MDM – Considerations for Security

With the advent of mobility, BYOx and the likes, enterprise security has transcended the realm of difficult, and become downright nightmarish. To tackle the challenge of managing and securing this complex environment, it is important to not forget the basic fundamentals of the business of technology defense and surveillance. There are some key considerations for the CSO when deciding on how to go about his / her business.

1. Strategize, don’t firefight – The most critical part of security is that it should be a part of the strategy, not an afterthought. It is critical to have documented policies, procedures, and guidelines for device usage and configurations. There should be also documented policies for the consequences of non-compliance, and financial responsibility. Enterprises must clearly define policies around reimbursement for services and what applications users can access via personal devices, along with clear guidance on who controls the data on devices.

2. Asset Management is the key – inventorying the devices and applications is the key to understanding the landscape that you are dealing with, which in turn is the single most important factor on deciding the security policies and technology. An organization that knows accurately what its technology landscape is is halfway there to managing it effectively.

3. Configuration – Device configurations should be centrally managed, wherever possible. This may be difficult to achieve with BYOD, but at least some configuration parameters should be defined for all devices that will be accessing enterprise apps and data. The configurations should be the first level of protection against malware and spyware. Also the data on the device can be protected through device configurations like data encryption and access controls.

4. Application protocols - Malware is a big issue with the app world, so even applications from the conventional app stores need to be checked before they are allowed to be used on the devices in the enterprise. Such malicious applications can take over the mobile device and operate in the background without the user knowing, searching for sensitive information such as passwords or banking details. It is important to monitor and restrict the protocols that the applications have access to, as it can help reduce the chances of Trojan Horse like attacks.

5. Training and documentation – Most enterprise users do not want to cause security breaches or issues. The issues happen without their knowledge, and in most cases, because the users are unaware of the dos and don’ts of mobile security. It is important to have the uses trained and aware of the enterprise policies. They need to know the right behavior in terms of mobile mannerisms. The users need to be informed what is expected of them if they are expected to do it.

6. Lastly, security – Finally, it is very important to implement the right security tools. Device and data encryption, anti-virus, anti-malware, enterprise certificate servers, and other measures need to be implemented.

Since the primary access platform for enterprise apps and data has shifted from personal computers to mobile smart devices, the attempts to use them to hack into the enterprise have also increased. Therefore, the focus on their security has also redoubled. It is imperative that the mobile devices be secured, for the enterprises to be able to breathe easy. While seemingly simple, these basic steps above go a long way in securing the enterprise mobile landscape.