Does iCloud make iPhones and iPads a security risk?

The forthcoming free Apple service syncs among iCloud-enabled devices, moving data to devices and cloud servers outside your control

Just when some CIOs and CSOs thought they could adopt iPhones and iPads after assuring themselves that iOS's built-in security capabilities and management support via Microsoft Exchange and/or mobile device management tools were sufficient, now comes iCloud. Could it stop the momentum of iOS devices into business -- or, worse, reverse it?

The iCloud service, to debut with iOS 5 this fall, is free, and many iPhone and iPad users will enable iCloud. iCloud syncs data and files using Apple's data centers as the waystation and intermediate repository among various computers -- including Macs, Windows PCs, and iOS devices such as the iPad and iPhone -- that are registered to the same Apple ID, which is often identical to a user's iTunes Store account.

[ Learn how to manage iPhones, Androids, BlackBerrys, and other smartphones in InfoWorld's 20-page Mobile Management Deep Dive PDF special report. | Keep up on key mobile developments and insights via Twitter and with the Mobile Edge blog and Mobilize newsletter. ]

Upon learning of iCloud, one financial firm's CSO bemoaned, "Many of us are bound by contracts or government regulations to maintain certain levels of security and data governance. ... We were impressed enough with the recent improvements to iOS to consider approving the use of the Apple devices, but this iCloud announcement set things back to square one. We can't have corporate and client data spreading to places and devices unknown, and Apple has been short on security details."

Does that CSO have cause to be worried? Maybe. He's right that Apple has said little about the security details of iCloud, and Apple has not responded to a request that InfoWorld made a week ago to comment on iOS security in light of iCloud. This CSO also is not alone in expressing concerns: "I had customers emailing me before the end of the WWDC keynote," where Apple CEO Steve Jobs announced iCloud on June 6, recalls Jesse Lindeman, product manager at mobile device management (MDM) tool provider MobileIron. Raffi Tchakmakjian, vice president of product management at MDM provider Trellia, likewise tells me that several corporate iOS pilot deployments were put on hold due to these iCloud concerns, as customers await a clearer picture on its security management implications.

What we know about iCloud syncing

Based on what Jobs showed at WWDC, iCloud syncs five kinds of data, and the user chooses what is synchronized:

• Safari bookmarks across devices registered to the user's Apple ID
• Media (books, magazines, music, and apps, but apparently not video) bought through one of Apple's online stores via that Apple ID
• Mail, calendar, and contacts information that is locally stored (that is, not Exchange, IMAP, CalDAV, and so on, as those are handled by their respective servers rather than by iCloud)
• Files in Mac OS X Lion and iOS 5 applications that use the iCloud Storage API; Apple's iWork suite (Pages, Numbers, and Keynote) will be iCloud Storage-enabled (data in apps not using that API is not synced, and it appears that you can't sync data across different apps, such as between Office and iWork)
• Pictures in iOS's Photos app, the Mac's iPhoto application, and in Windows' My Pictures folder

If you step back, you'll realize that iOS 4 today syncs exactly the same things -- though manually via iTunes over a physical connection -- as iCloud is promised to sync. Regardless of whether they allow such data syncing via iTunes, most apps today permit their data to be copied into other apps via the Open In facility or emailed, just like on PCs -- access that the app developer determines. Plus, many apps -- including all the major iOS office productivity apps -- let you upload and download files via cloud storage services.

In most cases, iCloud shouldn't really change your security assessment of iOS. But one case could apply: if your employees are European or deal with personal data covered by the European Union's privacy rules, which require data on E.U. citizens to be kept in an E.U. country. (Yes, I know the local laws on privacy and security are increasingly incompatible with the distributed nature of cloud computing, but that's a political issue that looks to be nowhere near resolved.) Apple's iCloud data centers are in the United States, and iCloud also apparently uses Amazon Web Services and Microsoft Azure for data storage (their servers could be anywhere) -- any of which may make iCloud usage illegal in some cases.

Even if E.U. rules don't apply to you, iCloud may expose an ability to trade information that IT organizations may have been unaware of previously -- or, more likely, turned a blind eye to because it involved manual processes most users weren't likely to use. In the case of file sharing via iTunes, users probably weren't even aware of them. Plus, iCloud's publicity puts IT in the uncomfortable position of now knowing that the data is likely syncing somewhere, so plausible deniability evaporates.

Possible approaches for Apple to takeBased on Apple's existing technologies, it's easy to see three approaches related to iCloud policy management Apple might take in iOS 5 to address the concerns that some IT people have, to extend what is available today. (Note: I have no inside information as to what Apple is actually working on, if anything.)

• Add a policy to its security APIs that disables iCloud on managed devices, so IT can decide which users, if any, may have iCloud syncing enabled via a mobile device management (MDM) tool. Apple likely would not want to disable fully a highly touted new feature, but per-app iCloud control -- similar to its per-app location information controls -- might pass muster.
• Better support for multiple Apple IDs on a device, so a company's apps and associated data are not synced to a user's private equipment via his or her personal Apple ID and iCloud. That's implicit in how iOS today manages apps and content based on the Apple ID or iTunes account; for example, if you install an app by signing in from someone else's ID, those apps can't be updated until you sign back in with that same ID (at which point your apps can't be updated). But Apple could allow multiple active Apple IDs -- such as a personal one, a business one, and a family one -- and then manage assets and iCloud separately for each account.
• Propagate security policies to synced devices; any policies enforced on the device that IT knows about are also enforced on those IT doesn't know about as soon as they sync via iCloud. Mac OS X Lion's new support for configuration policies for both iOS and Mac OS X Lion could be the vehicle for such policies, provisioned by Mac OS X Lion Server or through an MDM tool, though that would require major changes to MDM tools.

The third approach could be both tricky and invasive, so I'm hoping Apple looks at the first two.

I personally think the second option makes the most sense. Because so many people use the same Apple ID for their whole household, Apple's consumer users likely need to keep parents' and kids' media and data from commingling. A better multiple-ID mechanism to help these users could also help businesses.

What IT can do if Apple doesn't actShould Apple do nothing, here's what IT can implement under the existing iOS technology management to limit data sharing -- with or without iCloud as a factor: Provision iOS policies that disable app installation or block specific apps, use VDI technology such as Citrix Receiver and/or an HTML5 app so that the data stays in your data center, and that force encrypted backup of data. There are also ways to use iTunes at work to "own" the device, so users are less able to connect to other personal devices and accounts. Of course, these techniques work best with devices supplied by the company, as they restrict much of what a user would want to do on a personal device; if your goal is a BYOD or shared-ownership scenario, these techniques would be too restricting.

For issues such as national privacy laws, you'll have to keep that information on servers whose location you know, and that means not moving it to local apps, whether on smartphones, tablets, laptops, or PCs. Instead, you need to use pricey approaches like Citrix or VMware VDI clients, or some sort of Web-based tools (perhaps corporate Google Docs, though it's not so great on mobile devices) for working with that data.

That CSO I mentioned earlier wants more control than what I'm proposing or what iOS 4 supports today. Although he was willing to forgo the capability on iOS devices before the iCloud question arose, he'd like per-app management for file sharing and ability to copy or email data, as BlackBerry Enterprise Server (BES) offers on BlackBerrys. You can get some of that today via an iOS-capable MDM tool, but he doesn't want to have two management tools, saying it's cheaper to provision BlackBerrys to everyone. That last statement made me wonder how willing he really is to support iOS -- the iCloud issue may have caused someone already on the fence to climb back down, at least until detailed information becomes available from Apple. But he also cited the E.U. privacy issue, which does in fact apply to his firm's international operations.

Has Apple undermined iOS's acceptance in business?Regardless of his individual circumstances, that CSO's larger concerns do exist at other companies and deserve Apple's consideration. Several people I know in the MDM industry tell me these iCloud concerns are widely shared, even if not necessarily well-founded.

It would be a shame if Apple's iCloud promotion and subsequent silence casts on a shadow on one of iOS's key strengths: its ability to work well in both consumer and business contexts. After all, iOS is the most securable mobile OS after BlackBerry. After all, iCloud doesn't change the underlying sharing capabilities and approaches of iOS -- it just makes them easier to use. With one huge exception, that is: If it's syncing business data that can't be uploaded to a "foreign" cloud server, there could be a real problem with iCloud, iOS, and business compliance.

Click here to view the latest articles from this Blog and
Click SKIP AD on the right above to see the new Articels