Mobile Mobile Security COPYRIGHT 2014 INTUITION ALL RIGHTS RESERVED. Copyright 2014 Intuition

Transcription

1 Mobile Mobile Security COPYRIGHT 2014 INTUITION ALL RIGHTS RESERVED 1

2 Background Traditionally, security has not been a high priority for e-learning; as such content was hosted and only accessible at the organization s office, behind an enterprise firewall and/or was primarily non-proprietary or confidential in nature, such as regulatory compliance. The increasing popularity of mobile learning is rapidly changing how and where we learn, which, in turn, changes the content both in instructional design and around sensitivity and confidentiality. Business need Expectations from an increasingly mobile workforce are forcing organizations to empower their employees through Bring Your Own Device (BYOD) programs that aim to facilitate personal devices for work purposes. Employees are content they don t have to carry around multiple mobile devices and feel connected to the office. Companies are satisfied as this practice reduces cost and increases productivity levels of the workforce. However, this growing trend introduces less secure mobile devices with access to sensitive corporate information, and enterprise IT. As organizations apply policies less rigorously on isolation, their Information Security departments are starting to enforce strict Acceptable Use and Security policies on what content personal mobile devices have access to in an effort to protect against device data theft. Intuition s technology solutions, including the Rubicon Mobile Learning Platform strive to maintain customer proprietary information and content secure in our cloud-based servers, on the employee device, and as data travels over the air to and from the mobile devices. Intuition administration tools provide a Central Control enabling organizations to keep their content, data, and information secure at all potential points of vulnerability. Central Control s in-on-over approach to keeping critical information and data secure and protected is described in the following sections of this document. Intuition statement of security Intuition only employs the best industry practices for both security and performance. Network performance, network security and customer support are three vital areas of our business and, as such, Intuition has implemented a rigorous system of checklists and developed a comprehensive set of criteria for ensuring that the four primary objectives of any high performance Data Centre (security, availability, scalability and manageability) are achieved. All of these practices are covered by the company s ISO 9001 accreditation. Intuition implements various security techniques to provide multiple layers of protection against intrusion incidents and events. We use industry standard security controls such as physical, electronic and procedural safeguards, including data encryption and Secure Sockets Layer (SSL) technology. We also update and test our technology infrastructure regularly to maintain and improve the protection of our customers' information and data. Our Data Center is governed by SSAE-16 and ISO Information Security Management (pending) standards, which provides data retention and restricted access rights to sensitive customer data. Definitions HTTPS: HyperText Transfer Protocol Secure sockets provide encrypted communication between the MLP servers and apps that run on all activated mobile devices. LMS: Learning Management System a platform which manages learning, including hosting e-learning courses and enables users to login, launch and track elearning content. MDM: Mobile Device Management a system which manages policies, apps and security settings on mobile devices. Some MDM platforms manage a specific mobile device 2

3 Mobile Security platform, while others can handle multiple platforms. For example, BlackBerry Enterprise Server (BES) typically only manages BlackBerry devices although this is set to change late 2012 as BlackBerry FUSION will allow a BES server to manage both iphone and Android devices. Other multi-platform device MDM platforms include Good Technology, MaaS360, MobileIron and AirWatch. MPL: Mobile Learning Platform an end-to-end (e2e) system that provides tools for creating, distributing, consuming, tracking and reporting on mobile learning content. The platform comprises an app installed on the mobile device, mobile-ready content, and server software to which the app connects to authenticate the user, retrieve content and report tracking data. SAAS: Software as a Service is a model for the delivery of a software platform where a software provider hosts and maintains a product and all data associated with it. Typically the provider is the software vendor themselves. SAML: Security Assertion Markup Language is an XML-based open standard for exchanging authentication and authorization data between security domains, that is, between an identity provider (a producer of assertions) and a service provider (a consumer of assertions). SSL: Secure Sockets Layer is an encryption protocol which secures communication between a client and the server they connect to over the Internet. The Intuition MLP uses an SSLv3 certificate which has an RSA 2048-bit public key. Intuition Mobile Learning Intuition s award-winning mobile learning platform for BlackBerry, iphone/ipad, Google Android and Windows phone enables organizations to deliver learning, knowledge and information to their mobile workforce. The Mobile Learning Platform (MLP) comprises two key components: The mobile app: Intuition s mobile apps allow a mobile device user to browse and download available content, launch and consume content (including times when the device is out of mobile coverage), complete exams and surveys, and upload tracking and progress data to the server. Mobile LMS: Intuition s Mobile LMS is used for administering users and groups, assigning content and reporting on usage. It is also used as the administration interface for the MLP. Intuition Mobile Learning platform - security features The MLP manages content distribution and tracking through a six step process: 1. Saas infrastructure 3

4 Mobile Security Server Architecture: The Intuition mobile learning solution runs on a multi-tenant SaaS platform where data is stored in a single, securely segregated database. The company is in the process of implementing an ISO Information Security Management System and our Data Centre is SSAE-16 compliant. Network and infrastructure: If required, Intuition utilizes the Akamai global acceleration network for handling high latency communications on a global basis and for providing content caching services via secure networks globally. Rigorous testing: Ongoing development and releases of the MLP are subject to ISO 9001 compliant development and testing procedures. The platform is penetration-tested on a regular basis by independent external organizations and the overall platform is maintained with security patches and updates to ensure that it complies with the latest security fixes. 2. Provision or install the app To enable secure content distribution and tracking, the Intuition mobile app must be installed on the user s mobile device. Depending on enterprise or organizational policy and available resources, app installation is possible by a user-initiated pull or download or by an automated administrator-initiated push. A user-initiated download of the app to their mobile device through a mobile-enabled web page or a company App Store Pull Option 1: Downloading through a mobile-enabled webpage is the least secure of the app provisioning options and may cause additional complexities to app maintenance and updates. We recommend that pull provisioning is only implemented if push options are not technically possible. Pull Option 2: Downloading from a consumer App Store, such as the Apple AppStore, Android Market, or BlackBerry AppWorld, is more secure than Pull Option 1. However, the app is visible to anyone with access to the consumer App Store and this option may incur additional or escalating costs. Pull Option 3: Downloading from a company App Store is the most secure of the Pull options. This method enables improved app maintenance and app updates through on-device notifications and communications. Push or over-the-air (OTA) recommended An automated administrator-initiated download of the app to one or more mobile devices. Push provisioning requires an MDM platform where an administrator assigns and deploys the app to mobile devices with no user actions required. MDM facilitates additional security management and policy enforcement controls such as disabling device features (camera, SD card, Wi-Fi, and more), password enforcement, remote locking, device wiping/reset, and application management. Push provisioning through an MDM is the most secure option and it enables automated app maintenance and app updates similar to the initial app push provisioning. This method is also referred to as Over-the-Air or OTA deployment as no end user actions are required, such as plugging their device into a computer to access updates. Intuition recommends that organizations have a fully functional MDM platform which manages all mobile devices with access to enterprise data or information. This approach provides the greatest flexibility, control and security. It also allows utilization of existing business processes, without creating an additional workload for support services. 4

5 3. Activate and register the app Mobile Security When the app is installed, it must be launched and activated within the app welcome screen. Activation registers the user s mobile device with the MLP, which authenticates the user s credentials and permissions to access content and MLP features. When authenticated, the user data, such as their name, is sent to the device over HTTPS and encrypted before being stored on the device. A unique activation code or integrated Single Sign-On (SSO) may be used to register users. Both processes require the device to be online as the MLP may be contacted for validation. Each unique organizational build of the app is tied to that specific enterprise, preventing an app from one organization activating against another organization in the SaaS infrastructure. Activation code This process involves a user entering a unique code into the app which is sent to the MLP SaaS server for validation. The server stores a valid activation code against each user. When the user activates, the server marks the user as activated, and records the specific mobile device information for reporting and support. Activation codes can be randomly generated or they can use a unique user identifier, such as Employee ID or address. The use of commonly known identifiers, such as Employee ID, may streamline communications, but are less secure than randomly assigned codes. Single sign-on or simplified sign-on (SSO) and SAML Integrating the MLP with an enterprise SSO or SAML system allows the activation process to use standard enterprise credentials, such as those used to log into a computer or enterprise intranet. These SSO login screens are formatted to correctly display on the smaller screens available on mobile devices. SSO or SAML integration enables several benefits for both the user and the administrator including streamlining communications, improving support resolution, and simplifying re-authentication or reactivation on a new or upgraded device. SSO and SAML integration significantly improves MLP access security and administration control through employment validation. 4. Encryption enforcement The MLP incorporates a setting which determines the minimum version of the app that can activate. This feature ensures that only apps which support the latest encryption can be activated. Downloading content and uploading progress When the mobile device and app are authenticated and registered with the MLP, the user can download and launch the content and upload their learning progress to the MLP. Uploading content to the MLP Content is uploaded to the MLP via an SSL-encrypted web page. An administrator can log in to this web page, specify a file to upload from their local computer, enter the item details or use in the MLP, upload the content and create the learning object in the MLP. 5

6 Data in transit downloading and uploading Content is downloaded over a secure HTTPS channel. As the content downloads, it is rapidly encrypted before being stored. In the event of a download interruption, the files are discarded so that either the content is downloaded and encrypted or it is not downloaded. Each time content is accessed, it is decrypted as it is read. Uploaded information is continuously scanned for malicious viruses to prevent crosscontamination of the entire MLP. LMS Integration Intuition s MLP can be deployed as a standalone solution and fully or partially integrated with existing customers LMS and HR systems. Intuition has successfully implemented numerous LMS integrations for customers, including Cornerstone, Plateau, and Saba. Intuition s bidirectional SFTP server or Web Services provide a secure transport mechanism for the exchange of encrypted files between an existing customer s LMS and the MLP. 5. Running / viewing content Although wireless communication speeds and networks are increasing rapidly, Intuition believes that access to content on a mobile device that has no wireless signal or a low quality signal is critical for user performance and experience through the MLP. As such, content is available for consumption through the app even when the mobile device is offline. Data at rest double encryption The app itself is a closed environment and does not allow any data or content to be extracted to the device or data to be introduced from the device into the app. As a result, it is a highly secure environment supported by the fact that the app content can be remotely wiped by the server. Data is further encrypted on the device itself using built-in encryption libraries, such as AES-256-bit and DES-192-bit. By default, content is stored on the internal memory of the device, but where the device supports external memory cards and the server has enabled external storage of content, external card storage is possible. Each device platform provides different levels of support for encryption and memory cards. 6. User and app management The MLP provides administrators with a high level of control and management of users and content access. Many features are designed to increase security and control for mobile devices not governed by an MDM. Deactivation of users An app can be deactivated in two ways: 1. By the device user choosing to reset the app on the device. This resets all settings and removes all user data setting the app to the pre-activation state. 2. At the server by the administrator. At the next synchronization event, the server will instruct the app to reset itself. A. For automated deactivation of users, this can be managed manually (through admin screens) or automatically through the feed. 6

7 b. For manual retirement of users, administrators can deactivate a user, which maintains their records in the system. However, this action prevents the assignment of content or does not permit the user to access the system. c. For automatic retirement, user records can be deactivated via the process that manages the periodic feed from the client s Enterprise Directory. App upgrade MDM providers allow full control over which version of an app is installed on a device. App installation files can be updated via the MDM Management system and pushed out to users. The MDM provider can automatically push app upgrades to mobile devices. App updates can be sent from an MDM to the mobile device in the background and OTA. Users are not generally required to perform any actions in order to update the app via an MDM using the MDM Deployment App. APP Removal When the app is removed from the user s mobile device, the user s name and all secure encrypted learning items are removed from the device. The user can manually remove the app from the mobile device, or the administrator can remove it through an MDM. Logging and reporting The ability to generate and log instant security reports of user behavior on-device can immediately help identify any security issues. Intuition supports the recording of security events in one or more specific security event logs to ensure that information relevant to a security breach is readily available. Access to security event logs is limited to authorized IT security staff. All instances of cleared system events or any modified system security policy are recorded. Any changes made to the system log settings are recorded (for example, logs for certain events are turned off). The system includes the Logical Account identity, event type and timestamp in each entry in the security event logs. Roaming controls The Intuition apps and MLP can enforce control of downloads while the mobile device is roaming on another carrier s network. Using server settings, the device can be prevented from downloading content while roaming, except when a Wi-Fi network connection is available, resulting in the avoidance of unnecessary and expensive roaming charges. Remote access Administrators can manage devices and users from the server in order to deactivate a particular user or to assign/unassign (and consequently add or remove) content on a user s device. The changes are implemented at the next synchronization event for the device. Screen lock and timeout The Screen Lock feature protects data downloaded to the app from being accessed by unauthorized users. It provides an authentication step before content can be accessed. This feature protects content and data if a device is lost or stolen, or otherwise accessed by an unauthorized user. The Screen Lock does not require the device to be online, so data is secure even if the device is unable to connect to the MLP and during the period before it is deactivated or remotely wiped. 7

8 The Screen Lock prompts the user to enter their PIN when the following configurable events occur: App launch each time the app is launched on the device. Timeout where the user has been inactive on the app for more than 20 minutes. Restored from background each time the app is reactivated having been in background mode. Pin code rules To prevent weak PIN codes from being used, the app enforces the following rules whenever a user sets or resets their PIN code. The PIN code must: Be four digits in length, and Contain no more than two sequential numbers, for example, 1249 and 1967 are valid, 1239 is not, and Contain no more than two identical numbers, for example, 1149 and 1491 are valid, 1141 is not. Setting the screen lock pin The following steps describe how the screen lock PIN is set: 1. The first time that the user launches the app, the SSO activation process is initiated. 2. If successful, the user s device is registered to their specific user account on the MLP. 3. The app prompts the user to create a four-digit PIN code to allow access to the app. 4. The user is prompted to re-enter their new PIN code (for confirmation). 5. The user can now use the app Changing the screen lock pin The following steps describe how a user can change the PIN code they previously set up for a device: 1. The user launches the app and enters the PIN code. 2. The user navigates to the app settings menu (within the app) and opts to change their PIN code. 3. The user enters their old PIN code and enters a new PIN code twice (for confirmation). 4. The new PIN code is stored within the app Resetting a forgotten screen lock pin Using SSO or an Authenticate Code, a user can be authenticated and assigned permission to reset their PIN code if forgotten. To do this, the device must be online. 1. The user clicks on the Forgotten PIN code link on the app s PIN code entry screen. 2. The SSO Authentication process is initiated. 3. When the user is authenticated and confirmed as a registered user, they will be allowed to set a new PIN code by entering it twice (for confirmation). Limitation of attempts If a user incorrectly enters the PIN code twice, they will be warned that any further attempts may risk losing data. They are also offered the opportunity to reset their PIN code using the previously described method. If a user enters an incorrect PIN code for a third time, the app is fully reset resulting in the removal of all data held on the device including content and tracking data. 8

9 Time out conditions The user is prompted to enter their PIN code if they have been inactive on the app for more than 2ominutes. This timeout condition applies in certain scenarios, including: Launching the app but not being active on it for more than 20 minutes. Switching the app to background mode. Launching media from the app which plays in an external player. 9