Mobile Security: The Most Important Sale You’ll Make

Everyone’s going mobile and your customer can’t afford a breach. That’s why we would pose that this is the most significant sale a partner will make; your role as a “trusted adviser” is on the line.

That’s why we’ve put together this one-stop gallery that highlights the various customer mobile environments, breaks down the minimum requirements for a successful security solution, and tackles some of the important add-ons for vertical industries with strict compliance needs.

**Source material by Michael Cobb**

Follow executive editor Craig Galbraith on Twitter.

Mobile security is much different from traditional desktop security. Desktops are in a fixed location and don’t involve multiple operating systems and versions like mobile does. IT has an easier time with control.

In the mobile world, fragmentation – think multiple operating systems on dozens of different devices made by many manufacturers – makes security a challenge.

Some businesses provide employees with company-owned devices. That way, they can give workers some flexibility while keeping control of which devices they use and keeping security consistent across the board.

But some employees won’t be comfortable with that, feeling that their company could infringe on their privacy.

Other businesses have have turned to bring-your-own device policies, which make life much more convenient for employees. Of course, it can create headaches for administrators when those workers wind up going around IT and putting company information in personal clouds and other places where it doesn’t belong.

Thus, the biggest mobile-security issue is probably data leakage. Once data is saved on a device, employees can potentially forward it in an email, save it to external storage or paste it into other apps.

Fortunately, security vendors are getting a better understanding of mobile threats, so they’re coming out with new features. For example, remote-wipe functionality appeared in response to devices being lost or stolen.

Mobile-device management (MDM) tools are common. The latest incorporate what are known as “secure containers” or “dual personas” that divide an employee’s smartphone into two: one part for personal use and the other for corporate.

This is good for security and better than an employee having to carry two separate phones, but not that much better. A worker might get annoyed having to switch back and forth, dealing with one set of apps for their personal use and another set of unfamiliar apps for work. That’s where mobile application management comes in.

Mobile application management (MAM) lets IT control the apps rather than the entire device.

Data going to and from the phone or tablet can be monitored. That keeps employees from downloading and using apps not secured by the company. MAM offers more granular control, while MDM basically is limited to the security capabilities of a device’s operating system.

The latest mobile-security platforms focus on data encapsulation and application-level controls that protect data from being used improperly and while in transit, in use and at rest.

The cloud will be the best option for companies without resources (IT staff and hardware) to dedicate to mobile security. It’ll be faster to set up and offer a predictable, monthly fee.

In most cases, a business can choose the controls they need based on their environment and their user base. A channel partner should make sure the solution is scalable and the licensing agreement is appropriate for the company’s future plans.

When recommending a mobile security solution to a customer, a partner should make sure that it can provide protection for every device allowed on the company’s network. So, at the least, it should support Apple’s iOS and Google’s Android.

The devices must also be deployed and managed from a single console that gives IT visibility into the status of user and device security. Furthermore, the solution should integrate with other back-office technologies.

To provide a minimally acceptable level of mobile security, a solution should include device configuration, anti-malware, anti-theft (locate, lock, or erase data remotely), encryption, secure connectivity, application whitelisting and data loss prevention (DLP).

Some verticals will need more more security due to compliance requirements. Think health care, the financial industry and others.

They’ll probably need tools that provide more robust data access and control. Two-factor and one-time password authentication are examples. Access might be limited to authorized users only. And reporting features will be more comprehensive; a customer might need a solution that meets certification requirements specific to its industry.

Log analysis is a key element in compliance standards, and is often overlooked in mobile security. Usage stats, malware logs, quarantines and firewall event monitoring can offer insights into the overall security of a network and its users.

Knowledge of policies is critical, no matter the type of mobile security that is adopted. A partner should work with the client to ensure that employees and contractors are fully aware of what they should and should not do with their devices, apps and data.

The researchers at Gartner put together a useful “Managed Diversity Model” aimed at protecting businesses, IT and users.

There’s no stopping the mobility train, so mobile security will be the cornerstone of mobility going forward.

A partner’s goal should be to work with a customer to provide it peace of mind without compromising the user experience.

It’ll be key to continue to monitor solutions, re-evaluate them and improve them as threats continue to evolve.