Employee-Liable Smartphones on Corporate Networks: Five Tips to Boost Admin Control
Zenprise's Five Tips
1. Require users to proactively seek permission to connect via Exchange ActiveSync (EAS).
Microsoft Exchange ships with EAS enabled by default for all users. This means that employees can enable their iPhone, Android, Palm, and Symbian devices to retrieve corporate mail, without asking the IT department for authorization or approval. In order to secure a device, the IT department must have visibility into which devices are connecting to the network. Therefore, it's important to set a policy that requires users to contact the IT department for permission to enable ActiveSync.
2. You can't secure what you can't see. Gain visibility into which devices are connecting into the network.
A "particularly worrisome trend" cited by a recent Aberdeen Research report found that the vast majority of organizations meeting the demand for individual-liable devices had little to no visibility into device usage and telecom costs. Without full visibility into the devices running on a network, IT is subject to greater security risk from employee liable phones. Once an administrator has authorized and enabled EAS for a user to connect into the network with an iPhone, for example, they do not need permission to add additional devices to the network. Without daily or weekly reports, IT has no visibility when a user switches their smartphone for another type of device.
3. Like everything else on the network, smartphones must also have security policies.
Companies should set up a default EAS security policy so that all phones connecting into the network have a minimum level of security enabled. In many instances, this will force users to do things like set up a security password or enable other security policies before they can access their email for the first time.
4. Smartphones are an extension of corporate data. Give users the ability to wipe their own device in case their device gets lost.
According to Accenture, 10 to 15 percent of all handheld computers, PDAs, mobile phones, and pagers are lost by their owners. More often than not, users will delay reporting their device as lost or stolen, either in the hopes that they can retrieve the device, or because they are embarrassed for losing it. Every second of delay could mean the loss of sensitive corporate data. Providing users with an ability to wipe their own devices will significantly reduce the risk of both personal and corporate data loss.
5. All work and no play? Track applications installed on the device.
The line continues to blur between the personal and corporate use of smartphones. Organizations that allow users to install personal or corporate applications on their device, should audit for rogue third-party applications, and control which corporate applications mobile devices can access. More and more users are unintentionally downloading memory hogging or malware embedded applications. By understanding which applications are installed and running, enterprise IT can avoid potential security and compliance risks.