Secure Remote Working
Device Management versus
Secure Containers-A SOLITON WHITE PAPER-

Back when we all worked in offices (do you remember
those days?), we used company-owned devices,connected to the network. It was practical; IT
departments managed all the computers and hadcomplete oversight.

But things are different now. While many companies still
have networks, more of us than ever before are remoteworkers — and we want or need to use our personal
devices for work. For IT departments, this makes
things more complicated. Privately-owned devices, notmanaged by IT, introduce new security risks. Devices
are no longer just in the office. They’re out in the world,
travelling, mobile, and in the homes of employees,
exchanging company data on private devices using
unsecured Wi-Fi.

www.solitonsystems.com

2

Two high-level strategies to manage
remote working - device management
versus secure container
When people work
remotely, there
are two highlevel strategies
companies canadopt. The firstand most commonstrategy is device
management.
Essentially,

withdevice

management,a widespread strategy, used to enable remoteworking.
For the user, device management also hasdownsides. The device is a business PC. If theywant to use it for personal reasons, it probably
isn’t allowed. And if they change jobs, thecomputer likely will need returning, meaning if
they have used the device for personal use, theymight lose personal data or IT management
could lock them out.
Users often end up having two devices - a
personal device and one owned and managed
by the company - as using the business PC for
personal use is risky.
ITdepartments manage the endpoint — thecomputer, workstation, mobile phone, tablet
or any other device connecting to the network.
Companies will typically provide homeworkers
with necessary devices, say a PC, and that PC
has all the business software on it. It’s managed
from inside the networkw, meaning IT still hascontrol. But this approach is expensive forthe business. You have to pay for the device.

The alternative to supplying devices is getting
people to use personal devices for businesspurposes. However, this isn’t ideal. When
companies put device management software
on personal devices, they can see who the user
calls, what they do, and the apps they install,which is a privacy invasion. So what else cancompanies do? This brings us to the second
strategy: Using a secure container.

You have to buy software to manage it. You
have to control it. You have to think about andmitigate all the risks in all the places. But it iswww.solitonsystems.com

3What exactly is a secure container?
A secure container is an application installed on a device. The user
installs the app on their device and allows the company to control thatapp — but, importantly, not the device.
It works a bit like an embassy. When you look at

to deploy than device management. But more

an embassy from the outside, that’s a little part

importantly, it’s non-intrusive to other apps orof one country inside another. The UK embassy

data on the device. Companies cannot view orin Tokyo, for example, is UK territory and law,accidentally delete personal data on devices,operating within Japan. The secure container

which would breach privacy laws in someon the personal device is similar. Users allow

European countries.

an embassy of their company on that remotedevice. A container on a personal device, like ahome computer or private phone, means it’s not
the device managed; it’s the container. It’s a little
piece of the business on your device.
The secure container partitions the corporate
data from the rest of the device. By doing this,IT maintains full control over the data inside thecontainer, while keeping corporate data separate
from other (personal) data on the device. This
technique prevents corporate data leakage to thedevice and reduces the risk of data contamination
by viruses or malware on the device.
Even if the device isn’t secured, unauthorised
users can’t access the data inside the container.
Thecompanycontrols

thecontainerandconfigures the security settings. They can lockusers out after 10 seconds, ask for a PIN code or
require two-factor authentication. All data inside
the container is encrypted, and data can be wiped
remotely. Even if the device is compromised, thecorporate data inside the container is still secure.
Secure containers are much cheaper and fasterwww.solitonsystems.com

4Securecontainers =less to manage
Keeping up with new security-related
issues that emerge with new features orchanges in applications is a headache
for IT departments. Updates to Windowsand macOS, as well as new iOS andAndroid releases, introduce new risks,
which IT teams need to remember tomanage.
ForIT

Secure containers
in practice
Soliton’s MailZen solution combines a broad
set of standard business functions in a single
application, designed for iOS and Android.
Company data, including phone numbers,
contacts, calendars, files and photos, are stored
inside the secure container. It’s safe for remote

teams

using

thedevice

management strategy, this means you

workers to use these assets, no matter how well(or poorly) their device is secured.

have to keep track of everything. You
have to continuously understand alldifferent device types, all the operating
systems and apps, to manage them.
And this is a very costly thing. It takes
time, and there’s always the risk you
forget or overlook something. With asecure container, you don’t have toworry about these updates.

They can download files
from the server or thecloud to a secure partof the phone, which isencrypted. Users canaccess documents and files
when offline, read themand make some edits andamends. Then, when backonline, they can upload
those files again.

www.solitonsystems.com

5They can also take photos within thecontainer and upload them directly to thebusiness server, so they never end up on thephone itself. Images can include information
about private individuals, which should not
end up on personal devices. For example,
companies and local authorities take photo
to track fly tipping incidents could include
personally identifiable data.
Mailzen does more than protect company
data — it can also partition company datafrom personal data. As a result, company
assets are never “contaminated” with private
data, which avoids GDPR-related problems.
MailZen works for Microsoft Exchange,
but also in the cloud with Office 365. Using
MailZen for O365 gives you all the flexibilityof O365 services, plus the peace of mind of asafe working environment.

But securecontainers aren’t
just about phones
and tablets —solutions are alsoavailable for PCs
and Macs.

www.solitonsystems.com

6When to pickdevice management over securecontainers?
Importantly, you can also combine
the two; it’s not necessary to haveone or the other. It’s perfectly fine
if you have some places where
you need device management
and a pool of other people where
you choose to have this securecontainer on their device because
it’s less intrusive.

functionalities not available inside the container,
device management may be the best approach.
Device management also makes sense if thedevice is company-owned. Though, even if youown the device, there are some complications
with device management, because users stillretain privacy rights.
This point about functionality may make somecompanies concerned that secure containers
won’t include everything they need. But forthe most part, this is unfounded. The securecontainer balances a broad set of standard
business functions, within a very secureenvironment, that is managed by thebusiness, without any risks for the personal
device and the personal data.

It’s not a competition between the two strategies.
It’s about using the approach that best fits yourneeds, your users and your devices.
The key to decide which approach makes sense

Keeping personal
do they require additional functionality?
data out of theSecure containers are separate places on enterprisecomes down to functionality: Can the user doeverything they need within the container, orpersonal devices, which have a set of applications
required for work, for example, business email
apps, the calendar or the contact lists. It could

International businesses have to consider theinclude access to specific business services that

local laws of the countries where they operate.

users can access within the container. But users

You need to comply with the local law, and thatcannot change these functions; it’s not up to theisn’t easy. Container solutions aren’t necessarily

user to install a new app inside the container.

the answer in every situation. But being lessIt’s not an open architecture.

intrusive on the device (and therefore lessintrusive to the user) often means it’s preferable

In some scenarios, where users require

to device management.

www.solitonsystems.com

7Equally important with a secure container is the separation of private and business data. For
example, when you have multiple email profiles on your phone, it’s easy to make mistakes andsend business emails out of your personal email account. By separating the two, company data
never ends up in a place where a local app can access it.
Three is a clear separation between what the company owns and what the private person owns
and controls. It’s not an invasion of your phone. It’s just installing another app. For instance, it’s
impossible for a user to download a file from the server and store it on their phone, where anyother application can use it. Everything stays inside that container.

Benefiting the users, aswell as the company
It’s great for the company because they know that their company data
is not going to leak out. But it’s also good for the user. When they’reusing their device outside of work, they just see their apps, photos andemails; all work data is separate, and nobody is tracking your activity on
the device. They can switch off from work, and still use their device for
personal reasons. But they still have the flexibility to work at any timethey want.
For the business, they have way less to worry about, andthey get much more assurance around the data. It mitigated
the risk to an acceptable level. And IT also is happy,
because they have way less to manage. IT departments
are busy; they don’t want to control thousands of devices
if it’s not necessary.

www.solitonsystems.com

8

ABOUT SOLITONand Ultra-Low Latency Video Streaming,and is headquartered in Tokyo, Japan. Ourcurrent CEO and founder, Nobuo Kamata,
PhD has been a technology-oriented leader
and pioneer since 1979. Soliton has a strong
vision to innovate solutions to logically satisfy
the needs of our customers, without addingcomplexity.
Soliton Systems has continuously set new
standards

inperformance,qualityandreliability in our areas of expertise: CyberSecurity,MobileLive

Broadcasting

andPublic Safety. For more info, visit www.
solitonsystems.com.

SOL202104

The right solution
depends on you andyour situation. Basedon your requirements
and your budget, you
can decide which
strategy to use:
Device management,
secure containers
or a combination ofboth. Need somehelp figuring it out?
Contact us throughthe Soliton website,and one of the teamwill get in touch!

Soliton Systems specialises in IT Security

EMEA office

Soliton Systems Europe N.V.
Barbara Strozzilaan 364, 1083 HN Amsterdam, The Netherlands+31 (0)20 896 5841 | emea@solitonsystems.com
www.solitonsystems.com