Answers to these questions will determine which mobile device types and operating systems can be allowed to access enterprise data.

Transcription

1

2 Mobility options and landscapes are evolving quickly for the corporate enterprise. Mobile platform providers such as Apple, Google and Microsoft, and leading device hardware vendors are constantly updating their product line-ups with new smart devices that fit a wide range of business needs and technical requirements. In addition, wireless coverage from the mobile operators is non-uniform across all geographic areas. These factors have greatly taxed the budgets and resources of enterprises supplying corporate-owned devices to their employees. To address these challenges, many enterprises are allowing their employees to bring your own device (BYOD) to access to corporate data. BYOD access allows end-users to pick a smart device that best suits their individual requirements, and a mobile operator that has optimized coverage for their geographic location. A BYOD policy empowers end-users with the power of choice but can have the opposite effect on an enterprise s IT organization. IT, in most cases, is charged with securing and managing servers, desktops, and laptops. When the enterprise adds managing and securing BYOD mobile devices into the mix, it can prove to be a daunting task. There are some fundamental questions that require answers before a successful implementation of a BYOD model. These questions are: What mobile security policies should be enforced on BYOD mobile devices to protect enterprise data? How will these mobile security policies be implemented on BYOD mobile devices? Answers to these questions will determine which mobile device types and operating systems can be allowed to access enterprise data. 2

3 Security Policies Determining which security policies to apply to BYOD devices is a tedious endeavor. BYOD devices contain both corporate and personal data and applications. IT must specify security policies that protect corporate data while allowing maximum flexibility for personal use. Flexibility is core, but securing corporate data on the device is paramount. To protect corporate data, following policies are most commonly applied in organizations that implement BYOD: 1. Require PIN (Passcode) with the following characteristics: a. Depending on the organization, Simple (i.e. allowing a PIN such as 1234 ), or Complex (passcodes with a minimum specified number of non-alpha characters), may be required b. Minimum PIN (Passcode) length is specified, which is typically set to 4 to 6 characters depending on the enterprise 2. Require that data is encrypted while the device is at rest (i.e. not in use by the device user) 3. Specify maximum inactivity time to invoke PIN (Passcode). Typically that time is set to 5 minutes 4. Specify maximum number of failed PIN (Passcode) attempts before device wipes. Typically set to 10 failed attempts Best Practice: Protecting corporate data on BYOD devices is paramount in allowing access. The policies above are not all encompassing, and some organizations have implemented even more restrictive policies. IT must implement the mobile security policies that best suit the organization s security posture and requirements. 3

4 Mobile Policy Implementation Choosing how mobile security policies are deployed to BYOD devices is another critical decision IT must make. As a starting point, IT may choose to deploy policies to BYOD devices through Exchange ActiveSync. Exchange ActiveSync provides a limited set of security policy capabilities; however, many organizations require more advanced mobile security policies that go beyond those available from Exchange ActiveSync such as: ios jailbreak or Android rooting detection to prevent compromised devices that can be easily hijacked by malicious 3 rd party apps from accessing corporate data User identification/device certificate creation and deployment to quickly and easily provide users with secure access to corporate resources Wi-Fi configuration capability to enable only approved devices to access corporate Wi-Fi networks Device unlock to enable a device to be remotely unlocked in the event that the user forgets the device s PIN code A mobile device management (MDM) solution is required to implement these advance mobile security policies. These solutions operate independently from Exchange ActiveSync and most have a device agent that resides on the device. In addition to implementing advanced mobile security policies, these MDM solutions often also have advanced features such as in-house deployment of corporate applications, documents and media to ensure that users have access to apps and data required by the enterprise; and comprehensive device hardware, software and health reporting. IT has many options when choosing a MDM solution. Some solutions are stand-alone and require additional hardware while others leverage industry standard management platforms that the enterprise may have already deployed. The chosen MDM solution should be able to communicate with the device agent over the air (OTA) including WWAN and Wi-Fi network connections. 4

5 Choosing the right MDM solution for the enterprise quickly becomes an important task. Some important questions to ask MDM solution vendors are as follows: Does the MDM solution integrate with industry standard management platforms? Can BYOD devices be easily identifiable and grouped within the MDM solution for policy assignment? How does the end-user obtain the MDM device agent for the device? How does IT control which BYOD users are allowed to enroll the device in MDM? How are policies applied to the device? How does MDM resolve policy conflicts? Does the MDM solution have an end-user self-service portal? How is device wipe confirmation handled with BYOD devices in lost/stolen cases? What compliance reports are available for review? Best Practice: IT must choose how to apply and manage policies on BYOD devices to protect corporate data. Choosing the right solution becomes paramount because changing MDM products mid-stream has proven to be problematic and costly for many organizations. 5

6 Allowed Mobile Operating Systems and Devices While quickly evolving, not all mobile operating systems are at the same level of maturity from a security and management perspective. In addition, the mobile device hardware must be able to support the latest features. The good example of this situation are the OS and device hardware elements required to meet a policy such as enforcing encryption of data on a device at rest. On Apple ios, the device hardware must be 3GS or newer and it must be running ios3 to enforce this policy. Apple iphones prior to the 3GS release do not have the necessary hardware capabilities to encrypt data on the device. For Android, the minimum version that supports data encryption is 3.0 or later, and currently version 3.x is only available on Android tablet devices. No smartphone devices with Android currently support data encryption at rest. Future Android releases for smartphones are expected to support data encryption at rest. Microsoft differs in their two mobile device platform offerings. Windows Mobile being the most mature of all of the available operating systems has offered data encryption at rest since the release of the Windows Mobile 6.1. While broadly supported on ruggedized barcode scanning devices, Windows Mobile is being retired in the consumer space and device availability is sparse at best. Microsoft has recently released Windows Phone 7 in the consumer market place making it the newest mobile operating system to launch. Windows Phone 7 does not support data encryption at rest on any current device platform. Other mobile security policies that an organization s IT staff requires for BYOD devices may be not be uniformly supported across mobile OS versions, device manufacturers, or device types, so it is incumbent on the IT staff to specify the exact mobile device types and OS versions that will be allowed to access corporate data. 6

7 Best Practice: IT must determine the security posture the enterprise will take on BYOD devices before determining what mobile operating systems are allowed to interact with corporate data and resources. As evidenced above, different mobile operating system have different capabilities and these capabilities differ even among versions. Mobile operating systems should be reviewed frequently because they change rapidly. Today, a version of the OS may not meet enterprise requirements but the OS may meet requirements tomorrow. Mobile operating systems should be reviewed frequently because they change rapidly. Today, a version of the OS may not meet enterprise requirements but the OS may meet requirements tomorrow. Conclusion The good news is that solutions do exist for IT to have a successful implementation of BYOD devices. A systemic approach should be taken in the approach to BYOD devices. IT should never lose sight of ensuring that corporate data is secured on the mobile device. 7