Meeting with Richard Tracy of Telos

Today I went to see Rick Tracy at Telos and discuss mobile security in hopes of narrowing down my topic.  Rick was very helpful and talked very intelligently about the subject matter.  He also emailed some of his contacts, two of whom have responded already and offered to help me out.  Rick also handed me a copy of today's Washington Post which had an article on Mobile Security.  I plan on reading it.  Here is some of what I remember him talking about:

- Containerization versus usability
- With Containerization security is built in
- Unlike desktops and laptops, mobile devices do not have well defined security boundaries
- Containerization is safer but brings about usability issues and high overhead
- If containerization is not used, a VPN is typically used which while securing communication, allows malicious programs to also use the VPN
- An organization has to ask what is their tolerance for risk when dealing with mobility?
- Consumerization of IT meaning that businesses are scrambling to decide what to do with consumer products that are coming out (Pads and Smartphones) as they want to use them more and more
- A lot of organizations have mobile devices because it is more efficient
- Many have them just for the image it projects or sophistication
- There are no best solutions yet for mobile security

For this last point, Rick pointed out something great.  He mentioned that with mobile security, the goal is to iPhone it.  What he meant was that iPhone changed the the way phones are used and people think of phones for good.  A technology has to come along that does away with all other bits and pieces of security as they relate to mobile security and is so comprehensive that everyone uses it by default.

Telos according to Rick relies on

- Policy
- Education
- Devices that supports complex passwords and full encryption

For every 50 developers, Telos has one security coach who is also a developer.  This person is responsible to coach the other developers (and monitor them) in their code so that security is not an afterthought but integrated in the code they produce.

By: Nima Zahadat