Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, however in order for the device to be of any real use to users they also need to be able to install apps at their own discretion. While we can monitor which apps are installed using the MDM software, we have no real way of identifying which apps if any present a potential high risk to our corporate data.
For most apps it is very difficult to ascertain:
Whether any data is stored remotely 'in the cloud' on a server administered by the app vendor, or whether all data is stored on the device itself;
Whether any data sent/received is transmitted securely between the device and any remote locations using a known secure implementation of SSL;
The geographic locations and hosting companies where any data is stored or processed remotely, along with any known reputations of data security, local leglistation, active enforcement etc;
Whether the app really has been published by the company it says it has been;
Which company the source code has been written by, and what their reputation is for secure development and testing?
Whether any third party security companies have already analysed the app and given it a particular rating or review?
The attack surface very much becomes a big unknown when we allow users to use mobile apps and app publishers very rarely divulge this kind of information.
To give one example, we have identified a business card scanning app stores its data on servers in the Middle East, which is outside the EU, making use of it in certain circumstances illegal under British data protection law, and if used for business contacts, it could be used for competitive intelligence by authorities in that region where different laws apply.
While its often not legal to reverse engineer software, I can't believe anyone really has time to do this for every app they come across, so there must be a realistic approach that's not based solely on guesswork.
Does anyone know of any hosted services or apps that provide any kind of app assurance checking for third party apps, or a searchable database with this kind of information? While we wish to embrace technology and use the great apps out there for genuine business purposes, we need to ensure we're doing so within the boundaries of the law, contractual compliance etc. How do other information security professionals approach this issue?