BYOD Will Always Be Trade-Off Between Convenience And Security, Says Context

PRESS RELEASE

11 October 2013: Research by independent security consultancy Context Information Security has revealed limitations in current Mobile Device Management (MDM) solutions for Bring Your Own Device (BYOD) implementations. The report published today also concludes that BYOD will always be a trade-off between convenience and security as devices can only be locked down so much before users chose not to opt-in to the scheme.

Context researchers looked at three leading MDM solutions, Airwatch, Blackberry Universal Device Service and Good for Enterprise, when used with Android and iOS mobile devices. While they were all found to provide good levels of BYOD security, like all MDMs they are limited in what they can achieve by the underlying operating systems.

For example, MDM solutions in a BYOD environment cannot prevent unknown malicious applications from recording sound via the phone's microphone or tracking user location using the built in GPS. And while Jailbreak/Root detection is implemented by all the MDM solutions reviewed, they work in very much the same way as antivirus, only detecting known Jailbreak/Root methods and applications, which are often trivial to bypass by technical users or malicious hackers. Implementation weaknesses of MDM solutions may also inadvertently leak sensitive information and users can compromise security by downloading apps and disregarding operating system permissions requested by the applications.

"There is no realistic way to guarantee the security of a workable BYOD environment, but organisations can take significant steps towards mitigation of security risks if they combine technical security controls with clearly defined acceptable use policies," said Alex Chapman, Senior Consultant at Context. "To fully lock down these devices, a combination of fully restrictive MDM policies and network controls such as corporate firewalls and web proxies need to be implemented and enforced. But MDM solutions can only lock down mobile devices to the extent that underlying operating systems will permit and BYOD implementations can only lock down devices to a level that users are willing to accept."

The Context White Paper, available to download at www.contextis.co.uk/research/white-papers details the assessment of the three MDMs investigated and summarised below:

Airwatch

The Airwatch MDM solution provides access to corporate email via Exchange Active Sync and corporate documents, and MDM management via a dedicated MDM server within an organisation.

Pros: Provides advanced security settings on Android devices which support manufacturer extended APIs along with MDM management features over and above the built-in operating system features

Cons: No dedicated corporate email application on iOS devices; separate document viewer, email client and MDM applications; and relies heavily on external applications for viewing documents which can lead to data leakage

A number of encryption implementation and data leakage weaknesses were identified by Context during the review of the Airwatch MDM solution, which have been reported to Airwatch for remediation.

Blackberry Universal Device Service

The Blackberry Universal Device Service (UDS) solution provides MDM management and data access via dedicated Blackberry servers within an organisation. Blackberry UDS can extend existing Blackberry Enterprise Service infrastructure in order to manage Android and iOS devices.

Pros: Integrates into existing Blackberry Enterprise Service infrastructure and provides good authentication settings for enterprise data

Cons: Provides only basic MDM management features available in the operating systems built-in to the devices

Good for Enterprise

Good For Enterprise provides enterprise data and email access via a Good Network Operations Centre (NOC), which communicates with a dedicated Good server within an organisation. All MDM devices communicate with the Good NOC which relays data between a managed mobile device and the organisation.

Pros: Dedicated email and document viewer for office and PDF files and good authentication settings for enterprise data

Cons: All traffic must traverse a Good NOC, which could expose enterprise data to regulatory requirements of the country of residence of the NOC

The Airwatch and Good for Enterprise solutions were chosen based on Magic Quadrant market data available from Gartner, while the Blackberry solution was assessed because of the large number of organisations with a current Blackberry environment being repurposed for mobile device management.

"BYOD implementations carry an inherent risk and while fully restrictive security policies are possible to configure with corporately owned and maintained devices, ultimately these restrictions are unrealistic in a BYOD environment," said Context's Alex Chapman. "A successful BYOD implementation requires a fine balance of usability and security to ensure an appropriate level of user buy-in. Insecure settings, device use and software update frequency can all affect the security of the device and in turn, corporate data in a BYOD environment."

About Context

Context was launched in 1998 and has a client base that includes some of the world's most high profile blue chip companies, alongside government organisations. An exceptional level of technical expertise underpins all Context services, while a detailed and comprehensive approach helps clients to attain a deeper understanding of security vulnerabilities, threats or incidents. The company's strong track record is based above all, on the technical skills, professionalism, independence and integrity of its consultants.

Many of the world's most successful organisations turn to Context for technical assurance, incident response and investigation services. Context is also at the forefront of research and development in security technology. As well as publishing white papers and blogs addressing current and emerging security threats and trends, Context consultants are frequently invited to present at open and closed industry events around the world. Context delivers a comprehensive portfolio of advanced technical services and with offices in the UK, Germany and Australia, is ideally placed to work with clients worldwide.