Product Group Tests
Mobile device security (2013)July 23, 2013
Best Buy: Fixmo SafeZone v5.0
Recommended: Sophos Mobile Control v3.5
With bring your own device (BYOD), one would think vendors would be scrambling for new tools and techniques to handle the onslaught of users insisting on adding their smartphones and tablets to the corporate infrastructure. That, it turns out, does not seem to be the case, says Peter Stephenson.
In a relatively brief period, we have begun to see a stability that suggests maturity in the security products intended for the mobile market. This is not for the reasons we might expect - such as the technology not being ready for mobile device security, or that mobile devices don't need anything special or, more likely, there isn't a market. None of those things are the case. The real truth seems to be that the vendors are looking at evolving requirements and saying, "Yep... been there, done that". The state of the art in the products we looked at in this test is remarkably mature and effective. These are a batch of really fine tools, and selecting among them was a difficult task. When one of our products missed a tie for Best Buy because of some nearly trivial improvements to be made to some documentation, you know that the market is the real winner.
Mobile device security addresses several important issues. For example, being able to control the disposition of sensitive information that resides within the enterprise but can be accessed by a mobile device is very important. This addresses privacy, intellectual property and other confidentiality issues.
Also, mobile devices are prone to theft. It is important to be able to control access to sensitive information if the device is lost or stolen. Having a capability available to remotely wipe the device - either completely or selectively - is critically important. The most complete systems can do a selective wipe based on what is stored on the device as corporate and what is personal data. Most people dislike the idea of a forced wipe of personal data, such as music and photos, given that the device is theirs and not the organisations.
Anti-malware and hacking safeguards are important as well. For Android devices especially, there is a serious potential problem with malware. The Google Play Store contains a plethora of applications that are minimally vetted before being allowed to be sold or given away through this channel, so the possibility of malware containing backdoors and Trojans is potentially high. Not all of this malware is intended for the device itself, of course. Much of it is intended simply to be spread to the enterprise - making the Android device a sort of 'Typhoid Mary' (the first person in the United States identified as an asymptomatic carrier of the disease).
Access controls are also important since if the device is in use by an unauthorised person, it would be a bad thing for that individual - with embedded credentials - to be able to access the enterprise with an automated login. Along with this is access to the data on the device itself. Today, open source forensic tools are available that can extract data from many types of popular mobile devices. That means that even if a thief cannot gain access to the device, there is a possibility that access to the data may be gained forensically. Encrypting the data on the device is important to protect against this unauthorised bypass of access controls.
All of this goes together to make a world-class mobile device security solution. So, when one is looking at this type of tool, what should be required? While features may seem to be the hot button, before one starts thinking about functionality, ask what the environment looks like. In simple terms, what types of devices are you willing to support? Apple iOS is an obvious choice but Androids are gaining market share rapidly and BlackBerry is also growing in strength. There are also a few dark horses, such as Kindle and Nook. One probably won't want to support everything, but implementations should support the leaders.
All products in this group test
SC Webcasts UK
Information Security Manager
Infosec People - Hammersmith, West London
Senior Network Security Engineer, London, £68-85k + package
Infosec People - England, London
Information Security Risk Manager, £45-55k + bens
Infosec People - West Midlands, England, Coventry
SOC Analyst, Aldershot, £55-63k + benefits
Infosec People - England, Aldershot, Hampshire
Security Architect, Cardiff - to £70k Basic
Infosec People - Cardiff, Wales
Sign up to our newsletters
SC Magazine UK Articles
- Gooligan ad fraud malware infects 1.3M Android users, installs over 2M unwanted apps
- Met Police grab suspect with phone unlocked to get hold of data
- Cyber-security must reflect risk not just regulation
- Data centres are on the move - where will they end up?
- The information security implications of M&A deals
- SC Awards Europe 2016 winners announcements!
- ISIS radicalises 'lone wolves' through strong social media presence
- Updated: How will Brexit affect the cyber-security industry in UK and Europe?
- 9.2 million medical records for sale on darkweb
- Microsoft Office 365 hit with massive Cerber ransomware attack, report
- Is BYOD your company's norm? Beware the ghosts of data past this Christmas
- Over 400,000 phishing sites have been detected each month in 2016
- TalkTalk customers urged to get routers swapped over hacker fears
- Report: Mirai 'is just the tip of the iceberg'
- Avalanche takedown involved searches in 40 countries