Strategies for securing the enterprise in a BYOD world – guest blog by Chris Swan

With so many execs with tablet devices on their Christmas list this year, CTOs will be under increased pressure in the New Year to formulate a strategy that allows employees to use their new toys at work.

In this post, Chris Swan explains the different approaches for companies as they embrace enterprise mobility and balance the groundswell behind bring-your-own-device (BYOD) with company security. This piece follows up on a presentation by Swan at Making it Mobile last month. Until recently Swan was the CTO for client experience at Swiss banking giant UBS, prior to that he was CTO for security. He is currently looking for new opportunities. This post is also available on Swan’s personal blog.

I’ve spent a good part of the last year working on mobile strategy, so I get asked a lot about Bring Your Own Device (BYOD)^[1]. This post encapsulates my responses.

It’s not about cost (of the device)

Last week, a friend sent me a link to this article 2013 Prediction: BYOD on the Decline?. My reply was this:

News at 11, an unheard of research firm gets some press for taking a contrarian position. They ruined it for themselves by trying to align BYO with cost savings. Same schoolboy error as cloud pundits who think that trend is about cost savings.

Cloud isn’t about cost. It’s about agility.

BYOD also isn’t about cost. It’s about giving people what they want (which approximately equals agility).

In fact, cloud and BYOD are just two different aspects of a more general trend: the commoditization of IT; cloud deals with the data center aspects, and BYOD with the end user devices that connect to services in the data center^[2].

The enterprise is no longer in the driving seat

When I was growing up, the military had the best computers, which is a big part of why I joined the Navy. Computers got cheaper, and became an essential tool for business. For a time the enterprise had the best computers, which is why I left the Navy and found work fixing enterprise IT problems. Now consumers have the best computers in their pockets – so it’s time for another career change.

There are a number of companies out there trying to sell their device/platform based on it’s ‘enterprise security’ features. This is a route to market isn’t working – just take a look at the sales of the RIM Playbook – because the Enterprise doesn’t choose devices any more.

• Consumers choose devices
• Employees take their consumer devices to work
• Devices that come to work need applications to make them more useful

Even when the Enterprise is buying devices – where the trade-off between liability and control is worth it – they usually buy the same devices that employees would choose for themselves.

MAM is where the action is, MDM is a niche

For a consumer device to be useful in a work setting it needs access to corporate data, and in most cases there is a need/desire to place controls around how that corporate data is used. There are essentially two approaches to doing this:

1. Mobile application management (MAM) – where corporate data is secured in the context of a single application or a group of connected applications (that may share policy, authentication tokens and key management). With this approach the corporate data (and apps that manage it) can live alongside personal apps and data.
2. Mobile device management (MDM) – where corporate data is secured by taking control (via some policy) over the entire device. This is how enterprises have been dealing with end-user environments for a long time, but that was usually a corporate-owned device (where this approach may still be appropriate) rather than BYO. Most users are bringing their own device to work to escape from the clutches of enterprise IT (and what the lawyers make them do), so MDM is a bad bargain for the employee. It’s also a minefield for the enterprise – what happens if employee data (e.g. precious photos) are wiped off a device? Could personal data (maybe something as simple as a list of apps installed) be accessed by company admins and used inappropriately?

There is a 3rd way called virtual-machine-based segregation, but that approach is mostly limited to Android devices at the moment, and anything that ignores the iOS elephant in the room isn’t inclusive (and thus can’t be that strategic).

MAM isn’t without its issues, as it is essentially a castle in the air – an island of trust in a sea of untrustworthiness. This will eventually be sorted out by hardware trust anchors; but for the time being there must be some reliance on ecosystem purity (i.e. the ability of device/OS vendors such as Apple to control the spread of malware) and detection of tampering (i.e. jailbreaking) with device integrity.^[3]
• See the slide on user profiles, below, for more information.