iOS is becoming increasingly popular in the enterprise. It’s sometimes been a bumpyroad, but according to Forrester iOS has reached a level of security that should be acceptable to most enterprises. Forrester released today a new report titled Apple’s iPhone And iPad: Secure Enough For Business? In addition to covering seven basic security policies every enterprise should implement, Forrester lists several optional security policies and identifies some high-security areas in which iOS based devices shouldn’t be used. The basic settings detailed should also be applicable to Android 2.2.
The seven basic policies are:
1. Require email session encryption.
2. Wipe devices if they are lost or stolen.
3. Protect devices with a passcode lock.
4. Autolock devices after periods of inactivity.
5. Autowipe devices after failed unlock attempts.
6. Protect the configuration profile.
7. Continuously refresh policies.
Of particular note is the lack of the ability to control applications on iOS devices. IT managers can either turn off the ability to install apps, or leave it on – there’s no means for creating white lists. Forrester sees application control as the next “battleground” for enterprises adopting iOS and Android devices.
Another issue is the lack of a means to separate private and business use. For example, sensitive information could be copied from a business e-mail account into a personal account, and uses could have all their personal data remote-wiped as well. We see this as a major emerging issue in all areas of enterprise software, not just for mobile devices, as social media use in the enterprise accelerates.
The report also notes that third-party mobile security and device management software from vendors such as Afaria, Trust Digital, MobileIron and Good can provide additional security features.
Enterprises such as Intel and Wells Fargo have been allowing or even encouraging enterprise use of iPhones and iPads, and we’ve been seeing more and more reports of enterprise adoption of iOS devices. Apple and Google have improved their respective security features, and we expect to see more improvement in the future as both compete with Research in Motion in the enterprise.