Smarter security for smartphones

Mobile phones are emotive devices. They have your kids as the wallpaper, texts saying who loves you and both your work and personal lives in one.

Even if it’s a company device there is an emotional bond between the user and the device that is unlike any other. Very few people feel precious about their laptop. Mobile phones are also a status symbol, male jewellery.

It’s why an 80kg sales manager decides that his 100g phone is “too heavy”. Staff want to choose their own device. Often to the extent of buying it.

This makes managing their pocket computer a challenge for IT departments. While you can, usually, dictate that your workplace is a Windows environment it’s much harder to do the same with the raging religious wars of BlackBerry, iPhone, Symbian and Windows 7.

Just as you get some exec wanting a Mac as their laptop and upsetting your plans for VPNs, managed builds and security, on the basis that they paid for it, so you must support it, you’ll get the same with handsets.

As the vagaries of phone fashion change you can soon be running to keep still. If you are spread between Europe and the US you are likely to have users who want Nokia and Palm devices because that’s what they’ve always used.

The biggest problem is security.

Inside the building, outside the firewall

One threat that is rarely worried about with mobile phones is the hole they provide to carefully built firewall policies. While you may have crafted a security policy which prevents users from getting to sites and exporting data over the corporate network there is nothing to stop them from sitting at their desk, disconnected from your network, with a tethered phone, using webmail to send whatever they like to whoever they like.

You have a device which contains confidential information, is highly portable and often in the position where it might get left in a taxi. Worse it has VPN access to a network you’ve worked hard to keep secure, and runs through networks where you have no control over the security.