McAfee at Mobile Computing Summit – “But I Love My iPad” & Balancing Privacy & Governance

Last week, the first annual Mobile Computing Summit was held in Burlingame, CA. The event was put on to emphasize the effective use and management of mobile devices ranging from smartphones and tablets to laptops and beyond, and highlight the security issues surrounding their use. McAfee VP of Mobility, David Goldschlag, and I were privileged with the opportunity to weigh in on the issue of security in the mobile space.

During “People Can Do More With Tablets,” I shared the stage with Jamie Perlman, (Senior Director, Business Development at Box.net), Tom Nawara (VP, Digital Strategy and Design and Acquity Group) and Chandika Bhandari (VP, Mobile Solutions at Survey Analytics).

According to Perlman, it is estimated that there will be a 5000% increase in enterprise tablet sales in 2011, with enterprises expected to buy 1.1 million this year. Nawara discussed how T-Commerce (tablet commerce) is revolutionizing the retail game, with Forrester estimating 195 million tablets in the market by 2015. Bhandari supplied even more surprising statistics, noting that in June of this year, time on mobile apps actually surpassed time spent on browsers. All of these statistics relate back to a recent study done across McAfee’s customer base, which revealed that the average person owns 4 mobile devices for both business and personal use.

As the consumerization of IT becomes a growing reality, securing these devices becomes an even greater imperative. With IPV6, the number of attack sources is going to rise from about 4.5 billion to around 340 undecillion, or 340 with 36 zeros. That will make even the flood of attacks seen by today’s largest botnets seem like a mere trickle. Remember when wireless access points were a new thing? It’s the same situation with mobile devices – people just want it, and they are going to get, like it or not. As such, there is a need to address adoption now and leveraging a framework that will support strong security controls without butchering the user experience that mobile devices provide. Bottom line – security is a priority for these devices, saying “no” won’t scale, and a framework that addresses traditional IT endpoints, network, and data, must now include mobile for any security strategy to be effective.

IT security can address the consumerization of IT by following a few simple steps:

1. Segmenting network access upon connection
2. Segmenting network access based on identity and role
3. Checking antivirus and OS patch level prior to access to network
4. Performing a full system interrogation in order to enforce compliance prior to access

McAfee EMM supports the whole lifecycle of mobile devices. The lifecycle starts with self-service provisioning – a one-time process that bootstraps a device that can already connect to the internet but is not known to the enterprise network, into a secured and managed endpoint of the enterprise network. As part of the provisioning process, EMM generates a unique client SSL certificate for the device, which strongly authenticates the device for email access, and also names the device so EMM can determine whether a device is compliant. A provisioned and authenticated device can then be managed through “Policy Management,” while “Compliance” rejects devices that try to bypass provisioning. With ePO integration, which makes mobile devices part of the security infrastructure, enterprises can then bring mobile devices under management with the rest of the managed endpoints.

During his keynote, “The Core Issue: Balancing Privacy & Governance,” David Goldschlag further elaborated on the consumerization of IT and the IT governance of mobile devices – including those personally owned by employees – and how enterprises should balance security policy among conflicting goals and needs. According to David, consumerization and mobility bring risk and complexity and thus, well-communicated policy is necessary. What’s needed is layered security for mobile devices and apps, clear policy and nuanced touch.

David explored the two schools of thought in the enterprise when it comes to BYOD (Bringing Your Own Device):

1. The enterprise has less responsibility for personal devices, so BYOD is better from a governance perspective
2. The enterprise has less authority over personal devices, so enterprise should prefer corporate owned devices, a strong agreement, with a liberal use policy.

 
After weighing the pros and cons of various solutions, David noted that technology is only part of the solution, as not every company, employee or situation is the same. IT must govern enterprise data with respect to employee privacy.

As the consumerization of IT expands across enterprises, we at McAfee hope to continue providing enterprises with mobile security solutions to meet their various goals and demands.

Be sure to follow the @McAfeeBusiness handle for future updates about McAfee mobile security.

Tags: consumerization of IT, device, enterprise, laptops, Mobile, mobile device, smartphones, tablets