Speaking of Security – The RSA Blog and Podcast

It’s a common question around here: Who holds the most power in the mobile infrastructure? The carrier? The handset makers? The OS providers? Security is by its nature an add-on service, something that often is piggybacked on other more top-of-mind services, so whenever you try to sell security in the mobile space you always come to that golden question: Who owns the most customer mindshare on the mobile device?

Clearly in the past it was the mobile carrier. Phones were essentially customized at will by the carrier and they were able to control much of the service pipeline related to that mobile user. The first real blow to that environment was RIM with the Blackberry. RIM’s architecture allowed them to act as an intermediary on the network and provide a number of business and security-related services to enterprise customers. For this, service enterprises paid large amounts in data fees to carriers, who passed some of that along to RIM for paving the way. Then along came Apple, who as they usually do, flipped the model on its side by not allowing the carrier any access to customize their device. Apple would be in charge of everything on the phone, especially which applications and services are exposed to the user. As we know, that model became pretty popular, and the carriers have never been the same since.

But Apple doesn’t control the entire world (I think). It’s worth taking a look at a few layers to see who really has the advantage in a mobile world.

Applications

Applications make the mobile world go round. The vast popularity of smartphones lies in their ability to run applications well. Even the Blackberry became popular because of its delivery of an application near and dear to every enterprise user: email. Mobile carriers like to tell you they own a portion of the application ecosystem. And they do, it’s just a small, insignificant portion. First off, they aren’t even allowed to host app stores for iOS devices. Second, even in areas where they are (like Android), they are well behind the Android Market and other third party application marketplaces like Amazon. Customers just don’t think to go to the carrier for applications anymore, which is a bit surprising since only five years ago they were the only place you could go. So even though carriers have the ability to pre-load their own apps as Android devices walk out the door, the first thing most users do is toss those apps aside and download the coolest thing from the Android Market. Advantage: OS Providers (Apple, Google, Microsoft)

Hardware

A lot of things can’t be done without access to the hardware of the device. As much as we rely on our devices for multi-purpose use, they still are phones and providing a true rich application experience on them requires special knowledge of optimizing the hardware. In addition, layering in certain value-added services like mobile payments or security requires some ownership of the underlying hardware. The chip manufacturers certainly have an advantage here, since they can begin to layer in a number of features directly into the chips (especially security: see Intel and McAfee), but the carriers also have a footprint by having some input over specific device characteristics. Unfortunately for them, that footprint is rapidly eroding as well. Apple already owns the entire hardware pipeline as I mentioned before, and I have to imagine Google will start going down that path with the acquisition of Motorola. Sooner or later Microsoft will make a big move (above and beyond their partnership with Nokia) in the mobile hardware space if they start to see traction with their mobile strategy. Again, I’m afraid the carriers are losing ground. Advantage: Apple and Google

 Network

This is where the magic happens for the carrier. There is one true differentiator that no one else can touch in this space, and that’s the fact that the carrier owns the data network around these devices, and the more they get used for things other than voice the more strategically important that network becomes. Enterprisecustomers are becoming increasingly reliant on mobile networks for business use, which drives up the value of the carriers themselves and also gives them access to all sorts of data about user patterns and behavior. Google has certainly become successful leveraging data like this. The problem for the carriers is that they have certain regulations restricting their use of subscriber data, which limits their overall capability in this space. Either way, since they own the pipe they have the ability to layer in a number of services that are traditionally provided by the enterprise network (especially security). All of this becomes even more critical now that Blackberry is falling out of favor and enterprise users are no longer going through RIM’s secure NOC for access to data. Advantage: Carriers.

Bottom line: Carriers are scrambling a bit because they have lost a ton of user mindshare in the smartphone space. OS vendors like Apple, Google, and Microsoft are much better positioned to offer and monetize services to end customers without carrier involvement. However, in the enterprise space, the network is a critical enforcement point, and I fully expect the mobile carriers to leverage their footprint here more and more in the future.

•