An iOS 6.1 security vulnerability was recently discovered and documented (via the below video) shows that it is possible to bypass the screen lock without entering the required PIN or password. This latest vulnerability is similar to a security hole that was discovered in iOS 4, and comes just days after Apple acknowledged a bug that is causing hell for connected Exchange servers.

While this new security hole only allows you access to the iOS phone app, and does not allow full access to the devices data it does allow you access to contacts, where you can view as well as edit contacts without authentication.

To exploit the vulnerability you must execute a series of fast fingered power, home, and on-screen button presses, but as you can see in the video below it is trivial to perform.

Citrix announced today that it is acquiring Zenprise for an undisclosed sum. Citrix seems like an unlikely suitor for Zenprise, however this acquisition also allows Citrix to integrate and deliver their entire application stack to mobile, including their existing mobile applications (including GoToMeeting, Podio and ShareFile), enterprise desktop/application remote access and virtualization technologies (Citrix Receiver), and collaboration tools (GoToMeeting and GoToAssist). Additionally, this could allow Citrix to further extend their virtualization technologies to mobile to compete with VMWare’s mobile virtualization initiatives.

Zenprise’s software will be integrated into Citrix’s Me@Work and CloudGateway product lines. Me@Work provides mobile apps for business collaboration. CloudGateway is a management console for user managing access to mobile device software and data.

While Citrix is not a traditional MDM vendor, the market is due for consolidation with 40+ vendors currently playing this space and a value exceeding $7 billion. We expect to see significantly more acquisitions in the MDM market, with enterprise vendors potentially picking up more than one of the smaller vendors based on features.

Regardless if your organization is using BYOD or corporate issued devices, it is essential that, at the very least, basic mobile device technical security controls are employed. Technical security controls can be deployed in the form of mobile device policies using common email systems such as Microsoft Exchange and Google Apps, or using native tools such as Blackberry Enterprise Server or Apple Configurator.

The basic controls and policies that should be deployed to mobile devices are as follows:

• Device Password/PIN Lock – At least 6 characters
  • Reduced likelihood of a brute force access to device
• Device Inactivity Auto-lock – 1-2 minutes
  • Reduces liklihood of unauthorized user accessing a recently unlocked device
• Device Password/PIN Expiration – 90 Days
  • Reduces ability to use known password/PIN for unauthorized access
• Device wipe after exceeded failed password/PIN attempts – 5 failed attempts
  • Reduces likelihood of success of brute force access attempt to a mobile device, especially for lost/stolen devices

Keep in mind that these are only basic security controls and there are MANY additional device policies are available, even without a full MDM solution such as AirWatch or MobileIron, and comprehensive mobile device security controls should be deployed to all mobile devices in your environment.

The Information Week article also points to some insights about how doctors are actually using mobile devices. Doctors are using mobile devices to allow them to engage and better share treatment information bedside in hospitals and clinics, and not for diagnosing. This seems largely to be based on the fact that most mobile devices today are designed for consumption, and not creation of data and content. Will new tablets such as Microsoft’s Surface change this?

The Dell Enterprise team is giving away a free PDF version of  the Windows 8 for Dummies – Dell Pocket Edition ebook. The version of the ebook that Dell is giving away is a “special” Dell Pocket Edition produced for Dell and only covers a subset of topics that are available in the full edition of Windows 8 for Dummies. However this edition covers the basics of Windows 8 that most newbies need to know to get up and running, including the Windows Store or the new Start Screen.

You can get the free ebook here.

The full version of the Windows 8 for Dummies book is available on Amazon. I would also recommend Windows 8 Secrets, also available on Amazon.

The updated version of Exchange Server includes a number of great features and benefits that businesses will love including:

• Simpler Deployment options
• Tablet and Smartphone friendly, responsive Outlook Web Access design
• Full web-based management interface
• Built in anti-malware protection

However, what is glaringly missing is the addition of enhanced ActiveSync capabilities. Mobile device management, IT Managers, and Exchange administrators all were hoping for greater device management and security capabilities to be baked into an updated version of ActiveSync. Since the upcoming Windows RT (and Windows 8) is not manageable by traditional methods such as Active Directory, and is only manageable via ActiveSync, it seemed that those hopes would come true, but these hopes were dashed as there are virtually no improved mobile device management capabilities built into Exchange 2013.

Microsoft seems to have recognized the need for greater MDM capabilities, and has updated System Center Configuration Manager (SCCM 2012) to include MDM capabilities based on ActiveSync, but even the updated SCCM version only improves upon ActiveSync by enhancing reporting, device deployment, and mobile app management capabilities.

The full Microsoft Exchange Team Blog announcement is as follows:

Today we reached an important milestone in the development of the new Exchange.

Moments ago, the Exchange engineering team signed off on the Release to Manufacturing (RTM) build. This milestone means the coding and testing phase of the project is complete and we are now focused on releasing the new Exchange via multiple distribution channels to our business customers.

We have a number of programs that provide business customers with early access so they can begin testing, piloting and adopting Exchange within their organizations:

• We will begin rolling out new capabilities to Office 365 Enterprise customers in our next service updates, starting in November through general availability.
• Volume Licensing customers with Software Assurance will be able to download Exchange Server 2013 through the Volume Licensing Service Center by mid-November. These products will be available on the Volume Licensing price list on December 1.

Since announcing the Preview of the new Exchange back in July, the EHLO team has been actively blogging about the features and capabilities of the new Exchange. We’re excited to start getting the finished product into the hands of our customers!

The slide deck below was used for the tech talk and while it is missing some of the deeper content that was discussed verbally in the talk, you will get the point.

Mobilisafe which was co-founded in 2010 by T-Mobile alumni, Giri Sreenivas and Dirk Sigurdson, takes a different approach to mobile device management for the enterprise. Most mobile device management solutions on the market currently, typically focus on locking down devices and monitoring them, with remote-wipe being the fail-safe if a device is lost, stolen, or compromised. Mobilisafe’s approach is more of a proactive approach to identifying threats posed by mobile devices. It provides enterprises a way to identify device vulnerabilities, available software updates and patches, and notify employees on how to address the vulnerability or install the updates.

Originally, Mobilisafe was only considering a sales and marketing partnership Rapid7, but that changed this year when the companies CEOs met and a bid was made for the company by Rapid7.

At the time of publishing this article, most of the more popular MDM solution vendors have not yet added support for the enhanced management capabilities, but many have promised to work on it. However you do not need to be a large enterprise with a full MDM solution deployed to start working with the new management features today. Support for the new capabilities has been added to the latest version of the Apple Configurator application.

The new security and device management capabilities are:

• App Lock – Allows administrators lock the device to a single mobile app and restrict access to the home screen using a PIN
• Define Wallpaper – Allows administrators to select or install a wallpaper for both the lock and home screens
• Global HTTP Proxy – Allows administrators to define a single HTTP global proxy for accessing the web, rather than specifying it by connection
• Built In App Restrictions – Gives administrators the ability to disable iMessage, iBookstore, Game Center, and shared photo streams
• Notification Restrictions – Allows administrators prevent Passbook notifications from showing on a locked screen
• iBookstore Content Ratings – Allows administrators to restrict the download of content from iBookstore based on ratings (e.g., tagged as erotica)
• Recent Contact Sync – Allows administrators to prevent the sync of recent contacts to servers such as Microsoft Exchange
• Configuration Profile Enhancements – Allows administrators to prevent installation of configuration profiles and certificates and automatically remove profiles on a certain date or after a given period of time

With the addition of Exchange support, the Nook now becomes a device that could potentially make its way into the enterprise, especially in organizations that have BYOD deployments. What is not yet clear about the new Nook tablets is what level of support for ActiveSync is built into the device. As we have seen with some devices, notably Windows Phone 7 devices, ActiveSync policy support only goes skin deep and does not offer support for the policies that enterprises require, such as device encryption.

	Nook HD	Nook HD+
Price	$199 8GB, $229 16GB	$269 16GB, $299 32GB
Display	7-inch IPS LCD	9-inch IPS LCD
Resolution	1,440 x 900	1,920 x 1,280
Pixel Density	243 PPI	256 PPI
Operating System	Android 4.0 Ice Cream Sandwich (Customized)	Android 4.0 Ice Cream Sandwich (Customized)
CPU	Dual-Core 1.3GHz TI OMAP 4470	Dual-Core 1.5GHz TI OMAP 4470
Graphics	Unknown	Unknown
Memory	1GB	1GB
Storage	8 / 16GB + microSD	16 / 32GB + microSD
WiFi	802.11 b/g/n	802.11 b/g/n
Bluetooth	Yes	Yes
Dimensions	194.4 x 127.1 x 11 mm	240.3 x 162.8 x 11.5 mm
Weight	315 grams	515 grams
Battery	4,050mAh	6,000mAh
Details accurate as of press release 9/26/2012