The Information Security Forum (ISF) report Securing Consumer Devices specifically addresses the issue of securing enterprise data on consumer mobile devices and the role of mobile device management (MDM) systems.
The research shows that there are four main areas where organisations should focus their efforts:
- Devices and apps;
Governance should determine the strategy and approach the organisation adopts, for example allow any device to connect, provide users with a corporate device.
Based on that decision, the information security approach and controls required should be specified.
No matter the approach, the ISF's work highlighted 10 common responses (in addition to user education):
Read more on BYOD and MDM from the Security Think Tank
- Embrace BYOD, but be wary of the risks
- BYOD security: policy, control, containment, and management
- MDM is no BYOD silver bullet
- BYOD – key tenets and best practices
- BYOD means the map is no longer the territory
- BYOD – a challenge and an opportunity
- MDM just one way to lower the risk of BYOD
- Management is key to secure BYOD
- Cloud, BYOD and security – lock your doors
- Aim for a consistent solution;
- Clearly separate business and personal use;
- Demonstrate auditability;
- Deploy encryption;
- Deploy malware protection software;
- Implement an acceptable use policy (AUP);
- Ensure you can offer support;
- Accept you cannot block devices;
- Be proactive.
Organisations are increasingly treating the device – no matter its ownership – as untrusted or dirty. There is an increasing realisation that you cannot secure the device and so efforts must be focused on protecting the data.
This may mean stopping certain types of information being transmitted to mobile devices with a role for data classification, MDM and context-aware networks; adopting a virtualised or Citrix-like approach where data resides on the server, not the device; or using sandboxing.
The increasing processing power of devices actually can help security, as the devices can run anti-malware or encryption software such as that used on PC (although battery life is still an issue).
MDM is a tool that can assist in security. Most modern MDM offer services (for example, encryption, OTA upgrades) which can be woven into a consistent, enterprise-wide security solution especially when using sandboxes or similar on the mobile endpoint.
Successful MDM deployments need to be integrated with the governance approach, to support the
strategy and coupled to user awareness and training.
Adrian Davis is principal research analyst at the Information Security Forum (ISF)