A Model To Measure The Maturity Of Smartphone Security At Software Consultancies

A MODEL TO MEASURE THE MATURITY OF SMARTPHONE SECURITY AT SOFTWARE CONSULTANCIES
By Mr. Sean Allam Dissertation submitted in fulfilment of the requirements for the degree Master of Commerce in Information Systems in the Faculty of Management and Commerce of the University of Fort Hare December 2009 Supervisor: Prof. Stephen Flowerday

i

Abstract
Smartphones are proliferating intothe workplace at an ever-increasing rate, similarly the threats that they pose is increasing. In an era of constant connectivity and availability, information is freed up of constraints of time and place. This research project delves into the risks introduced by smartphones, and through multiple cases studies, a maturity measurement model is formulated. The model is based on recommendationsfrom two leading information security frameworks, the COBIT 4.1 framework and ISO27002 code of practice. Ultimately, a combination of smartphone specific risks are integrated with key control recommendations, in providing a set of key measurable security maturity components. The subjective opinions of case study respondents are considered a key component in achieving a solution. Thesolution addresses the concerns of not only policy makers, but also the employees subjected to the security policies. Nurturing security awareness into organisational culture through reinforcement and employee acceptance is highlighted in this research project. Software consultancies can use this model to mitigate risks, while harnessing the potential strategic advantages of mobile computingthrough smartphone devices. In addition, this research project identifies the critical components of a smartphone security solution. As a result, a model is provided for software consultancies due to the intense reliance on information within these types of organisations. The model can be effectively applied to any information intensive organisation.

ii

Declaration
I, Mr. Sean AndrewAllam, hereby declare that:    The work in this dissertation is my own work. All sources used or referred to have been documented and recognised. This dissertation has not previously been submitted in full or partial fulfilment of the requirements for an equivalent or higher qualification at any other recognised educational institution.

____________________ Mr. Sean Andrew Allam

iiiAcknowledgements
I would like to acknowledge various individuals and organisations for all the support shown throughout this project. Without their support, this research project would never have materialised. I would like to thank my supervisor, Professor Stephen Flowerday, for the advice, encouragement, guidance and words of wisdom whenever I required them. I would like to extend mygratitude to the University of Fort Hare, Department of Information Systems for the support it has provided me with through the duration of my academic career. I would like to extend special mention to my fellow students for their advice and support. I would like to acknowledge the University of Fort Hare and its associated research body, The Govan Mbeki Research and Development Centre, forthe financial support that they provided to me throughout this research project. I would also wish to thank the university library and its staff for their support. I would like to thank each of the respondents who took the time out of their busy schedules to participate in this research project. Finally, I would like to thank my family, my girlfriend and my friends for the understanding andsupport shown to me through this time consuming endeavour. Sean Allam

iv

Table of contents
Abstract ........................................................................................................................... ii Declaration ..................................................................................................................... iii Acknowledgements...