How Colligo Helped Novartis Trust iPads On SharePoint

When Colligo Networks asked Markus Bosch to test its iPad app for secure access to SharePoint, it couldn't have picked a better time.

Bosch is a solution architect at Novartis International, responsible for meeting the collaboration needs of the drug maker's headquarters staff. Colligo Networks makes several SharePoint-centric products for file management and synchronization. Novartis was already using the Colligo Contributor Add-in for Outlook to make it easy to upload and download files through the SharePoint interface and share content through the portal, rather than as email attachments. When he "stumbled over Colligo again" at a SharePoint conference last year, Bosch had just received a request from Novartis' investor relations department for iPad access to documents stored in SharePoint.

While he understood the investor relations team's desire to do more with their iPads, Bosch was also cautious because of the sensitivity of the information they worked with. "We could lose a lot of money if the wrong information is disclosed," he said in an interview.

[ Is it all about Apple? Read BYOD Policy Or Buy Everyone An iPhone. ]

Colligo tested its Colligo Briefcase iPad app against Novartis' requirements, and in the end Bosch was convinced. He had an Ernst & Young consultant run a series of penetration tests on Colligo Briefcase and other file management apps he was considering, including GoodReader, SharePlus, and Aircreek's Filamente. The testing looked both at the apps in normal use and their vulnerability to "jailbreaking" techniques, where an attacker might subvert the iPad's normal hardware and software security.

With the other tested apps, authentication methods could be bypassed and jailbreaking would allow someone to read content directly from the iPad's memory, Bosch said. "But with Colligo Briefcase, he didn't get anywhere." Because the application provides its own encryption, documents in memory were unreadable, even on a jailbroken device.

"When we started looking at the iPad, we realized there were a lot of issues that needed to be resolved to make it a secure environment to put corporate data," Colligo CEO Barry Jinks said. Jailbreaking was one of the items on that list, along with addressing scenarios where an iPad is lost or stolen, or when an employee leaves the company with corporate data stored on his personal device.

Mobile device management software exists to address these issues across a variety of devices, but applications for managing business data must address them, too, Jinks said. These products typically promise the ability to initiate a "remote wipe" that will clean the device of corporate data, but, according to Jinks, "some apps leave remnants of themselves on the device when it's wiped, and there are a lot of apps you can buy in the app store that can't easily be remotely wiped."

Many apps, emphasizing convenience for the user, will also prepopulate the user name and often the password for access to network systems, "which is not very secure if the device gets stolen," Jinks said. "They depend on the keycode locking of the device. We believe there needs to be app-by-app keycode locking."

Bosch said his selection of Colligo Briefcase only applies to the holding company that oversees the firm's international operations and, so far, has only 22 users in investor relations. However, there are another 18,000 iPads in use across the company, he said, so Colligo could have a broader opportunity if other divisions follow its lead.

Follow David F. Carr on Twitter @davidfcarr. The BrainYard is @thebyard and facebook.com/thebyard

The Enterprise 2.0 Conference brings together industry thought leaders to explore the latest innovations in enterprise social software, analytics, and big data tools and technologies. Learn how your business can harness these tools to improve internal business processes and create operational efficiencies. It happens in Boston, June 18-21. Register today!