How To Protect Your Business Information From Being Stolen From A Cell Phone Or Tablet Device

Transcription

1

2 Page 2 of 14 Securing Critical Corporate Data in a Mobile World

3 Page 3 of 14 Table of Contents 1 Mobile is the New Normal The Critical Importance of Mobile Security Mobile Security Challenges... 5 Security Requirements CWR Mobility Server Security Data Communication Authentication Device Data Management CRM Security Model CWR Mobility Device Security ios (iphone/ipad) Devices... 9 Metadata and Dynamics CRM Data Storage... 9 Settings Storage... 9 Connectivity References BlackBerry Devices Metadata and Dynamics CRM Data Storage Settings Storage Connectivity References Android Devices Metadata and Dynamics CRM Data Storage Settings Storage Connectivity References Windows Phone Devices Metadata and Dynamics CRM Data Storage Password Storage Connectivity References Conclusion: Deploy with Confidence Send Us Feedback on this Document... 14

4 Page 4 of 14 1 Mobile is the New Normal Mobile devices are not new to companies, nor are the need to secure them and the data they contain. What is new, however, is the scale that mobile technologies have reached both in terms of numbers of devices in use as well as the scope of advanced business applications they are now enabling organizations to deploy. This has been driven by a convergence of enabling technologies that are creating pervasive and permanent changes to the business computing landscape: The rapid adoption of next-generation smartphones -- with large screens, compelling new user interfaces, Internet connectivity, and advanced capabilities such as GPS, integrated cameras, and the ability to easily download and run compelling, visual applications 3G and 4G wireless networks, with affordable consumer mobile data plans The rapid global expansion of WiFi hotspots And now, the advent of the wireless Internet tablet These key technologies have converged to create an explosion of mobile device usage -- which has in turn led to a consumerization trend in corporate IT, wherein employees now bring their own devices to work and expect to be able to use them to accomplish their mission. These new technologies offer businesses significant competitive opportunities, but also present new challenges for corporate IT departments. With Customer Relationship Management (CRM) initiatives a competitive priority for many companies, extending the capabilities to employee s mobile devices to get and stay closer to customers is now a top priority. CWR Mobile CRM was designed to enable businesses to capitalize on these technical trends and gain maximum business advantage while addressing the requirements of IT departments to ensure that corporate data remains secure. For business mobile is the new normal. 1.1 The Critical Importance of Mobile Security As organizations across all industries and disciplines evaluate the adoption and deployment of mobile applications for key business needs, the safeguarding of corporate data is an important consideration. CRM data is a critical corporate asset. It often contains comprehensive information about a company s relationships with customers, partners, suppliers, sales data, product and pricing information, as well as information about customers or suppliers that is confidential and may be subject to government regulations. CRM data is highly sensitive for customers and suppliers, and mission critical for your business. Large-scale mobile workforce access to this data across a growing array of mobile

5 Page 5 of 14 devices, often owned by the employees themselves, brings new challenges for securing corporate information. 1.2 Mobile Security Challenges Mobile devices enable field professionals to be highly productive as they travel to various locations such as customer sites, the office, public settings, vacation destinations, airplanes, trains, etc., which creates a number of challenging security scenarios. Lost or misplaced device. A field professional loses their device or accidentally leaves it at customer site. Stolen device. The employee s mobile device is stolen. Hacking. Capture of corporate data transmitted over radio waves by hackers over a cellular network or in a public WiFi hotspot. An employee leaves the company. Since the employee owns their device, IT must have a way to ensure sensitive corporate data can be erased from the device, without having to rely upon the individual to complete this task. An employee upgrades to a new device. The accelerating evolution of mobile devices guarantees that employees will update their personal devices, moving to a newer, more powerful and more functional device. How can a corporate IT department ensure that sensitive corporate data will be erased from the old device and updated on the new device? Proliferation of technology. An organization s workforce uses a diverse mix of mobile devices that comprise different mobile platforms and form factors. Corporate IT is challenged with securing sensitive corporate data, regardless of which type of mobile device and operating system is used to access it. Managing sensitive data access by user roles. Companies need to be able to tailor and limit data access and update rights by individual role. For example, the data that field sales professionals need is different from the needs of field service personnel. 1.3 Security Requirements To address these security challenges CWR Mobility has identified four critical requirements: 1. Users can only view and update data they are authorized to access while mobile. 2. Prevent data from being intercepted during transmissions between server and mobile device regardless of network access used. 3. Prevent data on the device from being accessed or viewed by unauthorized persons or applications. 4. IT can remotely erase data from an unsecured or decommissioned mobile device.

6 Page 6 of 14 With CWR Mobile CRM enterprises can deploy sensitive business information to the field organization with a security protocol designed to address the unique challenges of mobile users.

7 Page 7 of 14 2 CWR Mobility Server Security The CWR Mobile Server software installs alongside the Dynamics CRM server and extends CRM out to mobile devices, providing important system functions including mobile web services, synchronization, security, and server grid operations functions. 2.1 Data Communication CWR Mobile Server provides two layers of protection for data that is exchanged with a mobile device. The first layer is that CWR Mobile CRM supports SSL (Secure Socket Layer). Installing a trusted security certificate on the mobile server ensures that any communication between the mobile device and mobile server is encrypted. This is highly recommended for all CWR Mobile CRM servers and ensures the optimal security for data transmissions. The second layer of protection occurs in the way that CWR Mobile CRM compresses data that is transmitted between the mobile device and server. The data is compressed and obfuscated to eliminate any clear text before being transmitted which ensures that the data is not readable. CWR Mobility data compression and SSL support insures a secure data connection on any network. 2.2 Authentication CWR Mobile CRM provides two methods by which the mobile device can authenticate with the Microsoft Dynamics CRM server: Active Directory (AD) Claims Based Authentication. When a Microsoft Dynamics CRM server is configured for AD Authentication, the CWR Mobile CRM server is configured with Windows Authentication (and possible Basic Authentication depending on which mobile devices are used). The mobile device authenticates with the CWR Mobile CRM which then impersonates the mobile user during all interactions with the Dynamics CRM server. Please note that if AD Authentication is used and Basic Authentication is enabled, you must installed an SSL certificate on the CWR Mobile CRM server to ensure that credentials are encrypted as they are transmitted to the server. When a Microsoft Dynamics CRM server is configured for Claims Based Authentication, the mobile device will authenticate directly with the Claims Based Authentication server and obtain an encrypted authentication ticket that is passed to the CWR Mobile CRM server and used for all interactions with the Dynamics CRM server. CWR Mobility s authentication options insure that only authorized users gain access to sensitive data and that the CRM system is protected from unauthorized access by hackers.

8 Page 8 of Device Data Management CWR Mobile CRM offers two options for device data management. They are Disable User and Wipe User. When the Wipe User option is enabled on the server for a user s device, the CWR Mobile CRM application will delete or wipe the contents of its local data storage the next time the device synchronizes with the server. When the Disable User option is enabled on the server for a user s device, the CWR Mobile CRM application will locked the application the next time the device synchronizes with the server. For added device management features, such as Device Lockdown and Remote Wipe we recommend using a Device Management tool, such as Microsoft System Center Mobile Device Manager for Windows Mobile devices or BlackBerry Enterprise Server (BES) for BlackBerry devices. CWR Mobility s provides the tools to remotely protect sensitive CRM data on unsecured devices. 2.4 CRM Security Model CWR Mobile CRM fully respects the Microsoft Dynamics CRM role based security privileges and access levels, including field level security. The user cannot read data in a CWR Mobile CRM mobile application unless he/she has permission to do so. Neither can the user see or perform actions on that data unless his/her CRM security permission allow. Also Field Level Security settings defined in CRM are respected. CWR Mobile CRM further extends the Dynamics CRM security model by adding a concept called Profiles. Using Profiles, different groups of users can have a customized application with their own set of Forms, Views and Data unique to the mobile experience. CWR Mobility integrates with the Dynamics CRM security settings to insure that mobile users can only access the data specific to their role in the organization.

9 Page 9 of 14 3 CWR Mobility Device Security Smartphones and tablets run CWR Mobile CRM applications developed specifically for each mobile platform to deliver the many benefits of native applications, including working the way users want them to work, superior performance (vs. a web browser-based experience), offline support via a local database so users stay productive regardless of the state of network connectivity, and background synchronization for automatic updates to and from the CRM Mobile Server without user intervention. Device security can be defined in these terms: Metadata and Dynamics CRM Data Settings and Passwords Connectivity Metadata is the information that describes the type of data that will be stored on the device. This includes information about Dynamics CRM entities, fields and relationships. Dynamics CRM data refers to the actual data (list of accounts, contact names, etc) that is retrieved from the Dynamics CRM server. Settings and password storage refers to the values that users enter to initialize the device: URL, organization name, user name, password and domain name. Connectivity refers to how CWR Mobile CRM application handles invalid SSL certificates. This can include expired certificates and certificates with the wrong host name. The following sections describe CWR Mobility s implementation of these terms for each support device and platform. 3.1 ios (iphone/ipad) Devices Please note that CWR Mobile CRM is not icloud enabled. Neither settings, metadata nor Dynamics CRM data are synchronized to Apple s icloud service. Metadata and Dynamics CRM Data Storage All metadata and Dynamics CRM data on an ios device is stored in an encrypted, sandboxed Sqlite database using SQLCipher 256-bit AES encryption. The database is secured with a random encryption key that is stored using the ios Data Protection API. The ios device passcode feature must be enabled in order for the encryption key to be truly secure. For more information, visit the Apple support document referenced below. Settings Storage The user s password, and any other sensitive data, is stored in the secure device key chain. Other settings are stored in the ios NSUserDefaults.

10 Page 10 of 14 Connectivity Invalid SSL certificates are declined by the ios device without prompting the user to accept the certificate. References 3.2 BlackBerry Devices Metadata and Dynamics CRM Data Storage All metadata and Dynamics CRM data on a BlackBerry device is stored in an encrypted, file based Sqlite database using 256-bit AES encryption. The database is secured with a unique device key which ensures that the database file can only be read from the device on which it was created. Database encryption uses the DatabaseSecurityOptions and CodeSigningKey API. Settings Storage All settings are stored using the ControlledAccess API to the BlackBerry Persistent Store which ensures that the password can only be read from the CWR Mobile CRM application. Connectivity The BlackBerry device will prompt the user to accept or decline connections with invalid SSL certificates. References atabasesecurityoptions.html esigningkey.html 3.3 Android Devices Metadata and Dynamics CRM Data Storage All metadata and Dynamics CRM data on an Android device is stored in an encrypted, sandboxed Sqlite database using SQLCipher 256-bit AES encryption. The database is secured with a random encryption key that is in an encrypted file using 256-bit AES encryption and secured with the user s password.

11 Page 11 of 14 Settings Storage The user s password is not stored on the device and is required to be entered each time the user starts the CWR Mobile CRM application. All other settings are stored along with the database encryption key in an encrypted file using 256-bit AES encryption and secured with the user s password. Connectivity The CWR Mobile CRM application will prompt the user to accept or decline connections with invalid SSL certificates due to issues such as an expired certificate or an untrusted source. The application remembers this setting until the user reinitializes. The CWR Mobile CRM application will reject connections with invalid SSL certificates due to an invalid hostname. Please note that Android 2.2 devices have an outdated list of certificates which leads to prompting the user about an invalid certificate even though it shouldn t be necessary. When the user accepts the certificate, it will be stored on the device. References Windows Phone Devices Metadata and Dynamics CRM Data Storage All metadata and a small subset of CRM data, such as organization settings, user settings, currencies, and the current systemuser record on a Windows Phone 7 device is stored in the IsolatedStorage sandbox which is only accessible by the CWR Mobile CRM application. Password Storage The password is stored encrypted in the IsolatedStorageSettings using the ProtectedData API. For more information, see the References. Connectivity Invalid SSL certificates are declined by the Windows Phone device without prompting the user to accept the certificate. References

12 Page 12 of 14

13 Page 13 of 14 4 Conclusion: Deploy with Confidence As business models evolve to deliver more value to customers, partners, and constitutes by engaging them anywhere and anytime, mobile technology securely integrated into the enterprise infrastructure becomes a critical strategy. The rapidly evolving landscape of networks and mobile devices offers creative new modes to deliver value but at the cost of added complexity and risk. CWR Mobility delivers a complete mobile solution that: Incorporates multiple levels of device and network security Insures users can only access authorized data Provides tools to prevent data access unsecured devices For business, mobile is the new normal, and with CWR Mobility, you can deploy sensitive information access with confidence.

14 Page 14 of 14 Send Us Feedback on this Document We listen closely to feedback from our customers and partners, and we d like to know how well this document met your needs as well as any ways that you would like to see it improved. You can quickly and easily provide this feedback via our website at This document is for informational purposes only. CWR Mobility BV MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Copyright CWR Mobility BV. All rights reserved. The Power of Close is a registered trademark of CWR Mobility BV. Microsoft, Windows and Microsoft Dynamics are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Apple, iphone and ipad are trademarks of Apple Inc., registered in the U.S. and other countries. The Trademark BlackBerry is owned by Research In Motion Limited and is registered in the United States and may be pending or registered in other countries. CWR Mobility BV is not endorsed, sponsored, affiliated with or otherwise authorized by Research In Motion Limited. Android is a trademark of Google Inc. Use of this trademark is subject to Google Permissions. Other trademarks held by their respective owners and/or its suppliers.