I don’t think anyone will argue that mobile isn’t hot. Never before have we seen a technology where consumers are driving it so aggressively into the enterprise. Organisations are being forced to react and develop mobile security strategies to support the demands of end users. The difference in this case may be that consumers are not only demanding support for mobile device access, but they are also demonstrating a willingness to supply their own devices, spurring the bring-your-own-device (BYOD) movement.

So just how big is this trend? According to eMarketer, there will more than 2 billion smartphones worldwide in 2016, and Gartner estimated that mobile downloads will rise to 268 billion by 2017.

Mobile has changed how we think and work

With the proliferation of mobile into our personal and professional lives, we are seeing changes in our expectations of how we interact with others, whether it be individuals or organisations. We expect to be able to communicate with people regardless of location, and we are demanding access to information and resources in the same manner. Whether it is a restaurant reservation, tickets to an event, product availability, shipment status or the latest sales figures, we want to be able to access the information at any given moment.

Mobile has put the expectation of on-demand data into our heads. In our professional lives, we expect to have access to the corporate resources we depend on whether we are in the office, on the road, out to dinner, on vacation or even flying. We have hand-held mobile devices capable of accessing enterprise resources and expect the companies we work for to support that access.

Mobile is redefining where, when and how we do work and has changed how we think about ‘everywhere’. It used to be that ‘everywhere’ was the office, our home or on the road. Now, ‘everywhere’ is the car, a restaurant, the pool, the dinner table, the nightstand and even into the bathroom. There is no place that these mobile devices don’t go with us.

Mobile security for the enterprise

Companies want to provide the mobile access being demanded, but mobile devices bring with them a whole host of issues that we haven’t seen before. The size and portability of them make them easy candidates to be lost or stolen. The BYOD angle creates a new situation for the enterprise; a situation in which IT no longer owns, controls and configures the device. With mobile devices, apps can be added at little to no cost and with little to no effort. Operating system updates are widely promoted, along with the new features that come with it, resulting in end users updating within hours of the version release. With the end user controlling the device and eager to make updates, IT is left trying to stay abreast of the changes and how they might impact risk associated with mobile device access.

The immediate and most obvious thought is to deploy some measure of security to protect the device in the event it is lost or stolen. In fact, when IBM sponsored a study by ISMG, 57 percent of companies stated device security was a primary factor inhibiting them from a full deployment of a mobile workforce. To address this issue, companies have flocked to mobile device management (MDM) solutions. MDM allows them to identify the devices and users, protect the device and put measures in place that would enable them to wipe the device clean in the event it is lost or stolen. The good news is that this is a great start for deploying a mobile security strategy. The bad news is that while protecting the device is a great start, this is where many of them stop. Unfortunately, this step is just the start of a comprehensive mobile security strategy.

Protecting data along with the device

Enterprises need to think beyond just the physical device. They need to think about how they will secure the content created or stored there and how the individual will use the device to collaborate with others. Do you want employees to intermingle their personal and business content, or do you want to separate the two in hopes of reducing the risk to the enterprise? Can they copy, paste and email content from the device to others via unsecured networks, or will you restrict how they share the content?

Then there’s the question of safeguarding the applications and data. What applications will be on the device, and how will users obtain those applications? Will they download from a public app store, or will you provide them with a private app store? Will you develop your own applications or distribute applications created by others? Regardless of the source, how will you test applications to ensure they are secure and are not providing a back door for hackers to deploy malware onto the device and into your environment? A recent case study on application security reveals significant savings related to app testing. The organisation indicated it had reduced the cost of correcting application issues by as much as 95 times by testing earlier and more often in the development process. If you develop your own applications, can you protect the intellectual property that has been put into the app? Can you be sure that hackers can’t reverse engineer your application, inserting malware into it and preying on unsuspecting end users?

Finally, how will you manage access and identify fraud? What steps will you take to identify users and devices that are attempting to access your enterprise resources? In the world of laptops and computers, each device had a unique signature that allowed you to identify it. Mobile devices don’t have that unique identifier. It is important that you are able to look at the characteristics of the access in context and assign a risk profile. Maybe it’s a typical transaction from an end user, but maybe the time of day, resources requested or actions being performed are not normal. Are your systems prepared to identify these variations and act on them? Can you identify a jailbroken or rooted device and deny access? Being able to view transactions in context is critical in terms of managing access and reducing fraud risks.

For more information visit the website: http://www.ibm.com/software/be/security/

See also: Security, safety and BYOD – The changing face of business communications