Mobile device management

Ruslan Rakhmetov, Security Vision

Smartphone has become a trusted companion for more than 2/3 of the population of our planet: according to the UN report, 93% of Europeans own a smartphone, in Africa 61% of people over 10 years old have a mobile phone. Along with mobile devices, different ways of communication, the ability to perform tasks collaboratively and without being tied to the home are growing. Related technologies have also been introduced into business - employees of various companies use mobile devices not only for personal purposes, but also for work duties, which means that approaches to corporate management of such wearable gadgets have also emerged. In this article we will tell you about mobile device management options, their prerequisites and the opportunities that MDM (Mobile Device Management) technology opens up now.

By mobile devices we will understand not only smartphones, but also tablets, laptops, virtual reality glasses, PDAs and other devices that can be carried with you. On them, using the inbuilt operating system, you can manage applications, edit documents, communicate with colleagues and perform other tasks. MDM is a set of programs for administrators designed for centralised management of such devices in the corporate environment, which allows to:

- protect corporate data stored on mobile devices from leaks and unauthorised access by third parties;

- Install, update and uninstall applications on employee devices, providing a unified software landscape;

- Customise devices in accordance with company security policies (e.g., block certain features or set passwords);

- track the location of devices in case of loss or theft, and remotely lock or wipe data;

- update the OS and applications automatically to keep devices up-to-date and stable.

Since the early 2000s, due to special security requirements, politicians from different countries once used secure BlackBerry smartphones, then Windows handheld personal computers were widely used, and the management of corporate devices focused on data protection and encryption.

After a few years of using new gadgets in businesses around the world, MDM solutions have gained functionality for remote management and application security, and by the early 2010s, after the introduction of Apple ‘s iPhone and the development of Google’s Android mobile operating system, the technology was even more advanced.

As a result, different approaches to the use of gadgets in business have emerged:

- Choose Your Own Device (CYOD) is a practice where companies provide a list of approved devices from which employees can choose the most appropriate one for themselves and use them for personal and work purposes;

- Bring Your Own Device (BYOD) is an approach where employees use their personal mobile devices for work tasks and are not restricted in their choice of device, i.e. they can start working immediately on their existing equipment;

- Corporate Owned, Personally Enabled (COPE) - where devices for employees with corporate restrictions and the ability to access corporate resources are purchased by the employer;

- Corporate Owned, Personally Owned (COBO) is a hybrid model that combines elements of COPE and BYOD. The company provides the primary device, and the employee can use their personal device for specific tasks.

These approaches are applied depending on the specifics of the business and the work of HR, for example, for maximum protection and standardisation of devices the COPE model can be applied, for increasing employee satisfaction - CYOD, and for maximum speed of adaptation and user convenience - BYOD.

The use of a single management system depends on the specifics of the company, for example, closed enterprises are likely to simply ban any devices, and different approaches and within the same company at different sites. For example, special devices for warehouse management should work throughout the day, and to organise audience access to concerts - it is possible to allow organisers to use personal devices with a ticket scanning application installed for several hours.

Nowadays, MDM integration with other IS and IT systems allows for more efficient data security and separation of personal and work spaces for users, and cloud-based MDM services have emerged, but these statistics are not quite fair for Russia: domestic businesses require more stability and often abandon clouds in favour of on-premise solutions. Cloud solutions are suitable for small companies, and for large companies - more flexible and scalable on-premise solutions.

It's important to note that MDM is not the most common name for this class of systems, so before we conclude this article we'll talk about similar solutions and the differences between them.

Containerisation is used not only for secure application development, but also for mobile security, for example, a separate container with access to mail, file balloon and company directories, the data inside of which is securely separated from the personal data on the device.

There are also mobile application management systems, or Mobile Application Management (MAM). These solutions focus specifically on installing, updating and managing applications on smartphones and tablets, as well as managing access to data through them. Mobile Content Management (MCM) and Mobile Security Management (MSM ) solutions, respectively, will provide separate data protection.

As all these classes of solutions are related to mobile devices, a common class for business tasks was born - Enterprise Mobility Management (EMM), which includes all of the above and is suitable for large organisations with a variety of mobile devices and complex security requirements.

When expanding the list of managed device types (e.g., adding various smart IoT devices to mobile gadgets), a universal tool - Unified Endpoint Management (UEM)- is used.

Choosing the best approach depends on the specific needs of the organisation and should be done taking into account all factors, from budgets and company size (EMM and UEM are more suitable for large companies, MDM or manual management for smaller ones) to specific security requirements (MDM, EMM or containerisation).

If in addition to classic gadgets you plan to manage the Internet of Things, it is better to choose UEM (and if the company uses only mobile devices, MDM is enough).

Mobility of employees, the possibility of stable work during business trips, connection of remote employees to the business - all this is associated with risks that can be reduced by applying information security technologies. MDM and similar solutions will allow you to:

- generate a list of devices and manage inventory from a single window;

- Manage operating system updates and security profile configuration;

- Allow or deny installation of certain applications and configure access to them under certain conditions (VPN, antivirus, etc.);

- protect sensitive information on the device with containerisation, encryption and access control;

- fix the location of the device in case of loss or theft and to optimise logistics;

- lock lost devices to protect against unauthorised access, or even completely erase information on them if they are stolen;

- customise password complexity, limit the number of login attempts and additional methods of identity verification (two-factor authentication via third-party services, fingerprint verification, etc.);

- limit access to the corporate network and data, making it secure.

In addition to security tasks, the systems we have described in this article also help to solve the tasks of performance improvement, device optimisation, collection of operational statistics and procurement planning. We hope that the features of mobile device management we have described will help you to understand the various solutions on the market and to choose for your tasks such an approach to the use of modern gadgets that will simplify your work and make it better.