Securing the Mobile Enterprise. How mobile devices, BYOD and other trends are driving a need for a new approach to mobile security

Transcription

1 Securing the Mobile Enterprise How mobile devices, BYOD and other trends are driving a need for a new approach to mobile security

2 Table of Contents Securing and Managing the Mobile Enterprise... 3 Introduction... 3 A New Era of Productivity... 4 Emerging mobile-centric workforce... 4 An onslaught of new devices... 4 The end of 9-to-5 work day... 4 Outdated security model... 5 The larger challenge for IT... 6 Managing Events not devices... 6 Conclusion... 8 About Sequitur Labs Inc.... 8

3 Securing and Managing the Mobile Enterprise Mobility, cloud computing and connectedness are changing the equation for how IT needs to think about managing the enterprise. The current model of securing enterprise information assets is not likely to work in supporting mobility driven productivity. This paper lays out a new direction of how enterprise, carriers and device manufacturers need to think about securing and managing the mobile enterprise. Prevailing mobile security and management capabilities are rooted in concepts two decades old. These old-fashioned controls are device-centric, static and inflexible, and they are part of a management model where only the IT department has a voice. The market requires a new approach to meet future challenges. Dynamic, activity-based management of mobile devices is essential while the mobile device market continues to evolve ever more rapidly. Controls must be more flexible and fine-grained to manage discrete events as the changing circumstances of user and usage context require; controls need enhanced ability to react automatically to increased risk as new threats are detected in real time. The management model must become more resilient; it needs to accommodate a mobile ecosystem is increasingly complex with numerous parties weighing in on how a device may be used; it needs to be able to adapt readily to new usage requirements. Introduction Enterprise computing has been dominated by PCs, PC applications and Client/Serverbased solutions. The transition to a mobile enterprise began decades ago with the introduction of laptops and notebooks and has accelerated with the introduction of tablets and smartphones. Given the rising computing power of mobile devices, many now believe we have entered the post-pc era of enterprise computing. Historically, enterprises have been slow to change their IT infrastructure, and often the change has been driven by rogue elements within the organization typically employees using new devices and technologies to improve their own productivity. Continual lowering of prices for new technologies has accelerated their use in enterprise environments. This same behavior has led to the rapid penetration of smartphones and tablets.

4 A New Era of Productivity In the past, employees adopting new technologies remained subject to enterprise IT rules because productivity was a function of tightly-controlled access to enterprise information assets. The advent of cloud-based services and mobile applications has redefined what it means to be productive. Employees now depend upon being able to consume services from both inside and outside the corporate firewalls. Consider for example a field service technician planning his day. While his daily appointments might be delivered to his mobile device through an enterprise CRM application, other services such as route mapping, appointment settings, access to third Source: CIO Magazine 2013 party service manuals depends upon external applications and sources of information. These are likely delivered by native apps on the device or by cloud-based applications accessed through the device, many of which are not certified or controlled by the enterprise. Nonetheless, they are necessary to make the employee productive. Three other phenomena characterize this change in productivity. 1. Emerging mobile-centric workforce Additionally, there is an entire generation of workers entering the workforce that has grown up with mobile devices that are central to its daily personal and professional lives. Workers are unlikely to look kindly upon attempts to limit or restrict the use of these devices. Indeed, a survey conducted by network security provider Fortinet found that over half are prepared to resist such policies. 2. An onslaught of new devices, including wearables Smartphones and tablets are just the tip of the iceberg in terms of the types of mobiles devices that will enter the workplace over the next decade. Samsung and Qualcomm have introduced smart watches that In a survey of 3,200 employees from Generation Y (ages 21 to 32), researchers found that 51% were prepared to contravene any policy banning the use of personal devices at work or for work purposes act as a second screen for accessing information. Google Glass represents another type of device with the potential to change how workers consume information. These devices will not only integrate data from enterprise systems but also from consumer applications, further blurring the line between work and personal life. 3. End of the 9-to-5 workday For most information workers, work time has already stretched beyond the traditional work day. What we are referring to here, however, is not just extending the work day, but the seamless blending of personal and work activities caused by the mixing of personal and work-related information accessed through a variety of devices. The smartphone or tablet used to manage meetings is also the same device used to manage doctor s appointments or plan vacations. This ability drives employees to insist on using the same device for both purposes and indeed has led to the BYOD movement (Bring Your Own Device).

5 Nevertheless, enterprise IT managers must still ensure that corporate assets are secure. However, enterprise policies focused on preventing or limiting access also, by extension, hamper productivity. In light of the above realities, how can an enterprise IT leader address this challenge? There are two fundamental aspects about enterprise mobility that must be accepted: Mobility is a tool to transform the enterprise by ushering in a higher level of productivity and business agility; Mobility is about people, not devices. Current security model is outdated The present state of mobile security and device management embodies an approach based on a model popularized by RIM. The model is based on locking down a mobile device similar to the way a corporate-owned PC would be restricted. This approach worked when the mobile phone was given to the employee in the way that a PC was given to the employee. It was fine when, as described above, productivity was a function of access to corporate information only. The key characteristics of this model are: The IT department sets the policies; Policies are created to maximize protection, not productivity; Policies ignore the nuances of individual worker roles and responsibilities; Policies are set as defined by a mobile management solution and are the same regardless of type of company, type of industry; Policies ignore the context in which devices are being used; Policies are device-centric and become active when they are pushed to the device; they are static until new policies are pushed to the device. This approach worked in 1999 but not in the future. Consider the following example. A new employee starts a new job at a company. The company has a BYOD program; in order to participate and receive reimbursement, the employee must agree to the company s terms that state the company will add an application to the phone that: 1. Shuts the camera off to prevent use when the employee is in the office; 2. Prevents the use of social applications; 3. Prevents the use of a browser. The employee wants to use his new phone so he agrees to the policy. The above policies now apply to his phone. The employee goes to a supplier s office to evaluate a new design for a part. He wants to share a picture of the part with his manager and share a web page describing the benefits of using the

6 new part. However, his camera and browser no longer work because the static security policy is not responsive to the fact that his situation has changed. Back in the office, he learns of his company s newest product. He wants to tweet about it to get the word out but is unable to do so since all social media applications were disabled. The employee goes from work to his daughter s piano recital. He attempts to take a video and share it on Facebook but is unable to because the camera is still disabled. Indeed, the above functions will work only if IT manually pushes policies to the phone that enables them. To be fair, some applications do allow adjusting their policies by time or by location but this approach is still heavy handed enough to negatively impact a worker s productivity. Some applications implement a virtual phone on the device or implement multiple profiles. But this multiple-persona approach directly conflicts with employees needs to be able to manage personal and professional times and activities. Besides, why should some IT manager decide what your work personality should be? At a time when enterprises demand out-of-the-box thinking, why put the employee in a box in the first place? The larger challenge for IT In addition to the challenge of reconciling conflicting employee productivity and enterprise security needs, enterprise IT managers face another very real challenge to the influx of many employee-owned devices in the workplace, including wearable smart devices. The workplace of the near future will involve sensors and information analysis that will adapt work environments to workers needs. Very real questions facing IT include: 1. How are these devices interacting with information systems and the network architecture? 2. What is the context in which these devices are operating and how is the context changing? 3. What is happening on the device that may threaten enterprise assets? IT departments must look holistically at enterprise security rather than looking at mobile and fixed infrastructure assets as distinct entities and problems to be managed. The key is to look at enterprise mobile and network events and how they impact each other. Managing events not devices The changes highlighted above make manageability of these devices a key priority. However, in order to achieve this manageability. IT must look at several dynamic factors. Specifically, IT must consider three aspects: 1. The role of the user; 2. The context in which the device is being used;

7 Benefits 3. Usage patterns of the device itself. User Role Context Device Usage Who is the authenticated user? What is the user s job role/security level/dept./office location? What are the audit requirements for the attempted action? Other enterprise-definable factors. What is the network connection status? What is the time of day? What is the location? Is the device connected to the corporate VPN? What application is running? What is the classification of the app performing the action? What action is being attempted? What resource is being accessed? What is the sensitivity of the resource being accessed? Is root or the attainment of root involved? Manage EVENTS not devices Better protection against malware and viruses Support multiple user authentication methods Smarter app and data protection Handle nearly limitless use cases Gather usage intelligence for reporting Device and OS agnostic Rapidly address changing compliance requirements Map policies to support business needs Each of the above three points include (A) additional questions that must be answered and (B) data taken into consideration so that the appropriate policy decision can be made. It begins with implementing a framework that is able to sense, intercept and understand the nature of the events happening on devices, to understand the environment the device is in to take into consideration those aspects of the user that can maximize productivity and to identify new threats and adapt in real time. Let s apply this thinking to the earlier example of the new employee joining the company. When discrete events are managed not devices IT can create a fine-grained set of policies that 1. Disable the camera while in the office but allow its use when at the supplier s office; 2. Disallow use of social applications only in the office; 3. Allow use of the camera only at home. Note that the IT department is involved only at the time of defining the policies. The business requirements are modeled in the policies, and the events are dynamically controlled as the employee s situation changes. This ability to dynamically adjust depending upon the user, the context and the event is critical to being able to manage a large and diverse set of devices. Managing events enables far more granular management of devices. In fact making event-centric management a lynchpin of security strategy creates a foundation that allows IT departments to look at the entire network of connected devices in a holistic way. Some specific benefits of event centric security enforcement include: 1. Dynamical enforcement of security policy according to the context of the user and device; 2. More effective balancing of the interests of multiple parties in an increasingly complex mobile ecosystem;

8 3. Greater degree of policy flexibility and ability to meet unique enterprise requirements more precisely; 4. Superior adaptability to new usage requirements in the future; 5. Ability to finely map a set of policies to organizational hierarchy with the focus being on maintaining and enhancing mobile productivity; 6. Ability to author an industry-wide, company-wide or geographically-based (for multinationals) set of best practice policies; 7. Gaining fine-grained intelligence regarding device usage and its effect on other network devices. For example, which device and which application were responsible for a malware attack? Conclusion The productivity equation is rapidly evolving with the sudden rise of mobile devices, particularly as trends like BYOD gain popularity. These devices used for both personal and work-related purposes are challenging existing notions and paradigms of security. The rapid evolution and sheer diversity of devices, some of which are yet to come, pose unknown risks and will cause the failure of old-fashioned security and management solutions. A new approach is required to manage these devices and secure the enterprise. Managing events on devices offers a more elegant and scalable approach than locking down devices and reducing functionality. Understanding both the context in which the device is being used as well as the role of the user and their productivity needs allows policies to be written so that that device functionality is available when needed. Only then can we fully realize the productivity gains of an agile, mobile enterprise. About Sequitur Labs Inc. Sequitur Labs was incorporated in 2010 and is led by industry veterans with deep roots in telecom-grade networking and in security. Sequitur s vision is to create a leading-edge platform for securing a world of connected devices Sequitur Labs Inc. All rights reserved. Sequitur Labs, the Sequitur Labs logo and DeadBolt are among the trademarks or registered trademarks owned by or licensed to Sequitur Labs, Inc. All other marks are the property of their respective owners.