Apple's iOS devices meet many enterprise security needs

Forrester Apple iOS report recommends layering atop basic protections

Apple's iOS, in the newer iPhones and the iPad, is now secure enough for many enterprise to deploy, according to a report from Forrester Research. But even the most recent version of iOS, in the iPhone 4, falls well short of the high security offered by Research in Motion's BlackBerry platform.

Nine real iPad alternatives

Forrester recommends implementing a basic set of iOS-based security features on both company- and employee-owned iPhones, and then layering on additional capabilities and policies to meet more stringent enterprise requirements. But the Apple devices still lack a range of features that high-security organizations may need.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Apple's iOS, in the newer iPhones and the iPad, is now secure enough for many enterprise to deploy, according to a report from Forrester Research. But even the most recent version of iOS, in the iPhone 4, falls well short of the high security offered by Research in Motion's BlackBerry platform.

Nine real iPad alternatives

Forrester recommends implementing a basic set of iOS-based security features on both company- and employee-owned iPhones, and then layering on additional capabilities and policies to meet more stringent enterprise requirements. But the Apple devices still lack a range of features that high-security organizations may need.

Nearly one in three companies in North America and Europe currently support the iPhone, according to Forrester. That's an unprecedented number given that Apple offers almost nothing in terms of the management and security infrastructure that are hallmarks of both RIM and Microsoft.

But the changes Apple has introduced in iOS 3.1 and this summer in iOS 4 have been winning over IT executives. (See "iPhone winning over some corporate security skeptics"). Today, iPhones and iPads now "satisfy the basic security needs of most enterprises," writes Andrew Jaquith, senior analyst with Forrester.

The Apple platform now implements seven key features that cover these basic requirements, he says:

* Encrypting e-mail to and from iOS devices; via Exchange ActiveSync licensed from Microsoft or SSL-enabled IMPA and SMTP over TLS.

* Remotely wiping data from lost or stolen devices, now able to be done in less than one second.

* Passcode lock, via numeric-only PIN, or via an alphanumeric password; both can be set to varying levels of strength.

* After a set period of inactivity, iOS can lock the device to prevent access to information if it's left unattended.

* Devices can erase themselves automatically after a specified number of failed unlock attempts.

* Signed user configuration profiles, which set the security settings for a given user; the signed profile ensures it hasn't been tampered with.

* Automatically refreshing security policy settings, but only via ActiveSync and Microsoft Exchange 2007; (Lotus Notes Traveler eventually plans also to push updated policies to the device).

The minimum-length PIN, preventing guessable passwords and the autowipe feature combine to ensure that "cybercriminals cannot easily guess passwords without forcing the device to erase itself," Jaquith writes. Autolock and remote wipe mean that it's less likely company data can be gleaned from lost of stolen devices.

These basic features need to be complemented by an updated employee acceptable use policy, Forrester recommends. Among them:

* Employees must accept installation of the company's security profiles on the device in order to access company networks and data.

* Notify IT at once if the device is lost or stolen, or the employee no longer needs company access.

* Codify the company's right to wipe the device, even an employee-owned device, if it's lost or stolen, or the employee leaves the company.