Managing Mobile Technology Securely and Effectively

Mobile devices provide a tremendous productivity growth to businesses of all sizes. We know of productivity gains of up to 1 to 2 hours per day. Businesses are taking notice. Analysts are forecasting increasing mobile spending in the years to come. And add the hype and the excitement around devices such as the Apple iPhone and BlackBerry Bold, I see steady uptake of mobility by business users as well.

Of course, as with any technology rollout and support, the process has to be managed diligently. The right tools and workflow need to be in place. Worst case scenario questions need to have answers – especially, when you consider some of the security bullets Todd recently blogged about with laptops. Security cannot be an after thought or a “supporting” feature – security and management of the entire mobile solution needs to be the foundation.

RIM is the industry leader in this space. BES can enforce 100s of IT Policy, deliver WiFi and VPN profiles wirelessly, push required business applications and exclude restricted applications. BES has been able to do this for a few years now. RIM even held off on delivering key features such as Bluetooth, Camera, and removable SD Cards, until it could securely enforce the most restrictive policies on these hardware features. Of course, RIM is doing all for this over an efficient, AES-encrypted, globally available BlackBerry network.

Now, contrast that with some of the newly announced Apple iPhone Administrative capabilities. Policies and settings are stored in an XML file on the server. (Oh and the server needs to be a Mac.) There is no role based access – anyone that has access to the administrative UI can change anything and everything. Then, it’s up to the user to connect their iPhone to their workstations and accept the policies. They can even choose not to accept some of the policies. The XML files that are downloaded are unencrypted and any VPN and WiFi passwords are in clear text. eWeek has a more detailed review of the Configuration Utility. The lack of controls over the hardware (such as camera and Bluetooth) and other applications (such as turning of SMS) also leaves a lot to be desired for. I am sure Apple has plans to address some of these gaps, but what Apple needs to realize is that these issues are concern #1 for CTOs in Financial Services. Push Email, a great media player and GPS are nice, but manageability is premier in the enterprise.

If designed and built well, security can be seamless to the end user. Sure - I have to type in a password to unlock my device, but I am used to the same experience on a desktop. This is not something I find especially annoying. However, if my IT admin requires me manually tether and then find and install software and policies myself – either I wont do it or will get it wrong. Apple has done very well with the iPhone. Businesses are taking notice. However, the bar is high. Security and usability are not two diametrically opposed – BlackBerrys prove this.

(written by Arun Nagarajan)

Comments

[Bill Chambers]

So you say "Then, it’s up to the user to connect their iPhone to their workstations and accept the policies. They can even choose not to accept some of the policies." I am getting exchange email on my iPhone and with it came a required device password that is, I was told, part of our IT policy. It doesn't appear I can reject this policy and still be on Exchange. Can I?

[Arun Nagarajan]

Bill - Thats a good one. You actually can't reject that policy. Microsoft Exchange actually enforces that. That's something Exchange puts on Windows Mobile and other devices as well. Apple has just licensed ActiveSync and that "hardcoded" policy comes with it.

[Claire]

The Wall Street Journal today reported on the challenges facing people who work outside an enterprise system (http://online.wsj.com/article/SB121803418845416977.html?mod=loomia&loomia_si=t0:a16:g2:r2:c0.0813958). Spyware that husbands can use to track wives and vice versa could be used by other parties to steal all kinds of information. And there is already a keystroke capture program for the Symbian operating system, the story reports.

Do you expect worries about this kind of hacking to push ever smaller and smaller businesses to take a more comprehensive approach to their mobile workforce? What is the minimum size of mobile force that you would expect to be using an enterprise-style mobile strategy?

[Arun Nagarajan]

Spyware and malware on mobile devices are definitely concerns for enterprises of all sizes. I see your point about how smaller organizations might be more vulnerable than the larger ones. RIM and the other platform vendors are recognizing this and releasing tools to account for home offices and mobile families. RIM has announced BlackBerry Unite (http://eu.blackberry.com/eng/services/blackberryunite/) to sync and manage several devices within a household. RIM also has BES Express (http://www.blackberry.com/select/professional/express.shtml) that is a free version for a single user of the same enterprise grade management tool. The same tool can be scaled up to 30 users for a nominal fee.

Surely, Microsoft and Apple are also looking into these sort of SMB offerings. Another option is to get a hosted solution so that the management and security is handled by a larger dedicated vendor.

As far your point about husband and wives spying on each other - that one I am not sure is an IT problem :)