How to Win in the Enterprise Mobility Market
Last year we exhibited SeaCat at the Web Summit in Dublin. On the second day I explored the venue visiting different exhibition booths in the Mobile Enterprise area and talking to the people there. Many of which have already developed mobile applications and other mobile solutions for enterprises and big companies. While these conversations were interesting, one thing in particular stood out. Regardless of the size, industry, or platform of the prospective client, they all had one thing in common — security, or lack thereof.
Surprisingly, the summit attendees had varying backgrounds ranging from developers, startups, and corporations yet they all responded similarly when I asked about the underlying security of their mobile apps and the back-ends. Their position is that they “are as secure as the infrastructure at our customers,” an alarming approach when discussing mobile applications that are more sensitive to security breaches than desktop applications.
CRM or BI data is traditionally accessed from office desktops. In this traditional environment the data remains within the internal network and is safe from threats. However, once CRM or BI data is accessed from mobile devices, it is beyond the protection of the enterprise network because the data is exposed to the outside internet.
Therefore, if you are an enterprise mobility vendor, your customers probably have not solved this particular security issue and rely on you as the developer to anticipate and respond to these threats. There is a potential risk of losing the client deal if you cannot show that have you aware of these threats. Even if you do get the deal, sooner or later you will be requested to fix the security part. That is not an ideal position to be in especially if you do not know to even solve the problem.
All hope is not lost. The solution lies in becoming educating on new security issues and establishing a protocol for addressing the same. Here are a few features you can employ to cover most basic security concerns as it relates to mobile applications and back-ends:
- Backend isolation
- Access control
- Automated client certificate request/renewal
- Protection of private key on mobile device
- Mutual SSL authentication
The above-referenced summit scenario is common given the rapid growth of mobile adoption. At the beginning of the mobile era, user experience and (visible) functionality were the only things that mattered. Today, security is becoming more crucial as more data breaches occur in organizations big and small. Naturally, enterprises try to avoid this kind of publicity so they are seeking developers who are knowledgeable about current security trends and requirements.
If you are in the mobile enterprise market, take security seriously. Do not rely solely on the skills and knowledge of mobile app developers because their underlying focus is on building a beautiful, functional application. Instead, use the best practices available and offer your customers not just functionality but also security.
Send us an email at email@example.com to get a free consulting session on your mobile solution and learn if there will be any potential risk to your data.
Photo credit Web Summit
You Might Be Interested in Reading These Articles
The use of mobile app security best practices has become a necessity as app development and mobile usage continue to grow. These practices are needed to improve consumer protection, trust, and regulatory compliance.
Published on March 24, 2015
In just the past 12 months, we’ve come across 100 mobile app projects at different phases. We’ve had conversations with more than 300 professionals active in the enterprise mobility space. We asked questions and uncovered the underlying problem that caused the current miserable state of mobile application security. It sucks. The answer doesn’t lie in technology but in us.
Published on May 19, 2016
A zero-day, also called zero-hour, vulnerability is a security flaw in the code that cyber criminal can use to access your network. Zero-day attacks call for new technologies built from the ground up for today’s advanced threat landscape. There is no known fix, and by the time hackers attack, the damage is already done
Published on May 12, 2015