  • BLACKBERRY OS:  When it comes to individual platforms, the experts’ analysis clearly points out that some operating systems are more mature than others. BlackBerry OS scores very high across the board, clearly separated by the group of the three emerging consumer mobile platforms. Corporate-grade security and manageability make this platform the option of choice for the most stringent mobile roles
  • APPLE iOS:  Now at its 5rd iteration, the leading challenger is Apple iOS. Apple’s proprietary approach has become more enterprise friendly: the strict control exerted by Apple on the overall ecosystem – from hardware to operating system to applications – makes this platform more secure and manageable in the consumer mobile segment. However, in contrast to RIM’s fully integrated approach, the backend components required to secure and manage Apple mobile devices are not provided directly by Apple but by a multitude of 3rd party vendors usually positioned in the Mobile Device Management segment. When complemented by 3rd party infrastructure, Apple iOS security and manageability are already good enough to be considered for mobility roles requiring device encryption and policy control.
  • ANDROID:  Despite its impressive market performance, Android security and manageability are the lowest in the segment. The Google Android operating system is at its 4th commercial iteration and has recently seen some important security additions such as device encryption support, however good Mobile Device Management APIs and a reliable control of the overall operating system versioning and application ecosystem are still conspicuous by their absence. The system is widely exposed to malware and data loss and the platform fragmentation resulting from the rich OEM ecosystem has proved quite challenging for enterprise adoption. IT managers should definitely consider adding Android to their set of flexible policies but probably limit its use to the least sensitive mobile roles.
  • WINDOWS PHONE:  Although last to enter this segment, Microsoft Windows Phone performs quite well across the board especially considering that this is a truly new version of the operating system. The system is too new to show a reasonable track record for enterprise adoption and corporate policies should take this reality into consideration when considering Windows Phone devices for mobile roles other than for general knowledge workers.