download issue 27 here - Help Net Security

The mobile IT architecture is completely unsuited
for any heretofore-existing security
model and securing the mobile workforce requires
a fundamentally different security architecture
that solves several, seemingly
contradictory goals:
• It should have zero impact on the performance
of the smart phone.
• It should be invisible to the user, who should
not be able to bypass any controls.
• The enterprise should be able to mange
many different types of smart phones with a
single management, enforcement and control
console.
• Existing corporate security policies should be
easy to migrate to any entire smart phone
population in a few hours.
• It should meet best security practices and
compliance requirements of many industry
sectors.
• Any business should be able to design and
deploy applications without having to worry
about the complexities of secure programming
as is needed even with web applications.
Any business should be able to design and deploy applications
without having to worry about the complexities of secure
programming as is needed even with web applications.
The mobile security problem is not going away
because we wish it to. In fact, it is more complex
than ever before and the sheer number of
users is driving the consumerization of IT and
the proliferation of these dual-use devices
faster than any technology in history.
The control of computing devices has migrated
from the centric to the non-centric and
back. The intelligence of devices has similarly
moved from point to point within the IT infrastructure
and the response of the security industry
to the hyper speed of technology innovation
and deployment must accommodate
the new mobile requirements of business,
government and the consumer.
I invite readers to consider one approach to
this massive problem: moving all security controls
and enforcement off of the internal enterprise,
the end point devices, the desktop and
into a secure ʻhaloʼ where security comes first
and application comes second.
Imagine: a private security cloud where the
business guys can actually design applications
with minimal restrictions. Imagine: a single
administrative and control point for the
mobile enterprise.
There is no need to imagine that this is real -
because it is.
Winn Schwartau is Chairman, Board of Directors, Mobile Application Development Partners, LLC and consults
with private and government organizations around the world. He is an expert on security, privacy, infowar,
cyber-terrorism and related topics. Schwartau has testified before Congress, advised committees and has
consulted as an expert witness.
www.insecuremag.com 42