iOS 7 and Mobile Security

A lot of businesses have been eagerly awaiting Apple’s iOS 7 release, that finally arrived yesterday. The new OS will undoubtedly have an impact on the entire enterprise mobile management marketplace, and many vendors are sharing their opinions as they relate to their own mobile security solutions.

Apple has added many new management features to iOS 7, expanding their focus on the enterprise market by adding important features that address security corporate requirements.Apple is continuing to focus on mobile device management (MDM) as the mechanism for managing and securing all iOS devices. This means that Apple is making MDM an even more important aspect of a company’s mobile strategy.

iOS 7 and Mobile Device Management

There are many new features publicly noted in iOS7 that further consolidate the role of MDM in protecting enterprises against costly downtime or IP theft:

• Open in Management to control sensitive documents and email
• Per App VPN for secure communications
• Single Sign on for enterprise applications
• VPP enhancements to improve licensing of enterprise applications
• Streamlined enrollment for corporate owned devices

iOS7 and app wrapping

You need flexibility and choice in supporting multiple approaches to securing your mobile deployments. With the new iOS7 capabilities, in addition to the device level capabilities, many companies also require app-specific security policies to complement their MDM strategy.

There are two main scenarios where additional security capabilities may be needed:

1. Organizations with strict security policy requirements (such as those in the public sector requiring FIPS 140-2 certified encryption, or financial services and other regulated industries).
2. Companies who want to extend enterprise apps to mobile devices that are not under MDM control, such as BYOD devices or the extended enterprise.

Many enterprises will find that as they evaluate what is actually in iOS7 that they may want (and need) more. For companies deploying corporate apps on devices they don’t own or control, including those owned by partners, resellers, distributors or contractors, the iOS features won’t help since iOS7 requires the device to be under MDM.

In a recent article published in CIO magazine, SAP’s Tom Voshell was quoted as saying “Organizations, particularly those moving toward BYOD, have been developing device management policies with features like remote data wiping and encryption, but those policies, if left at the device level, fail to address some unique security concerns associated with mobile apps.”

When looking at approaches to mobile app security in these unique environments, the easiest and most robust approach is App Wrapping. Quickly and easily, you can add new security features to the apps you already have, simply by uploading them to a special portal. App wrapping allows you to wrap certain critical resources – like a keychain and an IP stack – directly into each app. That helps keep apps and their data safer, even when the device gets jailbroken or infected with malware.

When evaluating what mobile security approach is right for your company, there are some areas that you should review closely. For example, evaluate how Per-app VPNs are implemented and see if the vendors approach to single sign on works for you. Some difference might not seem like a big deal, but to security professionals, they may be significant.

A version of this post originally appeared on SCN Mobile and was republished with permission.