ITís best (and only) strategy in a mobile enterprise is to retain control of the components of the mobile software stack that matter most. Encryption and access control are the building blocks of the mobile security infrastructure, and the software implementing these two operations must be as firmly in ITís control as feasible. In practice, this means that a software-only container, which includes its own full stack implementation of all cryptography functions and all secure network protocols (e.g., a full SSL/TLS stack), should be the only software trusted to handle sensitive corporate data and to authenticate corporate users. This strategy is not perfect because no software (including the container itself) is perfect, but it restores control to IT when vulnerabilities are discovered.
As IT quickly loses control of the endpoint devices that employees choose to access corporate systems and data, IT needs to consider carefully when it is essential to retain control and how to do so. A secure container plus device independent security must be in IT's control. Companies that fail to do so are risking their data, reputation and revenues.