White Paper. Security: Cortado Corporate Server for BlackBerry. Information on the Cortado infrastructure and Bluetooth printing

Transcription

1 White Paper Security: Cortado Corporate Server for BlackBerry Information on the Cortado infrastructure and Bluetooth printing This white paper provides information about the security of BlackBerry and Cortado Corporate Server, featuring access to the company network, printing, faxing and Present-to-Screen functions. You will learn how secure Cortado Corporate Server for BlackBerry is and what you can do to ensure maximum security. The BlackBerry infrastructure Technical basics Tips for secure server configuration The BlackBerry device Tips for secure BlackBerry configuration Cortado and BlackBerry Note Please note that ThinPrint GmbH has compiled all information and descriptions in this document based on currently accessible information on the treated subjects and based on the current state of the art and assumes no liability for the accuracy of the information. Cortado Explorer Printing with Bluetooth Printing to network printers and faxing Present-to-Screen Tips for secure Cortado configuration

2 Copyright This document is the intellectual property of ThinPrint GmbH. This document may be copied in whole or in part, provided this Copyright notice is included in every copy. Registered Trade Marks All hardware and software names mentioned in this document are the registered trademarks of their respective companies or should be regarded as such. ThinPrint GmbH Alt-Moabit 91 a/b Berlin Germany/ Alemania ThinPrint Pty. Ltd. L 10, 275 Alfred Street North Sydney / NSW / 2060 Australia ThinPrint, Inc Center Ridge Rd, Suite 630 Cleveland, Ohio USA/EEUU ThinPrint, Inc Yates Drive, Suite 200 Westminster, Colorado USA/EEUU info@thinprint.com Web: Issued: July 1, 2008 (v24)

3 Contents Introduction... 4 The BlackBerry infrastructure... 5 The BlackBerry device... 6 BlackBerry and Cortado... 7 Cortado Explorer: Access your company network... 7 Bluetooth printing... 8 Printing to network printers and faxing Present-to-Screen Summary More information Cortado Security White Paper 3

4 Introduction Introduction The security of mobile devices is under continuous debate. In particular, access to company networks from mobile devices, and the transmission of sensitive data via Bluetooth, raises questions about the security of mobile technology. This white paper explains the Cortado Corporate Server for BlackBerry infrastructure from a server and client perspective. When the word BlackBerry is used, it refers to the original BlackBerry smartphone devices from RIM (Research in Motion), not those of third-party manufacturers that also use the BlackBerry Connect technology. RIM, the manufacturer of BlackBerry, places high value on security and in recent years has continued to improve the technology so that the devices are more secure than other mobile phones or PDAs. The Cortado solution fully integrates itself into the BlackBerry menu structure; for example, when you open an , the menu will include the print option. You can then choose whether the text or the attachment is to be printed, whether you want to send a fax, or if you want to see the data on the screen of another device (Present-to-screen). With Cortado Corporate Server, users have the same access as if they were on a normal workstation: access to all network drives, as well as Document Management Systems, SAP Enterprise Portal, and Microsoft Sharepoint. Additionally, Cortado enables the printing of s, attachments and files located in the corporate network via Bluetooth, and network printing, as well as faxing and Present-to-screen. In this white paper you will learn everything about the security aspects of these features. The security of Cortado Corporate Server for BlackBerry greatly depends on the secure configuration of both the server and BlackBerry devices. This white paper offers many useful tips on how to set up a secure BlackBerry and Cortado Corporate Server environment. 4 White Paper Cortado Security

5 The BlackBerry infrastructure The BlackBerry infrastructure If you use a BlackBerry, your company requires a BlackBerry Enterprise Server (BES) with a connection to the mail server. These servers would logically be located behind the company firewall, as depicted in Illus. 1. s sent from the mail server to the BlackBerry are encrypted with 3DES/AES. The encryptions conform to a worldwide recognized security standard. DES and AES (Data Encryption Standard/Advanced Encrypted Standard) is approved in USA, UK and other countries for restricted government data. Illus. 1 MDS channel: 3DES/AES encryption Bluetooth encryption: 128 Bit Illus. 1 BlackBerry architecture, here with Bluetooth printer The encrypted data is sent via the internet to a BlackBerry Network Operation Center (NOC), which is operated by RIM. From the NOC, it is distributed to the various mobile networks, which then send the message to the end device. Data is sent from between BlackBerry Enterprise Server and BlackBerry device through a channel that encrypts each data packet with either 3DES or AES, depending on configuration. The keys are only stored at the end points of this communication, in the customer's area of responsibility. In other words, the keys are only located on the user's own BES on one hand and on the user's end device, the BlackBerry, on the other hand. This guarantees that none of the components involved in the data transfer have access to customer data. All services, such as , PIM 1, and MDS 2 are sent through this secure channel, which is an integral part of the BlackBerry solution from RIM. 1 Personal Information Management: calendar, memo, contacts, etc. 2 Mobile Data Service: enables access to the internet and company server Cortado Security White Paper 5

6 The BlackBerry infrastructure Configuring a secure infrastructure The following tips help you to securely configure your BlackBerry infrastructure. Disable services on the server that are not needed Specify mandatory (group) policies on the server for all BlackBerries (the default IT policy should be the most secure). Prohibit users from installing software Put BES behind a firewall (see Illus. 1) BES: open only the port that is needed for communication with the mail server (port 3101, outgoing connections) The BlackBerry device The biggest security risk for a BlackBerry is certainly when it is lost or stolen. There are various safety precautions for this. Basically, one can say that BlackBerry has achieved a much higher level of security than conventional mobile phones and PDAs. BlackBerry is as vulnerable against mechanical invasion as other devices unless, of course, data was previously deleted by an administrator or local encryption is enabled. Password protection BlackBerry is equipped with a screensaver that can only be disabled with a password (4-14 characters). Easy passwords are not allowed. If the password is incorrectly entered 10 times (default setting), the device will be locked. The administrator can increase or decrease the number of incorrect entries. Password protection is optional and should always be activated. The password itself is not saved on the BlackBerry, but only its hash value; this is saved in the device's flash memory and cannot be read by other applications, such as Java. Remote deletion of all data If a BlackBerry is lost or stolen, all data stored on it can be deleted remotely by overwriting it. This is also possible if the SIM card 3 has been replaced. Encryption of local data Local data (address book, memos, etc.) can be encrypted with AES and therefore additionally protected in case someone acquires direct access to the device. Also the domain password for using Cortado Explorer is encrypted if it is stored locally on the BlackBerry smartphone. Storing the password locally can be disabled by the administrator and this is recommended for higher security. The Cortado Explorer can then only be opened with the password. Cortado security Cortado Corporate Server uses the BlackBerry Enterprise Server architecture (see illustration on Page 5). Print jobs are sent securely via the BES to the BlackBerry smartphone. Due to the innovative streaming technology, the document itself or the complete print job is at no time on the BlackBerry smartphone. Even if the device is lost or stolen, it is impossible to access the documents. 3 Subscriber Identity Module: Smart card in mobile devices to identify the user. 6 White Paper Cortado Security

7 BlackBerry and Cortado Configuring a secure BlackBerry device Set high password protection (maximum length) for local data and change password regularly. Disable the option of storing the domain password on the BlackBerry smartphone. Set encryption for local data (enable content protection). Set the number of incorrect entries for the password before the device is locked. Delete (remotely) all data if the device is lost or stolen. Only use devices of the latest generation (4.1 or later). Protect SIM card with password. Protect the media card (password and/or encryption) Change default device name (BlackBerry8810, for example) to an individual name. BlackBerry and Cortado The Cortado Corporate Server lets you have information available at any time and at any place, all via your BlackBerry smartphone. You can view, copy and paste, print and fax documents (files from your network or attachments) on the spot. Cortado Corporate Server is a client-server based solution, where the server component is installed behind a firewall at the company site (see Illus. 1). The communication between the clients on the BlackBerry smartphones and the Cortado Corporate Server takes place completely through the secure MDS channel. The Cortado Corporate Server does not have any connection to the outside, just internal server connections, to the mail server and to the BES. We will now take a close look at the security of these features. Cortado Explorer: Access your company network The Cortado Explorer enables users to access the company network, for example to transfer and organize files and folders. Together with the flexible output options Cortado Corporate Server offers, the user can work with his BlackBerry smartphone just like he can from the desktop in his office. Security is very important in this mobile scenario. With Cortado Corporate Server, each user has the same rights as he has from his workstation. Cortado Corporate Server reads and uses the rights from the Active Directory, without causing any changes or extensions to it. To access the company network, users use the same domain password that they use at their desktop. User password storage can be centrally enabled or disabled by the administrator. By disabling this option the administrator ensures that loss or theft of BlackBerry smartphones cannot lead to unauthorized access to the company network. Cortado Security White Paper 7

8 BlackBerry and Cortado Users utilizing the Cortado Explorer on their BlackBerry smartphones have the following rights: they can only see folders they would be able to see from their desktop they can only delete files and folders they are also allowed to delete from their desktop they can only use the network printers they are allowed to use in the company network they can only edit documents, they are allowed to edit from their desktop Restricting rights in ADAM As a second level of security, Cortado Corporate Server enables the administrator to restrict the rights for the mobile user, amongst other reasons because working form the BlackBerry is not the same as working from the desktop. This can be especially useful to prevent deleting files by accident. The restrictions are made possible by additional settings in the ADAM (Active Directory Application Mode) from Cortado Corporate Server. On this level it is only possible to restrict rights, not to expand them. The rights in Active Directory stay untouched. For example the following rights can be restricted on the Cortado Server for the mobile users: Deleting files (the right to delete files from the desktop is not touched by this) Bluetooth printing Downloading files from the corporate network to the mobile device Uploading files from the mobile device to the corporate network Sending files from the corporate network as attachments Viewing files from the corporate network with the BlackBerry viewer Mapping of WebDAV Online drives Rights can be restricted for single users, user groups, or for all users. Tip! Cortado Corporate Server features can be selectively installed. Printing, faxing and Present-to-Screen features can be enabled, even if you do not want to use the Cortado Explorer. Bluetooth printing Cortado enables you to print s, attachments or documents from your corporate network via Bluetooth to the next printer. The BlackBerry can connect via Bluetooth to other devices, such as a printer. Bluetooth is a radio link that, unlike infrared, does not require direct line-of-sight. The range varies between Bluetooth devices from 10 to 100 meters ( feet) depending on the radio class. A Blackberry's range is 10 meters (30 feet). Bluetooth devices are categorized into three security modes. BlackBerry supports the highest and safest category 3. In this category, authentication is required when establishing a connection and encryption is available. 8 White Paper Cortado Security

9 BlackBerry and Cortado Frequency hopping Generally, radio communications can be intercepted. The short range makes it more difficult, but so does frequency hopping. Bluetooth sends each transmission through one of 79 radio channels. The channel changes 1,600 times a second and only the two communication partners know which channel is currently being used. If an eavesdropper is listening in, he would have to record all 79 channels. This is possible with special hardware, but time-consuming. Pairing When Bluetooth devices communicate with each other, they first have to link up (pairing). During pairing, keys are created for encrypted data transmission. Each Bluetooth device is equipped with algorithms for authentication and encryption. BlackBerry uses the highest key available on the other device for encryption devices, between 8-bit (minimum) and 128-bit (maximum). Keys are created and exchanged during pairing. Pairing means that a Bluetooth device searches for and displays all other Bluetooth devices within its range. The desired device, such as a printer, is selected from the list. A PIN for the other device (here, the printer) must be entered to establish a connection. Encrypted data transmission applies a symmetric encryption; in other words, sender and recipient both use the same key for encryption and decryption. This key is created during pairing from the following three numbers: Device address (MAC address) A random number PIN of the device to which the connection is established (here, the printer) The user only needs to make a single entry; namely, the PIN. The device uses the PIN and the other two numbers to create a (initially temporary) key, with which data is encrypted and transferred between the paired devices. This key is sent to the target device (here, the printer) during pairing. A BlackBerry can only be paired with devices that have a PIN. Of the above numbers, the PIN is actually the only one that is not radio transmitted. In practice, the BlackBerry user goes to the printer to find out its PIN. A Bluetooth device then only runs the risk of eavesdropping when all three of the following happen simultaneously: is turned on (at the moment) Device is in "discoverable" mode (to communicate with other Bluetooth devices) Device is within the physical range of the attacker (10 meters / 30 feet for BlackBerry) The discoverable status is disabled on the device by default. Printing with Cortado If you want to print, the file is sent from the mail server or from the file server to the Cortado server. The Cortado server creates a print job, compresses it with the Thin- Print technology, and streams it to the BlackBerry. This system uses the MDS channel from RIM, so that the print data follows the same path as communication (see illustration on Page 5). The print data is therefore optimally protected along the way from the server to the end device. Cortado Security White Paper 9

10 BlackBerry and Cortado It is not necessary to download the file to the BlackBerry before printing. Compression and streaming also ensure that the complete print job is never in the air, which adds to the security. Criticism of Bluetooth Security risks are often mentioned in connection with Bluetooth. One issue is that the radio connection, particularly pairing, can be intercepted, giving eavesdroppers access to the keys. Another criticism is that the PIN is often either too short or simple and therefore easily found by trial-and-error. Furthermore, it is considered a weakness that interfering signals can break an open Bluetooth connection and it is then necessary to reenter the PIN, which can then be intercepted. These criticisms can be refuted by proper training, responsible use and careful configuration. Solution 1: Use long PIN Solution 2: 128-bit encryption Solution 3: Pair in a secure environment Solution 4: Prohibit pairing An eavesdropper requires the PIN to tap the connection. "0000" is the default PIN on many devices. This setting should be changed immediately using the longest PIN possible. The PIN may not be so trivial that it is easy to figure out (like or ). If you use a 16-digit PIN, you can be almost certain that a hacker will not figure it out. The key used for transmitting all data is then also secure. BlackBerry supports 128-bit encryption, which is today considered tap-proof. However, not every end device supports this type of encryption. When paired, Bluetooth devices exchange data in the encryption depth. Black- Berry uses the maximum encryption supported by the partner device (printer or Bluetooth adapter). For example, the following Bluetooth adapter use 128-bit encryption: Anycom Blue Printer Adapter PM-400 or HP BT 1300 Bluetooth Adapter. The Pentax PocketJet 3Plus printer supports 56-bit encryption. Be careful only to pair devices in a secure environment, such as in private or company spaces, and never anywhere where there are crowds (trade shows, airports). Because the BlackBerry's Bluetooth interface usually only has a range of 10 meters (30 feet), this is a manageable environment in which you can easily eliminate eavesdroppers. If the connection between paired devices is lost and the PIN has to be reentered, open your ears and check your surroundings. Only pair your device if you are certain that nobody is eavesdropping. Once the devices are paired, the ensuing data traffic cannot be tapped because it is encrypted and the keys are only known to the paired devices. Device pairing can be prohibited in the configuration settings. In practice, the administrator would pair the BlackBerry once with the (portable) printers in a secure environment and then prohibit pairing with other devices. Then you can be certain that your data will not be tapped. In summary, one can say that Bluetooth is secure when the devices are paired in a tap-proof environment and the PIN is sufficiently long. 10 White Paper Cortado Security

11 BlackBerry and Cortado Tips for Bluetooth security Use a long and not trivial PIN (use maximum character length). Only pair the device in a tap-proof environment, not in crowded, public places. Then block pairing for the device (if possible). Permanently saving the partner device in the authentication list is safer than entering the PIN each time. Always disable "discoverable" (it will still be possible to print) Only turn on Bluetooth for as long as necessary. Never connect to unfamiliar devices and ignore unexpected messages and prompts to reenter your PIN. Use printers or Bluetooth adapters that support encryption. Printing to network printers and faxing Printing and faxing without Bluetooth Printing to network printers or sending a fax is possible without a Bluetooth connection. The BlackBerry tells the Cortado server which document is to be faxed or printed. It is not necessary to download the document to the BlackBerry. The Cortado server sends the fax or print job directly to the selected fax machine or network printer. In other words, the BlackBerry initiates the process but the data does not travel through the mobile device; it is sent directly from the server to the printer or fax machine. For printing to network printers, the printers must first be created on the Cortado server. The network printers on the server will then be displayed in the list of available printers on the BlackBerry. Thanks to ThinPrint's technology it is also possible to print to printers in masked networks. If you want to avoid printing via Bluetooth, you can use this method to print to all network printers in your company and all remote offices. This is also possible with SSL encryption 4. Thanks to the open Cortado Corporate Server architecture it is possible to integrate Cortado with third party software systems like tracking and accounting software. This way print jobs could for example be created from the BlackBerry smartphone, then picked up from any network printer with a magnetic swipe card or smart card, and at the same time be tracked (user, document printed, and on which printer the job was run). Present-to-Screen The Present-to-screen function sends files from the company network or attachments from the BlackBerry to a laptop or PC, where they can be viewed in original size. Users can hold presentations via their BlackBerry smartphone by transferring documents to a computer screen in a highly compressed format. With Present-to-Screen, files of any format can now be sent quickly and simply from a BlackBerry smartphone to a notebook or PC screen, even if the user forgot the appropriate file at the office. This allows the user to view documents such as diagrams, blueprints, or complex spreadsheets. 4 Please ask Cortado Support or Consulting for details. Cortado Security White Paper 11

12 Summary The desired document can be selected from the company network with the Cortado Explorer. Only a compressed view of the file is transmitted to the smartphone's SD card 5, also providing opportunities for big savings of up to 80 percent in regard to download time and data transfer. The connection from the smartphone to the notebook or PC is established via USB cable. The file never leaves the smartphone and no footprint will be left on the notebook or PC as soon as the USB cable is disconnected again. This way the data transfer to the smartphone and to the laptop or PC is secure. Summary With conscientious configuration, BlackBerry is secure. Data is sent through the MDS channel from the server and thus is encrypted with a method (3DES/AES) that experts classify as secure. Cortado Corporate Server is a client-server based solution, where the server component is installed behind a firewall at the company site. The communication between the Cortado client on the BlackBerry smartphone and the Cortado Corporate Server also takes place completely through the secure MDS channel. The Cortado Corporate Server does not have any connection to the outside, just internal server connections, to the mail server and BlackBerry Enterprise Server (BES) for example. The use of the Cortado Explorer is password protected. With the Cortado Explorer users can only perform those actions and access those folders, files and network printers that they are allowed to by their rights in Active Directory. As a second layer of security, rights and features can additionally be restricted on the Cortado Corporate Server, for example for deleting, downloading or uploading files from or to the Black- Berry smartphone. This can be done for all users, for user groups and single users. For sending files as attachments, fax and network printing, data is send directly from the Cortado Corporate Server. No data is transferred back to the handheld device. Even if using Bluetooth printing, at no time the document itself or the complete print job are on the BlackBerry smartphone. Thus, even if the device is lost or stolen, it's impossible to access the documents. Bluetooth connections are secure if certain security measures are taken. The BlackBerry smartphone has achieved a much higher level of security than other mobile phones. Locally stored data is password protected and can also be encrypted. In case of loss or theft, all data can be deleted remotely. More information Cortado Corporate Server for BlackBerry: Free demo download, brochures, and manuals at -> Enterprise Solutions -> Cortado Corporate Server for BlackBerry. 5 Secure Digital Memory Card: Smart card for mobile devices. 12 White Paper Cortado Security