Better Security Through Software
There should always be a clearly defined plan, or a goal when it comes to mobile security. The idea is to give the help desk and IT staff the tools they need to support the mobile workers, whether it is a line of business deployment or it is just mobile email. Having online remote control so IT can peek under the covers to see what's going on and solve issues is key. This way, you won't end up with a frustrated user and a frustrated IT team.
"The number one thing companies are looking for is security and encryption because they are worried about lost or stolen devices," said Sybase's Freeman. It's a good thing the number of tools IT can use to secure smart phones seems to grow every day. One long-time contender is Sybase's iAnywhere Afaria product. Afaria focuses on mobile device management and security.
From a functional standpoint, what that means is keeping software up to date, tracking the hardware and software, configuring settings, keeping files up to date, securing access to mobile devices, and securing the data on them. Smith Micro and Odyssey Software make similar products.
Mobile device management software such as that from Sybase, Smith Micro, and Odyssey lets IT control every aspect of a smartphone. Want to enforce passwords? Easy. Need to disable access to a smart phone's camera? No problem. Have to require VPN security? It's in the bag.
If your enterprise uses Research In Motion's BlackBerry Enterprise Server and accompanying devices, a lot of the tools IT needs are already available. RIM knows that security is mobile priority number one, and has built a plethora of device management features into its products. It's simply a matter of activating them and setting permissions for different user subsets.
Microsoft's Exchange ActiveSync server provides similar levels of control for Windows Mobile smartphones. It has 45 different functions that can be turned on or off, such as requiring complex passwords, or remote device wipe.
Smith Micro's Device Security Management Suite uses an on-device agent to control security, enforce policies, and manage software updates. "IT creates a policy and adds it to the server," explains Tom Matthews, VP and general manager of security and connectivity for Smith Micro. "Because we have a client-server solution, the policy is then pushed to the device. It receives this policy and the agent that resides on the device can take action and report information back to the server. The device can then be forced to load or unload applications, update virus software, or reset a password."
"Because there is growing prosumer use of smart phones," said Matthews, "the whole strategy behind policy control is so you can identify users. You'll need to be scanning to see if a rogue mobile device is being used on your network."
Odyssey's product does these things, but also collects network information. "When you have hard data, that helps the mobile operator find problems faster and in turn helps the enterprise customer," said Mark Gentile, President & CEO of Odyssey. Odyssey's Athena software makes sure companies have appropriate licensing. This way, from a support perspective, they know what versions of applications are on the smart phones. It also helps provision software updates, certifications, and policies all over the air.
Endgame
With the proper tools in place, securing your enterprise from the threat of mobile devices is manageable. Combined with the right set of policies, employee education, and software controls, there's no reason why smartphones should leave the back door open to the whimsy of hackers and ne'er-do-wells.
