iPhones in enterprise: how scared should you be of your own employees?

Security scares surrounding iPhones and other smartphones roll around fairly regularly. This one has come from a company called DeviceLock that specialises in “endpoint security” – which is a nice way of saying that it offers internal security to stop a business’s own employees from doing anything they’re not meant to.

“Endpoint”?

Every heard of the acronym PLBKAC? It’s used by IT and admins, and means Problem Lies Between Keyboard And Chair – it’s just a polite way of saying that the computer is working fine, but the user is screwing up. This is roughly the same as “endpoint” security. The endpoint is the actual user of the device. DeviceLock treads a fine line between actual security and paranoia, by offering “endpoint data leak prevention”. So if you think you’re employees are hooking digital cameras, MP3 players or USB keys to their work computers and stealing sensitive software untraceably, then DeviceLock can help you. It simply offers admins a way to lock users out from using connectable devices. And it blocks a lot of connectable devices including (but not limited to) USB,  FireWire, WiFi,  Bluetooth, CDs,  floppy disks, serial and parallel ports, PDAs, smartphones and even your local and network printers.

So what’s the story?

Up in the top left corner of the DeviceLock website, it has had a poll posted for seven months. It simply asked the question “have you taken any steps to secure your business against the security threat posed by iPhones?” Over 1000 responses have been collected, and it found that less than 25% of respondents in Europe and America answered “yes”.

What kind of security threats?

Ok, so this is the big question. What should businesses be so scared of when it comes to iPhones? DeviceLock CTO and Founder Ashot Oganesyan claims that a mass entry of iPhones into the workplace is inevitable. He says that many businesses will being to realise that their employees can perform all of their work-essential functions on the iPhone – meaning that they don’t have to invest in laptops anymore. Ashot says “the results do suggest that the iPhone threat to data security is being generally underestimated. Given the iPhone platform’s consumer popularity and robust development community, its launch into the workplace is inevitable”.

The problem, DeviceLock suggests, is one of timing. If an enterprise wants to kit itself out with laptops, it can go to a trusted vendor and buy highly-secure units. The laptops or desktops it buys can be set up to have “endpoint” security taken care of from the start. DeviceLock is worried that because the development community for iPhone is so strong and so fast moving, that enterprise-ready iPhones could start making their way into businesses en masse before they are properly secured against “data theft and corruption from within your organization at local endpoints”.

Does DeviceLock suggest a solution to this problem?

Of course it does! It has a security option prepped and ready to roll – no good scaremongering tactic is complete without a solution up your sleeve! DeviceLock says it can enable a “least privilege” mobile device policy for employees, which will mean that an employee can set exactly what kind of data that iPhone can exchange, and what other devices it can exchange it to. In effect, it means the work iPhones can be limited to only exchanging information of any sort with the central server of the company, and other iPhones that are connected to that server. This is just a data thing -  files, emails and any other sort of data are controlled. SMS and voice remain untouched.

What we think?

I always tend to treat these kinds of stories with skepticism. I dislike scaremongering, and certain “security scares” last year were pretty lame. But the precautions being suggested by DeviceLock aren’t entirely unnecessary. One of my previous employees (who I won’t mention by name) had all of the USB connections to our work computers physically disabled, and took out the CD drives. This was to prevent us taking or bringing any files we shouldn’t. And I regarded that as being quite fair, to be honest. I never encountered needed to transfer anything that was too big to be emailed to my work account, and that left a record with my employee. So it prevented me from even being tempted to get up to anything. And if you’re company has just given you a free iPhone, you shouldn’t be surprised if they’ve also taken steps to prevent you from misusing. Get your own damn smartphone if you want to use a load of non-work applications and files.