How to Avoid Data Leakage from Mobile Enterprise Apps:

Transcription

1 White paper How to Avoid Data Leakage from Mobile Enterprise Apps: Use the Cloud

2 OVerVieW One of the biggest challenges facing IT today is the inherent insecurity of mobile devices now being used by the enterprise, either because of new corporate mobile-enabled applications or because of BYOD. This paper will examine the opportunity for enterprises to use public or private cloud offerings, together with some Framehawk technology, to deliver an architecture that can solve the problem of data leakage from mobile devices. BaCKGrOUND increasingly wider network access (location and cellular). And, there are major forces at work driving It started with the simple existence and popularity of tablets and smartphones. These new devices and form factors have changed the demands of users. Users want to engage enterprise applications via And these devices are on mobile networks and home networks more often than they are on secure corporate networks. Compounding things tremendously are two predictable but new trends: 1) Employees (and, frankly, everyone else) use their devices in bite-sized engagements, all day long. Consumer app access (news, social) via these devices has encroached from casual or after-hours access into 24x7 demand 2) BYOD - Bring Your Own Device In many ways, BYOD is a response to the consumer-style behavior noted above if a user wants 24x7 access to their news and social networks, then access to enterprise applications becomes a viable corporate networks and they are rarely as controlled or locked down as corporate-issued laptops. These forces are driving a sea change in the way that enterprises have to think about protecting corporate information. These forces are also changing the requirements for a scalable, secure architecture (and infrastructure) for corporate applications in this new mobile-friendly world where not everything is under corporate control. the ChaLLeNGe If corporate data leakage is a primary concern, then standard native application options, such as the on them provide too many ways for data to be exposed. then this immediately pops up as one of the options. Data moved there is instantly in the public uncommon to see 15 options to move data around, as every service can easily be a target location. 2

3 Note that this scenario is true regardless of whether the user got the to their phone via direct (sanctioned) or indirect (unsanctioned forwarding of to a personal account) mechanisms. Compounding this, web applications can also be problematic. Accessing web applications behind the the device then have access.. This issue is not solved by having corporate-issued devices. A recently published Osterman Research article shows that only 54% of company-owned tablets can be remotely wiped. Furthermore most of these devices cannot run the bevy of intrusion detection, edge-point analysis, and anti-virus software previously required in the world of laptops and home-based desktops mobile operating systems. So the browser often needs to run in a container (see below for more on this issue), which can introduce performance and more compatibility problems. In all cases, a device ends up with corporate data cached on it. , web browser caches, downloaded data leakage potential. Being able to wipe the device is only useful if the device shows up on the network again. the realistic OptiONS So if having corporate data on the device is not a desirable outcome, then there are only two realistic options: 1. Solve-the-problem: 2. Mitigate-risk-with-controls: Protect any data that is on the end-point device. Option #1 has never been accepted by the employee population for daily usage. Current approaches to Current approaches result in poor user experience (UX). Poor UX results in high attrition, low adoption, and high costs. UX issues include complicated interfaces, poor performance, and non-functioning gestures. As a result, this model is often relegated to disaster recovery or temporary at-home access. models For option #2, mitigate risk with controls, approaches usually include some or all of the following: Good for Enterprise (or equivalent) Secure Container 3

4 want their company to have complete control, including wipe ability, over their personal devices. device and app lockdown measures are put in place. Client Good for Enterprise The premise is simple: if you need to get access to corporate apps and data behind the on the device. So even with a corporate owned device, there are many, many apps that come from untrusted or questionable sources, so data leakage prevention is by no means guaranteed. GfE provides a secure solution that allows enterprises to have a Blackberry-like security model for other mobile platforms. recommended way to access corporate web applications. applications, typically in conjunction with an enterprise app store. either by using an SDK and building the security into the application itself, or by platform (ios, Android, Windows 8, etc.) Secure Container A secure container on the device enables applications to be deployed in the container and then run in a secure environment.there are a few challenges typically associated with secure containers, including: Deployment and management of a secure container may not be possible in many BYOD scenarios Compatibility and usability of the secure browsers used (device browsers are limited compared to their counterparts. No plugins. Webkit differences. Etc) There is no support for legacy applications 4

5 Summary: any time you enable your corporate application software to be accessed from an inherently insecure device that is easily lost, the costs of developing secure applications and managing the risk of lost devices is very high. how the CLOUD CaN help With enterprise MOBiLitY Distributing client applications to insecure devices outside the corporate campus creates compounded costs in multiple forms: Risk and mitigating control processes and technology Distribution management systems Application fracturing across devices multiple versions or reduced feature set Redesign and regression testing to handle tuning over non-managed networks. Said another way: implementing mobility costs a lot. Adding a new end point outside campus control regardless of whether the asset is owned by IT or by the employee creates a mess that is costly to manage: Dealing with these complications is where the idea of leveraging cloud computing has appeal. 5

6 As an alternative, consider (for a starting point) that all of the client applications could run from a highly performant B2B cloud a single place where control and distribution are easy. This would mean no asset management challenges and enable the use of familiar server technology. There would be environment. Of course, for cloud computing to be a viable solution for mobile application access as described here, there are a number of other issues that need to be managed and pre-requisites that need to be in place. Consider the following logic: IF (trusted communication exists between cloud and data center) AND (cloud is secure) AND (secure communications exist between cloud and mobile device) THEN (cloud is suitable for deploying corporate mobile apps) 1. CLOUD-TO-DATA CENTER COMMUNICATIONS Securing a cloud environment communication structure is straightforward. Leveraging standard partner access techniques, B2B designs, or co-location facility access are skills that IT network professionals have done for many years. leased lines are all viable and trusted models. 6

7 2. CLOUD SECURITY This is a hot topic. Cloud vendors ranging from Amazon Private Network clouds. These are clouds that have both A number of vendors even allow dedicated server versions, enabling even more control for a price. In the old days of networking, the same discussion about the telecom space all private lit lines are shared. Today no one thinks twice about it. 3. SECURE CLOUD-TO-MOBILE COMMUNICATIONS Basic secure communications to mobile devices are available. Secure tunnels, encrypted data streams, and authentication cloud computers to run the software client, you will generally use a terminal services offering. apart a computer. On a laptop or desktop, the keyboard, mouse, and monitor (also known as the primary components of the User Interface (ClientUI )) talk directly to the OS (ClientApp) Thus an application client is two pieces: ClientUI + ClientApp 7

8 With terminal services, the application (ClientApp) executes on a big server and then you connect the Secure terminal services (similar to dumb terminals, but smarter) have been around and are secure by 8

9 IF THE CLOUD CAN HANDLE THE SECURITY ISSUES, HOW DO YOU DELIVER A QUALITY USER EXPERIENCE? What we have essentially discussed is how a cloud-based application hosting style approach can be scenario #1 (solve-the-problem), the issues were the poor performance and poor usability. the eureka MOMeNt: it S about the protocol Introducing Framehawk Improving Performance IF (trusted communication exists between cloud and data center) AND (cloud is secure) AND (secure communications exist between cloud and mobile device) AND (performant communications exist between cloud and mobile device) THEN (cloud is suitable for deploying corporate mobile apps) To be really effective, the high-speed communications between the mobile device and the cloud need to be able to work in low-bandwidth and unreliable network scenarios (e.g. 3G). campus networks. These networks have plenty of bandwidth and low latency. They are generally in varying levels of degradation. Generally, they are useful for the occasional access model, but are Solution: If we can use technology control planes from halfway around the planet, and can talk solve the performance problem, Framehawk created its own communications protocol called the Lightweight Framebuffer Protocol (LFP), which works with the laws of physics better by leveraging some advanced mathematics. a patented new architecture that was developed by former NASA programmers with the goal of 15,000 mile performant communication mobile carriers with devices chipset. 9

10 DeLiVeriNG Great MOBiLe USaBiLitY Solving the performance problem for mobile devices is still not enough. Delivering applications that are not designed for mobile at high speed can leave you with a high-speed but poor user experience. So to complete our logic, we need one more requirement: IF (trusted communication exists between cloud and data center) AND (cloud is secure) AND (secure communications exist between cloud and mobile device) AND (performant communications exist between cloud and mobile device) AND (the user experience can be optimized) THEN (cloud is suitable for deploying corporate mobile apps) Optimizing the user experience where the applications are accessed via the cloud requires a few different techniques: Direct UI improvements areas where the customer interacts with the application A way to engage multiple legacy applications simultaneously while keeping them protected from each other Allow different classes of services to safely be interacted with. legacy mash-ups, extending these cloud-based techniques. A way to integrate legacy applications as desired UI Improvements for the terminal service genre requires gesture and sensor conversion that is device contextual while allowing the user to interact naturally. Additionally, screen size optimizations for scale and aspect ratio need to occur since devices range from 4:3 to 16:9 and everything in between. Framehawk has developed a system of translation to enable any devices (current and future, regardless of form factor) to work with any Framehawk-powered cloud service. enables different classes of applications to be used regardless of origin. This enables an employee productivity workspace to be created and assembled instantly from Internet and private data center sources, without fear of data leakage across those services or to the native device apps as well. This solution protects against the Dropbox example mentioned earlier. 10

11 Framehawk was engineered from the start to enable this protection. See below: BriNGiNG together MOBiLe SeCUritY, performance, and USaBiLitY Putting it altogether requires a secure cloud, secure transmission, and a secure endpoint. And, to make it usable to your users, a natural gesture translation system needs to overlay the communication infrastructure. All of these techniques are available today, with Framehawk. Framehawk has the full platform to work with your enterprise or enterprise partners. With Framehawk, you: Do get in the market today with mobile access to enterprise applications and satisfy your employee and customer needs Do leverage cloud economics to create rich application services Do focus your efforts Do keep your data secure without worry about user behaviors with their devices 11

12 Application opportunities addressed here today: Leveraging the basic techniques above, there are several different application scenarios that should be considered. For general productivity apps in BYOD scenarios For existing legacy applications For existing web applications For all of these situations, the Framehawk Canvas is available today. mash-ups for dynamic and immersive mobile device applications. SUMMarY The possibility of data leakage from mobile devices is one of many challenges that IT organizations are facing with the BYOD phenomenon and the move to the next-generation, mobilized enterprise. Perhaps secure architecture and application delivery capability such as the Framehawk Platform is used. For additional information about the Framehawk Platform, visit our website or contact us directly. CONtaCt US: Phone: Framehawk, Inc. San Francisco, CA Framehawk, Inc. All rights reserved. Framehawk, Framehawk Canvas, Framehawk Cloud, Framehawk Lightweight Framebuffer Protocol, Framehawk Platform, and Framehawk Software Development Kit, and Framehawk Studio are trademarks of Framehawk, Inc. 12