Cloud, security and the mobile enterprise: An end-to-end manageability challenge

Transcription

1 GreHack th October, Grenoble France Cloud, security and the mobile enterprise: An end-to-end manageability challenge Boris Balacheff Dave Penkler seamless, secure, context-aware experiences for a connected world

2 Outline Enterprise mobility context User requirements IT requirements Tools The Management Challenge Conclusion

3 Enterprise Mobility Context Mobility defined: Mobility of data and applications Consumerization of IT drives technology designed for the consumer market into the enterprise through better price/performance ratios. Not initially designed with enterprise IT in mind Bring Your Own Device personal smartphone, tablets and PC s used for accomplishing work related tasks. Enterprise IT perimeter expanding; Outsourced suppliers: CRM, HCM, cloud services Applications on devices: consumer and partner Multiple access networks Evolving HW, SW and networking technologies RFID, Sensors, Surveillance Increasing challenge to maintain control while embracing progress 3

4 BYOD 4

5 User Requirements Boundary between work, private, family, and home contexts blurring. Access ICT tools for all contexts through appropriate available devices Ease of use Assurance Control over the stuff they own Privacy 5

6 Enterprise IT requirements Manage cost of B2C, B2E and B2B application and data delivery Improve productivity Secure data in motion and at rest Compliance and audit User, Group, Application and device based policy management and enforcement Users can be employees, contractors, partners and customers 6

7 IT Perimeter Client Devices Users Management Private DC Site N Corporate Network Private DC Site 1 Private DC Site 2 Corporate IT Infrastructure VPN Remote Managed Sites Public Internet Unmanaged Sites SaaS Provider SaaS 1 Provider SaaS 1 Providers Provider 1 Provider App 1 Stores Public Cloud 7

8 Client side Enterprise IT tools Mobile device management Protecting content on end-user devices without taking over the device is hard Needs device specific agent with admin rights Functionality Registration / Inventory Configuration management Remote device wipe, lock, pin reset Connectivity control Restrictions: Apps, Camera, screen capture etc Mobile Application Management Container, SDK or wrapper based Container needs large set of permissions Functionality Storage and network encryption Cross app data protection (cut & paste) Access control Auto-disable / wipe when device compromised Usage control: Location, time, duration, connectivity 8

9 Mobile Application Architectures 1. Remote application delivery Application runs on server remote screen on mobile (Thin Client) 2. Server based mobile web applications (web 1.0) Application runs on server uses browser on mobile 3. Client based mobile web applications Developed using HTML5/CSS/JavaScript, runs on client browser or web container 4. Native mobile applications Developed with native SDK, deployed in app store 5. Hybrid mobile applications Combination of 3 and 4: Native / client based web app 6. Container deployed applications Container deployed as native app, contained apps deployed via custom app store 7. Client side virtualisation Applications are deployed into separate virtual machines; VMs managed by deployer 9

10 Infrastructure Tools Enterprise Application Store App screening App mapping App management MDM/MAM VPN Security gateways (BlueCoat, Layer7, ) Policy User management Federated Identity mangement (Ping, Symplified) 10

11 Endpoint security challenge Multi-tenant administration is becoming expected of a client device New devices will support better containerization Enable user to grant IT policy control for just a set of apps, not the entire device Enable one or more stakeholders to manage their own content on a personal device Protection of personal device TCB while respecting each stakeholder needs (personal privacy, IT control, ) 11

12 Management Challenge Feasibility of federated management of extended IT perimeter New Devices with emerging capabilities Enterprise Applications Private and Public app stores Outsourced SaaS applications (CMR, HCM, etc) Public applications User communities covering multiple administrative domains Content security management 12

13 Conclusion Corporate IT landscape expanding Full control not possible in most cases How much control is good enough To maintain control, IT will need to outsource some control Ergo they will need trust relationships with application and content channels Device manufacturers Service providers Carriers One web to rule them all 13

14 Questions?