BYOD will always be trade-off between convenience and

Research by independent security consultancy Context Information Security has revealed limitations in current Mobile Device Management (MDM) solutions for Bring Your Own Device (BYOD) implementations. The report published today also concludes that BYOD will always be a trade-off between convenience and security as devices can only be locked down so much before users chose not to opt-in to the scheme.

Context researchers looked at three leading MDM solutions, Airwatch, Blackberry Universal Device Service and Good for Enterprise, when used with Android and iOS mobile devices. While they were all found to provide good levels of BYOD security, like all MDMs they are limited in what they can achieve by the underlying operating systems.

For example, MDM solutions in a BYOD environment cannot prevent unknown malicious applications from recording sound via the phone’s microphone or tracking user location using the built in GPS. And while Jailbreak/Root detection is implemented by all the MDM solutions reviewed, they work in very much the same way as antivirus, only detecting known Jailbreak/Root methods and applications, which are often trivial to bypass by technical users or malicious hackers. Implementation weaknesses of MDM solutions may also inadvertently leak sensitive information and users can compromise security by downloading apps and disregarding operating system permissions requested by the applications.

“There is no realistic way to guarantee the security of a workable BYOD environment, but organisations can take significant steps towards mitigation of security risks if they combine technical security controls with clearly defined acceptable use policies,” said Alex Chapman, Senior Consultant at Context. “To fully lock down these devices, a combination of fully restrictive MDM policies and network controls such as corporate firewalls and web proxies need to be implemented and enforced. But MDM solutions can only lock down mobile devices to the extent that underlying operating systems will permit and BYOD implementations can only lock down devices to a level that users are willing to accept.”