One Acronym to Rule Them All…

It seems that maybe MDM (Mobile Device Management) isn’t the most effective solution to an issue as broad and undefined as BYOD (Bring Your Own Device), although it certainly is a simpler one. At a recent CISO panel, Andrew Yeomans, a board member of the Jericho Forum and regular attendee of the RANT event for end user security professionals, was amongst other senior figures in the industry calling for a more effective and rounded solution.

Since the iPhone and G1 came along and convinced us all that PDA owners were on to something after all, the issue of secure mobility has arisen beyond the need to encrypt laptops and USB sticks. This has troubled CISOs and Information Security Managers who are reluctant to tell their CEO “no”; after all information security is positioning itself as an enablement function now. So how do you tackle the problem of making a consumer device, with little inherent security, sufficiently resilient to hold sensitive or regulated corporate data?

It seems at one point about 12-18 months ago, MDM was a possible solution, now it is often heralded as the only solution. So what’s the problem, other than licence fees from some vendors can reach towards £100 per device, and that’s without support or server costs… there is of course the additional strain on already understaffed security departments as well.

So why might MDM be the great info sec white elephant of 2012/13? The main difficulty all security controls encounter is user resistance, if something isn’t intuitive or streamlined it will often be circumnavigated. MDM may sound like a good blanket solution but it is addressing Bring Your Own Device, and therefore it’s presence on a personal smartphone or tablet is incredibly intrusive. It is harkening back to the darkest days of Draconian approaches to information security and risk management. To do the job properly MDM needs to lock down the full device and in doing so impacts user experience.

MDM is one solution to fit them all. Fine your product covers iOS, but is it compatible with the iPod Touch/Nano and the latest iPad Mini too? Yes you do Android, but does that cover Froyo, Gingerbread, ICS and Jelly Bean? And what about every manufacturer’s Android OS overlay, will it work on employees’ HTC, Sony Ericsson, Samsung, Motorola, LG, Huawei, ZTE, Acer, Asus, Dell and Panasonic handsets? Then there’s the Nexus and Kindle ranges. Fragmentation is a huge problem not only for compatibility but also from a functionality and support perspective. And what about reporting, how do you manage so many disparate devices, and where do you begin with e-Discovery?

Other acronyms don’t necessarily fair any better. MIM (Mobile Information Management) is also troublesome from a security and monitoring perspective; and MAM (Mobile Application Management) is again difficult for the user to adjust to, there’s a sacrifice of native apps and there’s a whole new aesthetic and ecosystem to acclimatise to. The idea of MAM through SDKs and API wrappers, features recently announced by both AirWatch and Webroot, will likely materialise to be the most effective solution in the long-term.

As it stands, for many MDM is too obtrusive a solution for personal devices and much better suited to locking down corporate mobility assets. We’re on the right path, but there’s a lot of work to be done in balancing security, impact, and usability. Come to think of it then, BYOD is just like most other security concerns CISOs have encountered over the last decade.