 |
|
| Mobile Computing Tips: |
|
|
|
MOBILE SECURITY
Mobile devices: Business or personal property?
Craig Mathias
03.14.2007
Rating: --- (out of 5)
|
Last month, I discussed the management of mobile devices from the perspective of nuts and bolts, via a list of the key elements that need to go into a mobile device management strategy. It's pretty clear that there are a good number of operational concerns when it comes to mobile computing, but a combination of appropriate policies and nuts-and-bolts tools and techniques can certainly get the basic management job done. There is, however, another issue that I think almost every enterprise will eventually have to come to grips with, and that is how to deal with the fact that, in the majority of cases, a mobile device used for business is the personal property of the user and is not owned by the enterprise. Sure, laptops are still provided by the company in almost every situation, but the opposite is usually true of cell phones, PDAs and smartphones. And as these are on their way to replacing the PC, at least in some applications and venues (and, I believe, many more over time), it's not too early to consider how a mobile device management strategy will need to evolve to meet this reality.
Think about it: Corporate data -- from company phone directories to confidential memos -- is floating around on devices outside the control of network and IT operations and management. Many of these devices are used for remote access to the corporate network. How many of these devices are lost, stolen and otherwise misplaced every year? Millions, in fact. How many of these lack even basic password or PIN-code protection? Almost all of them. And how many fall into the hands of individuals who might cause harm to a given enterprise as a result of possessing the contents of these devices? This is truly scary, and no one knows.
In fact, if just one handset with valuable information or unsecured access to the enterprise network winds up in the hands of a professional information thief, the consequences could be dire. This has led me to the conclusion that any device capable of storing, accessing or manipulating enterprise information, especially information governed by the firm's security policy, must be managed by the enterprise. This is really no different from the management strategies put in place on mobile computers. But there is that one little detail again – most of these devices belong to the end user, not the enterprise. The enterprise thus does not have the right, let alone the ability, to do such management.
Nonetheless, there are a few actions the company can take to move down the road to a solution. The first, as I've previously noted, is to have acceptable-use and security policies that cover all mobile devices. Every mobile user needs to understand that protecting valuable enterprise data is essential to the success of the firm. Should you require passwords or pin codes to access mobile devices? Absolutely. You should also explore liability issues with your legal team and have contingency plans in the event that a mobile device is compromised. You may want to keep to a minimum the set of handsets approved to hold corporate data, in anticipation of eventually providing management for these devices.
But the ultimate solution needs to be ownership of the handset by the firm. And I think that is going to become very common as companies begin to replace desktop phones with dual-mode converged handsets. So, rather than the company paying for your phone, you might wind up reimbursing them for personal use of the device. Or we might, as I have theorized, have "virtual" cell phones, handsets that actually have two distinct personalities built in – one for you and one for the company. You'd obtain and pay for your own calling plan on the personal side, and the company could manage anything on the enterprise side. Lose your phone? The company data on it gets zapped, and your personal information – well, that's your problem. But we might even see the rise of outsourced management companies that, for a small fee, will secure both personalities according to specific rules for each. So, though mobile device management has its complexities today, I think we're going to see good solutions in the not-too-distant future.
About the author: Craig Mathias is a principal with Farpoint Group, an advisory firm based in Ashland, Mass., specializing in wireless networking and mobile computing. The firm works with manufacturers, enterprises, carriers, government, and the financial community on all aspects of wireless and mobile. He can be reached at craig@farpointgroup.com.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchMobileComputing.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
|
|
|
| TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of . |
|
| | |
All Rights Reserved, , TechTarget |
|
|
|
|
|
