Apple's iOS, in the newer iPhones and the iPad, is now secure enough for many enterprise to deploy, according to a report from Forrester Research. But even the most recent version of iOS, in the iPhone 4, falls well short of the high security offered by Research in Motion's BlackBerry platform.
Forrester recommends implementing a basic set of iOS-based security features on both company- and employee-owned iPhones, and then layering on additional capabilities and policies to meet more stringent enterprise requirements. But the Apple devices still lack a range of features that high-security organizations may need.
[ InfoWorld's Galen Gruman says iOS appears to do less than you may think. | Master your security with InfoWorld's interactive Security iGuide. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]
Nearly one in three companies in North America and Europe currently support the iPhone, according to Forrester. That's an unprecedented number given that Apple offers almost nothing in terms of the management and security infrastructure that are hallmarks of both RIM and Microsoft.
But the changes Apple has introduced in iOS 3.1 and this summer in iOS 4 have been winning over IT executives. (See "iPhone winning over some corporate security skeptics"). Today, iPhones and iPads now "satisfy the basic security needs of most enterprises," writes Andrew Jaquith, senior analyst with Forrester.
The Apple platform implements seven key features that cover these basic requirements, he says:
- Encrypting email to and from iOS devices; via Exchange ActiveSync licensed from Microsoft or SSL-enabled IMPA and SMTP over TLS.
- Remotely wiping data from lost or stolen devices, now able to be done in less than one second.
- Passcode lock, via numeric-only PIN, or via an alphanumeric password; both can be set to varying levels of strength.
- After a set period of inactivity, iOS can lock the device to prevent access to information if it's left unattended.
- Devices can erase themselves automatically after a specified number of failed unlock attempts.
- Signed user configuration profiles, which set the security settings for a given user; the signed profile ensures it hasn't been tampered with.
- Automatically refreshing security policy settings, but only via ActiveSync and Microsoft Exchange 2007; Lotus Notes Traveler eventually plans also to push updated policies to the device.
The minimum-length PIN, preventing guessable passwords, and the autowipe feature combine to ensure that "cybercriminals cannot easily guess passwords without forcing the device to erase itself," Jaquith writes. Autolock and remote wipe mean that it's less likely company data can be gleaned from lost of stolen devices.
These basic features need to be complemented by an updated employee acceptable use policy, Forrester recommends. Among them: