Aragon Research RESEARCH NOTE. Workplace Service. Mobile Security in a BYOD World

Transcription

1 Aragon Research Author: Mike Anderson Mobile Security in a BYOD World Summary: Employee-owned devices at work put significant strain on security and manageability. Government agencies need policy and mobile management tools to rein in security for the growth of BYOD. Mobile devices are rapidly permeating most organizations, and securing those that are employee-owned is a top issue. Mobile is becoming a fundamental element of computing, both in terms of support and in its integration with software strategies. This emerging trend is still rapidly evolving, and today s enterprises face growing pains as the change encompasses them. This note deals with the information security aspects of mobile systems and the bring-your-own-device (BYOD) movement. Topic: Information Security, Mobile Issues: What risks will cloud computing bring to the firm? What are the cloud and networking best practices regarding security? What are the best practices for harnessing the power of mobile computing? Planning Assumption: MDM and MAM will consolidate into integrated mobile management by The percentage of organizations with BYOD programs continues to grow, and Aragon expects 75% of large organizations to support this approach by the end of Government agencies have been slower to accept it than most others, primarily due to HR or legal policy concerns, and for issues regarding security. Although there are circumstances where agencies with classified roles or data must restrict BYOD because of security issues, large non-defense organizations are increasingly open to BYOD approaches and policies. For government agencies especially, BYOD pressures are great. Certainly the benefits are similar to those in private enterprises, with worker demands and technical capability being key drivers. However, government agencies have additional needs that make addressing BYOD a high priority. The growing movement toward telework, guided by the Telework Enhancement Act (TEA), is rapidly expanding the population of workers who access work networks and applications from home or other non-traditional places. The government cloud-first mandate is increasing the pressure on agencies to effectively migrate to cloud solutions, and basic office functions like , document sharing and collaboration are often the first to move. Copyright This publication may not be distributed in any form without Aragon Research s prior written permission. The information contained in this publication has been obtained from sources believed to be reliable. Nevertheless, Aragon Research provides this publication and the information contained in it "AS IS," without warranty of any kind. To the maximum extent allowed by law, Aragon Research expressly disclaims all warranties as to the accuracy, completeness or adequacy of such information and shall have no liability for errors, omissions or inadequacies in such information. This publication consists of the opinions of Aragon Research and Advisory Services organization and should not be construed as statements of fact. The opinions expressed here-in are subject to change without notice. Although Aragon Research may include a discussion of related legal issues, Aragon Research does not provide legal advice or services and its research should not be construed or used as such. Aragon Research is a private company and its clients may include firms or financial institutions that have financial interests in entities covered by Aragon Research. Further information about the objectivity of Aragon Research can be found at aragonresearch.com

2 Individual workers are also increasingly encouraged to select and acquire their own devices by the federal executive order calling for increased attention to the cost of employee computing devices. Business or agency owned devices typically have stronger security, and usually a policy that restricts personal use. Concerns over breaches or data loss are real, with multiple areas of content exposed (see Note 1). If BYOD is an option, users increasingly opt to use their own phones and tablets. Although IT organizations need to control at least some of the networks, apps and data that users can access, to a great extent users can connect to their work and personal lives with a single device. Dealing effectively with mobile and information security requires a much more robust strategy than it did a few years ago. Providing a single platform with predominantly agency-owned devices and as the main app is no longer viable. IT organizations now face a newly diverse and complex environment armed only with PC-oriented skills and procedures that need to be overhauled for the mobile world. One issue: the two main types of software that manage mobile systems hardware-focused mobile device management (MDM) and software-focused mobile application management (MAM) are on a collision course. Mobile Device Management MDM has been around longer than any other mobile management approach. Initially aimed at helping enterprises control their growing investments in smartphones, MDM became a de facto foundation for managing and securing an increasingly diverse population of devices, carriers and platforms. If an enterprise owns most of the devices that employees use for work, MDM can establish a wide range of policies and controls that allow IT to manage access and security (see Note 2). The main focus of MDM is to control the devices themselves. Features such as configuration control, performance management, and over-the-air troubleshooting characterize MDM tools. The focus is on ensuring effective management of the devices as enterprise assets, and handling situations such as lost or stolen devices. MDM is the best way to secure and lock down devices. However, the device-centric approach exerts tight control, and limits how employee-owned devices can be used on the enterprise network. Note 1: Information at Risk on Mobile Devices Financial information Classified reports and information Personally identifiable information (PII) Employee personnel data Contact data for other employees Task and schedule information about projects Note 2: Essential Mobile Security Features Enforced passwords Device encryption Multi-factor authentication Remote lock & wipe Mobile asset tracking Remote control GPS tracking Page 2

3 As more and more personal devices are used at work, IT needs to manage and secure the enterprise without totally controlling the devices themselves. Mobile Application Management The focus of MAM is on software rather than devices. It builds on the access and distribution role of the enterprise app store. Rather than trying to control the devices, MAM controls the use, configuration and security of the apps in use across the full range of a mobile device portfolio. Software distribution is an essential ingredient of this approach, and an app store is an essential tool for implementing software and content distribution policies. In addition to managing the apps and their distribution to users, MAM allows enterprises to control the access to and use of company data according to defined roles and policies (see Note 3). App-level authentication and access control lets businesses create policies and systems that protect their information while giving each worker the right access to the apps and data that they need. MAM incorporates security, role-based management, and authentication features found in MDM approaches as well. MAM is most useful to businesses that have growing app portfolios and that support BYOD, which tends to create an increasingly diverse universe of disparate mobile devices. MAM is especially needed by enterprises that have embraced or been overrun by personal phones and tablets owned by workers. MAM can differentiate corporate apps and data from personal ones, and can secure and protect corporate assets without erasing or disabling a personal device. Building and applying policies at the app level rather than the device level is an increasingly popular way to manage personal devices used for work. A new class of MAM vendors has emerged to focus on this app-centric approach. Although these MAM vendors distinguish between apps and devices to differentiate their offerings from older MDM products, MDM vendors are expanding their methods to incorporate many of the same capabilities while MAM vendors, in turn, begin to address device issues. As this convergence and consolidation evolves, each enterprise buyer will have to align the strengths of the various technical approaches to its own mobile portfolio and priorities. Note 3: App and Data Security Considerations Application permissions App whitelist and blacklist Automated backup App license tracking and compliance Data download policy and authorization Page 3

4 The Enterprise App Store The enterprise app store is a key ingredient of any approach to managing the mobile environment through software controls. The public app stores have proven highly skilled at helping consumers find and acquire apps, and helping developers distribute and update apps. When enterprises deploy work-related apps, they need to manage distribution, promote user adoption, and control releases and updates in ways that meet their specific needs in a controlled and secure manner. Using some of the same ease-of-use features that have made the public app stores so popular, enterprises can provide similar showcase and distribution capabilities. Enterprise app stores can support a custom mix of mobile devices, and control which apps are available to which employees, including apps developed inhouse as well as those available publicly. The strength of this model is similar to that of a consumer store. A simple app store provides information about the apps, perhaps including feedback from users, and simplifies downloads and updates. Over-the-air (OTA) distribution makes it easy for apps to stay current and maintained, along with the associated data. For IT groups, an app store simplifies life-cycle management. Just uploading apps or updates to the store initiates the process of distribution and refresh, which can occur with or without user participation. A single method can support both company and personal devices on multiple hardware and software platforms, and simple controls can make it impossible to download the wrong version of anything. Paths to Mobile Management Enterprise app stores, MDM and MAM are important ingredients of an effective mobile strategy, but no single approach or product has emerged to address the entire breadth of needs. At the same time, evolving organizational requirements are creating opportunities across the spectrum of capabilities (see Figure 1). Organizations with many internally developed mobile apps can start by focusing on distribution and deploying a private app store. Organizations that need highly secure access to and other apps, as well as tight control over device selection, can use MDM to tightly control the environment, especially for enterpriseowned devices. A complex environment with a broad mix of enterprise-owned and BYOD devices, both public and internally Figure 1: Paths to Mobile Management Page 4

5 developed apps, and the need to separate control over personal and work apps and data will require capabilities across the full range of mobile management tools. Security Securing devices, apps, data and the network are essential elements of a mobile device strategy. For enterprises whose top priority is strict security, MDM provides the strongest controls. In the event of a security breach such as invalid passwords entered, or no system access for set periods of time the entire device can be locked or completely wiped. In this scenario, strong controls over a system s apps and data can be established by individual and by role, and associated with approved devices. Personal v. Professional Personal content on personally owned devices used at work can create a potential legal liability. Allowing users to leverage those devices in the workplace, to access business networks, apps and data, requires both policy and formal consent from the individual (see Note 4). However, when action is needed to secure a breached or lost device, completely locking or wiping the user s device may not be acceptable. In the case of BYOD it is typically unacceptable, or even illegal, to completely wipe a personally owned device and all its apps and data. It can also raise a risk of civil liability if users assert they have lost something irreplaceable. In such situations MAM provides a broader range of approaches than MDM s more draconian options. Controls can be based on user role, individual, and context. Users with security clearances can get access to individual apps and data sources. Encryption can occur at the source (based on existing policy and approach), over the network, or on the individual device. In addition, as in MDM, lost or breached devices can have the agency apps and data wiped, while leaving personal information alone. For some, wiping the personal content is also an option. Some users will be able to perform a self-service lockdown or wipe when they find a device has been lost or stolen - providing even more rapid containment of any security exposure. Protecting and Securing Data Note 4: Consent for BYOD use Responsible for appropriate use Responsible for reasonable security Responsible for information protection Approve remote monitoring Agree to use specified OS and apps Agree not to jailbreak or root device Page 5

6 In addition to the devices and apps, data protection is a critical part of an effective mobile management strategy. Even when users are approved, devices supported, and apps enabled, there will be differences in user access to sensitive data. For some roles, it will be important to never allow access to sensitive data, while others will find it essential to store such data locally on a smartphone or tablet. Whatever the strategy, data security requires attention, and needs to be addressed regarding multiple states where data may exist. When the data is stored and not being accessed it will be stored behind the firewall and typically encrypted. Ensuring appropriate device security and user authentication provides effective control until the data is transmitted to a user-owned device. This connection can be managed in multiple ways, from using SSL and VPN to secure connections, to separating individual apps and their connections to data sources through secure networks. Once accessed, data presented to the user needs to be secured. Decrypted data displayed on a mobile device may be transient (only exists on the display), cached, or stored locally. Each such instance should be addressed, and role-based needs should be understood to ensure appropriate protection. Encrypting cached and locally stored data provides strong security, but will often be insufficient and will need to be supplemented. Mobile devices, particularly those that are personally owned, have a different profile to be managed. The mobile device may be lost or an employee may leave, necessitating action to prevent data loss. In some instances, where the device is lost and the user accepts the need to destroy all its content, a remote wipe feature will suffice. In other cases it may be desirable to wipe data only for a specific application, while leaving other work and personal content untouched. The more options the management system provides, the more granular a solution can be applied to meet the maximum number of possible circumstances and threats. Aragon Advisory In BYOD environments, a mobile security strategy needs to address apps and data as well as devices. Plan to control network access to enable better security management. Ensure that all mobile apps support SSL connections. Page 6

7 Deploy mobile apps via a secure private app store. Buy, do not build, a private app store. Legal and policy issues will differ by organization and geography and must be integral to the BYOD program. security should allow content to be wiped, or the entire device to be wiped, in the case of breach or loss of device. Evaluate data security needs, and the risks associated with potential data loss. Consider tools that can address data security and limit data loss at the device, app and network layers. Bottom Line BYOD is a force that needs to be addressed by every enterprise and agency. Without a policy that bans or restricts their use, individuals will seek every opportunity to leverage their mobile devices and apps at work. In such an environment, agencies need a mobile strategy that addresses security for users, devices, apps and data, and can manage at both the app and device level to meet specific security threats. Page 7