IT Briefcase Exclusive Interview: BYOD Holiday Hazards for Popular Shopping Apps

In this interview, Maureen Polte from Flexera Software discusses findings from the company’s report, “Holiday Hazard Shopping Apps Highlight Risks of Mixing personal Apps and business Data,” and why it’s important for enterprises to understand the risky behaviors associated with mobile apps that could compromise data security in today’s BYOD environment.

• Q. What prompted Flexera to conduct this study and do a risk assessment on shopping apps?

A. We work with companies all over the world to help them shore up their Application Readiness processes and automation.  Organizations tend to have very mature processes around preparing their desktop applications for deployment and understanding how they interact with other applications and systems.  However, we observed that most organizations have very little idea what data and systems mobile apps interact with.  And with so many mobile apps now interacting with the corporate network as a result of employee-issued devices and BYOD – lack of insight into mobile app behaviors brings with it inherent risk.  Conducting this study provided a good backdrop to discuss that risk.

• Q. How did you conduct tests on these shopping apps?

A. We used AdminStudio Mobile, part of AdminStudio Suite which powers an enterprise’s daily Application Readiness process for inventory, rationalization, packaging, planning, and compatibility testing of physical, virtual, and mobile applications.  The solution helps ensure faster service delivery and predictable deployment.  AdminStudio Mobile enables centralized management of mobile apps with the same tools and processes used for physical and virtual applications.  AdminStudio Mobile imports mobile apps from the store and analyzes their property files and other aspects of the application against a set of pre-configured Operating System and device tests and reports on the behavior and configuration of the apps.

• Q. What was one of the most surprising findings from this assessment?

A. We were surprised that so many of the apps tested interacted with features and functions that do not have obvious connection with their primary purpose.  For instance, many of the shopping apps tested are able to interact with Bluetooth, devices’ address books, calendar and SMS texting capabilities.  Most organizations are probably not aware of this – and it may or may not be a concern – depending on their own security concerns and policies.  But it’s important to understand what data and systems mobile apps are capable of accessing.

• Q. What is your advice for enterprises who offer BYOD or company-issued devices to protect themselves this holiday season and beyond?

A. It’s critically important for enterprises to establish a BYOD policy.  This process allows them to think through what is and is not acceptable risk with respect to mobile devices and apps, and set guidelines that are appropriate and understood by employees.  Just as important, organizations must enforce those policies – and that’s where Application Readiness comes in.  You can’t enforce what you don’t understand.  So testing mobile apps that are being used (or likely to be used) by employees on their devices is critical so that you understand what the apps do and what systems they interact with.  Armed with this data, organizations are then equipped to enforce their BYOD policies with whitelists, blacklists and other mechanisms.

• Q. How should mobile teams within organizations struggling with workload and resources prioritize these activities?

A. Many organizations struggle now with Application Readiness because they have different teams managing application rationalization, packaging, remediation, repackaging – for different types of applications.  For instance, one team may handle desktop apps, another may be responsible for cloud and virtualized applications, and yet another handles mobile apps. And they often use different processes for each. This is extremely inefficient.  In our experience, the same Application Readiness processes should be applied to all applications.  In organizations with mature processes, Application Readiness is centralized and automated.  This eliminates much of the waste associated with ensuring that enterprise apps are deployment-ready and reliable.

Maureen Polte is the Vice President of Product Management at Flexera Software responsible for driving strategic product direction for the Installation and Application Readiness Solutions. She works with both Software Producers and Enterprise IT Operations to ensure that the world’s business and consumer applications are reliably and optimally deployed on millions of computers worldwide. Prior to Flexera Software, Maureen worked as the Executive Vice President and Group Leader, Product Development at Infogix, Inc. and as the Vice President of Development at Cyborg Systems (now Accerro). She graduated with a Bachelor’s degree in Actuarial Science from the University of Illinois at Urbana-Champaign.