Computerworld - The analysts have a term for it: BYOD, or "bring your own device." IT managers have their own term for it: Trouble.
Once, mobile devices were exclusively issued -- and managed -- by a company's IT department. With the broadening of the mobile device market -- and with stylish, powerful smartphones and tablets becoming commodity products -- can you blame anyone for wanting to use theirs for work?
The whole question of how to secure those devices in the first place is a spur for both innovation and controversy. The good news: The most recent wave of mobile devices for the consumer reveals that device makers are conscious of this issue, and turning more attention towards adding enterprise security features. The bad news: There are still plenty of devices in circulation without such security.
The problems of device security
The most common problem with consumer-grade devices in the enterprise is how to secure sensitive data. In fact, the process is a crapshoot.
Leslie Fiering, a research vice president at Gartner covering mobile computing, says, "In the past, the user would be provisioned a device by the enterprise, and you could assume there was endpoint security. But now we can no longer make assumptions about the user's device."
In her opinion, the enterprise needs to do two things to achieve proper device security. The first is to perform network access control "that not only checks the user's credentials, but also interrogates the devices, 'Are you a trusted device?'"
When people bring their own phones and tablets, she explains, "you can no longer assume such security resides there."
That leads into Fiering's second point: Figure out what devices are privileged to have offline access to data. "Since user data cannot comingle with enterprise data, we start to think in terms of containers that are leakproof, that separate the user data from the enterprise data." An unprivileged device can be shunted to a different network segment or allowed to read data only as a browser, with no persistent local storage.
Devices that work as both personal-use and corporate-use devices also become test cases for privacy issues. Frank Sickinger, vice president of business sales for T-Mobile, sums it up this way: "Whether you are looking at BYOD from the perspective of the enterprise or from the device manufacturer, one of the primary challenges is addressing and balancing security of corporate information and privacy of the employee."
Many paths to security
The ways that device makers and third-party mobile device management (MDM) software vendors have approached the implementation of enterprise security on phones and tablets are as diverse as the devices themselves. It's a reflection of both the complexity of the problem and the various clever ways it's being solved.
The first approach is the "container," or "sandbox," approach. In this model, "nothing can get in or out without express permission from the group policy [governing the device]," says Fiering. This covers every kind of input and output: "If you want to hook up a projector to show your PowerPoint slides, there has to be express permission to show video out." A common provider of such solutions is Good Technology, whose technology can be used either by developers to create new secure apps, or in partnership with device makers to provide different kinds of baked-in security.
"Sandboxing on mobile devices is kind of ugly," says Fiering -- meaning it can be jarring for the user who suddenly needs permission to work with her own device -- "but it works well enough to get the job done, and over time as we get more competition [between types of app sandboxing] we'll see that area improve."
Another approach is to turn the whole device into a sandbox via virtualization -- using virtual-machine technology to compartmentalize the device into personal and work "facets." Each facet runs in its own virtual machine on a hypervisor (also called a virtual machine manager); neither facet can exchange information with the other. This makes policing a personal device less problematic: The work facet can be managed (or erased) independently from the personal facet.
Earlier this year, LG introduced its LG Revolution handset that uses VMware Horizon Mobile software to run as both a work and personal-use device in this way. An Israeli company, Cellrox, uses a modified Android kernel to accomplish the same thing by using Android itself as the hypervisor.
Powerful as this approach is, it's still limited. Because of its hardware requirements, it works well only on the most recent generation of mobile devices.
"There haven't been mass rollouts of that technology yet -- it's very new, it hasn't been broadly available," says Stacy K. Crook, senior research analyst, mobile enterprise at IDC. She also questions whether the user experience on such a device will be satisfactory, given the need to flip back and forth between facets.
And there's another problem. "It's only available for Android devices right now," Crook says, "and from an IT perspective: Do I want to have a different solution on my Android devices than on my other devices?"
A third approach, according to Crook, is "app-wrapping." "This is applying a policy to specific applications," she explains, "but you're not sticking them in a sandbox. Instead, you have the ability on the server side to put policies around apps that govern how it can interact with other applications. This allows you to revoke access to that app on demand, or declare that a given app cannot interact with other apps, or can only interact with a given app." The exact approach varies depending on the vendor, she says.
You are previewing premium content. 
Free Insider Guide
