MDM: Mobile Device Management

The development of mobile devices and wireless technologies in recent years has revolutionized the way we work and communicate. The growing use of these technologies makes mobile devices one of the main targets of cyber threats. 

Mobile means a small device for personal or professional use that allows data management and access to communication networks and services, and that usually has both voice and data telephony features, such as smartphones, tablets, personal digital assistants (PDA) etc. 

The use and widespread adoption of mobile devices as basic tools to increase productivity in professional environment, combined with their use in personal sphere, make it necessary for organizations to carry out thorough, comprehensive and ongoing management, consistent with the organization's security policies. 

Technological solutions that enable mobile device management at an enterprise level are known as MDM and basically allow to efficiently manage various mobile devices considering their massive, dynamic and large-scale deployment in an organization, with a focus on increasing their security. 

Architecture 

MDM solutions use the client-server structure for their operation. Servers usually include the MDM management system, its database, WEB administration panel and services used by clients such as Active Directory, certificates, e-mail servers etc. 

On the client side, a management software is usually installed to be able to manage the endpoint remotely and to install software updates, monitor or add policies to the endpoint. 

To establish connection to the server, it is essential that clients have a data connection via mobile phone or Wi-Fi. Another feature of the client app is that it does not need administrator privileges to run, so its functionality may be limited. 

When selecting an MDM solution, the following considerations should be taken into account: 

• Support of multiple devices such as phones and tablets with various operating systems. Normally any device running Android, iOS or Windows Phone is supported by MDM.
• Easy integration with the corporate internal services already used by the company.
• Ensuring the security of devices’ of internal information and its transfer. 
• Most companies that deploy this type of solutions provide a device to each employee, but there is also the possibility for employees to use their own device (Bring Your Own Device - BYOD) at work.
• In this case the MDM client application should be installed on them, which would allow the endpoint to access the company’s internal services and provide them with additional security for communication, physical access and encryption of internal data. 

Basic Features 

The key basic features that are typical for most MDM solutions are:

• Application control: It facilitates administrators to deploy apps in a centralized way, allowing and controlling those that are necessary and restricting possible installation of others, thus preventing the possibility of manipulation by the user.
• Profile management on devices: Possibility to preconfigure mail profiles, calendar, contacts, VPN access on an endpoint and/or user in a centralized way, being able to revoke the privileges easily in cases of loss, theft or absence of the device.
• Data protection: Ability to enable mandatory use of disk and card encryption on those endpoints that allow it.
• Secure remote data deletion: In case of loss or theft of an endpoint, the removal of its content can be managed remotely and safely.
• Monitoring: Ability to record the actions performed on an endpoint, attempts to violate security or protection mechanisms, as well as accessing the location data of the device.
• Data reports: Monitoring statistics of various parameters to know the dynamics of the device status.
• Device access: Ability to add authentication mechanisms before accessing endpoint information. 

Security Aspects 

To consider the implementation of any MDM solution, the following points should be taken into account in order to ensure compliance with security policies: 

On devices (client): 

Mobile devices are the weakest part of the platform, being the means of communication between employees and company services. Security analysis of an MDM platform should take into account the following aspects: 

• Access control: devices have various control tools for limiting access to the device itself or its resources. They can use a SIM card access PIN, an access password for an encrypted partition, etc.
• Security policies: they require endpoints to comply with a minimum of security requirements established at the corporate level; among the most common: denying access for installing new apps, restricting the use of specific features (such as camera, tethering, Bluetooth), blocking permissions that apps assign to storage resources etc.
• Operating system security: access to certain processes, files or directories specific to the operating system, as well as the execution of apps, firewall configuration etc.
• Data security: encryption of stored data, remote erasure in case of loss or theft of the endpoint, automatic destruction of data after reaching maximum number of failed access attempts,file system tracking with the purpose of finding information leaks caused by apps etc.
• External or additional security apps: antivirus, VPN, as well as others that provide an extra layer of security.
• Password analysis: Weak passwords (lockout or encryption) can be used on endpoints. If this is the case, policies should be considered to ensure minimum levels of security, such as the use of credentials with alphanumeric characters and punctuation marks, a minimum length of ten characters etc.
• App and system updates: A mechanism should be implemented that transparently applies security patches to the system as well as app updates.

In the infrastructure (server): 

Since the MDM solution should be integrated with the existing infrastructure in the organization, it is necessary to evaluate the affected parts. Server security analysis should take into account the following aspects: 

• Analysis of the architecture and cross-platform communication: involves study of infrastructure components, use of encrypted communications between them, and analysis of the certificates used. It also includes assessing network protocols, identifying deficiencies in them, identifying the information transmitted between different parts, as well as analyzing reliable channels.
• Server analysis: includes security assessment provided by both the server’s operating system and the application that manages the MDM platform. It is typically performed by performing a simulated intrusion test, so it is important to follow methodologies aligned with the good practices of the industry. 

Benefits and Vulnerabilities 

Due to the need for staff mobility, the power of endpoints and the requirement of their central and secure management, a clear increase in the level of use of MDM systems can be considered in many organizations. 

The most important benefit of mobile device management is information security. MDM protects data through device-level policies, provided by the device manufacturer or platform provider. 

Platform administrators can control, protect and disconnect mobile devices from the organization’s networks, enable encryption for communications, and automatically block or delete an endpoint if it is broken or lost. Other popular MDM features include device inventory and tracking, password management, black- and whitelisting certain applications etc. 

Despite the benefits of this type of solution from the data security point of view, it can also be subject to vulnerabilities and, therefore, should be periodically assessed, and measures should be taken to eliminate or mitigate the deficiencies identified. 

This assessment should be carried out on all the elements involved in the MDM infrastructure, and should include the review of aspects related to configuration deficiencies, absence of updates, or corporate policy violations. 

MDM solutions offer valuable options in terms of mobile device security and control, however their efficiency ultimately depend on the existing security policies, the selected configuration, and the overall security level of the organization.