magazine - Connect-World

Mobile security
employee to move data to clouds outside
enterprise control. Mobile devices are also
constantly connecting to any available
network, private or public whether or not it
is trusted. As a result, data moving between
a device and the corporate network is
vulnerable to man-in-the-middle attacks via
rogue Wi-Fi hotspots. Mobile IT needs to be
able to secure data-in-motion as it travels to
and from the device.
Lockdown will fail
Mobile devices should never be locked down
like laptops because lockdown fundamentally
damages the user experience impeding
productivity and impairing adoption. The
core tenet of successful mobile deployments
is the preservation of user experience. A
mobile program will not be sustainable
if user experience is compromised when
employees start using their personal devices
for corporate email and apps.
Every computing deployment, whether
mobile or not, carries some risk of content
loss. With mobile, there are several best
practices which organizations follow to
mitigate this risk to the point that it is
acceptable given the positive business value
of mobile.
Best Practices for Securing Mobile Content
Email attachments are the primary source
of enterprise documents on mobile devices.
Mobile IT’s challenge is to give users access
to business email on their mobile devices
while ensuring those users cannot save
business email attachments to apps or clouds
outside IT security controls. The security
challenge of mobility for the enterprise is
that this one-click sharing of information
from the device to external services is
simple and frequent. A business email
attachment can quickly end up in Dropbox
without any malicious intent or even effort
on the part of the user.
Ensure every device is under management
Every device needs to be connected to
a Mobile IT platform that can secure
and manage the device, the apps, and
the content. If the user deactivates or
removes the management client from the
device, that will trigger a policy violation
in the system. The system should be
configured to immediate block the device
and the apps on it from accessing the
corporate network.
Monitor the operating system
When a device’s operating system is
jailbroken or rooted the established data
security measures are no longer reliable.
Therefore, automated rules should
immediately quarantine the device, remove
corporate data, and notify the administrator.
Companies should also determine what
versions of an operating system they are
willing to support. Devices running on
the latest version will be up-to-date with
all available security patches while older
versions will not.
Set and enforce passcode policy and
encryption: Passcode enforcement prevents
unauthorized access to the device. Companies
should also implement an auto-wipe policy
that wipes the device completely after
a predefined number of failed password
attempts. This minimizes the risk of brute
force attacks on lost or stolen devices.
Protect email and attachments
Restricting email forwarding prevents
corporate email from being forwarded
through the user’s personal email account on
the device. It also prevents emails from being
moved by the user from a corporate inbox to
a personal inbox. Companies also need to be
able to restrict the ability to use third-party
file readers or document management apps to
open email attachments. When an attachment
is opened in one of these apps, it can be
saved or distributed completely without
the knowledge of IT. As a result, email
attachments are the biggest risk of mobile
data loss.
Establish identity
Especially in BYOD initiatives, user and
device identity must be strongly established.
Securing email, Wi-Fi, and VPN access
using certificates protects identity and
also improves the user experience since
certificates provide complex credentials
automatically.
Define the role of iCloud
In a well-designed corporate deployment,
iCloud will not increase the risk of data loss.
iCloud does not back up any email or PIM
content that comes from corporate sources
such as Exchange or Notes. iCloud also does
not back up encrypted data, which means data
from apps that use iOS Data Protection will
not be stored in iCloud.
Blacklist known threats
The mobile app landscape moves quickly
but most organizations have identified a set
of file readers or other apps that they do not
trust. These apps should be blacklisted so that
if an employee downloads a blacklisted app,
a remediation action will be automatically
triggered. This action could range from a
simple non-compliance SMS notification to a
full device quarantine which strips the device
of all enterprise email, apps, connectivity, and
settings until the threat is removed.
Conclusion
The old model for content security was
‘heavy containerization’. A container is set of
protected data. This data is separated from all
other data on the device and is protected from
unauthorized apps or users.
In the first generation of enterprise mobility,
all business data and associated apps were
segregated into monolithic, email-based
containers. While this protected business
data, it forced users into an experience they
did not like.
People buy an iPhone, iPad or Android
device because they love the user
experience that was developed specifically
for that device. When they use that
device at work they want to be able to
have that same experience. The heavy
containerization approach forces people
to flip between enterprise and personal
screens on their device or requires they
use a third-party email app instead of the
native experience they love. Not only do
these approaches compromise productivity
but they create security risks as employees
figure out workarounds.
In the new generation of enterprise
mobility, user experience is core and the
new answer is ‘targeted containerization,’
securing the enterprise content within the
native experience and leaving the personal
content untouched. Mobile First companies
know that mobile access to corporate
content is critical and their vision is that
employees can work the way they want to,
on the device of their choice, with the apps
that they love, and access to the content
they need, all in a secure environment. •
42 • EMEA 2013