Back to the Future: Securing your Unwired Enterprise By Manoj Kumar Kunta, Global Practice Leader - Security
Back to the Future: Securing your Unwired Enterprise The advent of smartphones and tablets has paved the path for the world to be more interconnected, intelligent and integrated. This ability to consume information anywhere and anytime is driving a dramatic behavioral change in the way people live, work and stay connected. Recognizing this dramatic change in consumer behavior, enterprises have rapidly started to adopt smartphones and tablets as work tools, joining existing laptops and desktops. The use of mobile devices in an enterprise is no longer a choice, but an imperative and is expected to see an explosive growth over the next few years. Over the years, Blackberry has been the pre-dominant mobile device for executives to manage their voice, emails and promote effective communications. The ground breaking invention of the iphone, ipads from Apple, and quickly followed by Android smartphones and tablets have created a broader consumer appeal. These mobile devices have an improved hardware performance, a more robust platform feature set and increased communication bandwidth, expanding their capabilities beyond voice and email. As a result, these smart mobile devices are providing enterprises the ground to conduct their businesses new and innovative ways by consuming and processing information anywhere and anytime. As a result, enterprises are seizing every mobile opportunity to optimize their processes, increase productivity and drive an increase in overall corporate wide profitability. This opportunity to increase overall profitability by increased access to enterprise systems can also bring an increased security risk to the organization. This white paper explores how companies can safely introduce employee, or corporate-owned mobile devices and applications into the workplace, identify the risks inherent in their broader access to corporate data, and recommendations on mitigating these risks to derive enhanced business value. Trade-off between Mobility Benefits and Risks Introducing corporate owned mobile devices or rolling out a bring-your-own-device (BYOD) policy for your enterprise comes with a bag full of benefits, challenges and risks. Enterprises are motivating their employees to stay connected to the corporate network, because they tend to : Improve employee productivity and satisfaction Mobile devices and enterprise applications can give employees ability to consume or process corporate resources to enable continuous collaboration with colleagues and business partners. Employees are now able to access productivity apps on-to-go to complete universal approvals, travel and expense reports, and time entry, leave requests, analytics or look up a customer or vendor. 2
Optimize and innovate new processes Employees whose job functions demand them to be on-the-go no longer need to fire up their laptop to access business critical information. The ability to effectively use mobile device features such as push notifications are introducing brand new processes to drive a proactive and timely action to derive enhanced business value. Sales employees are now able to use apps to generate sales orders, create quotations and look up customer s financial fact sheet. Field services employees are notified on new service schedules and can record start and end time of services rendered. Finance teams are better able to manage and track their assets using camera and GPS functions on the mobile devices. Improve customer service Retaining an existing customer is of paramount importance to any enterprise. Sales or support teams that regularly interface with customers can now effectively respond in a timely manner, directly increasing customer satisfaction. Reduce IT Costs By allowing a bring-your-own-device (BYOD) policy, and allowing employees to use, and often pay for, their own mobile devices and wireless services, enterprises can potentially save IT spending on devices, wireless and management services. Wireless Providers Internet Mobile Devices Mobile Devices Corporate VPN Gateway Corporate Internet -- Security Vulnerability Figure 1: Enterprise Mobility Security Failure Points 3
Back to the Future: Securing your Unwired Enterprise These business benefits cannot be ignored, nor can the multitudes of security threats. Enterprises must find ways to embrace mobility in their organization to gain an overall sustainable competitive advantage and address the accompanying security threats. For both corporate owned devices and employee owned devices, securing the devices, apps, databases, and communications are an imperative to avoid any corporate data vulnerability. If security is not addressed at the outset, these corporate owned devices and employee owned devices merged with personal and corporate data become a point of security failure that threatens to disclose confidential business information or become a new channel to introduce security threats to enterprises IT resources and infrastructure. These security threats can become failure points for an enterprise to fully reap the benefits of mobility. Security concerns can impede the momentum of embracing enterprise mobility. Whether your enterprise is deploying corporate owned devices, bring-your-own-devices (BYOD), pre-packaged mobile apps or developing them internally. They all must be locked down to protect confidential corporate resources and information being disclosed intentionally or unintentionally. The latest smartphones and tablets were initially not designed to provide comprehensive security for corporate usage. As a result, hackers have been discovering the benefits of compromising both business and personal data contained within these devices. Mobile devices and enterprise apps need to be protected with an even broader set of security techniques than those employed for traditional desktop or laptop operating systems. The typical security threats compromises the following corporate resources:1 Credentials to access business or personal accounts Confidential business or personal information Phone or data communication services Mobile device or enterprise apps To eliminate the security threats listed above, an enterprise must consider building their mobile security strategy around the below four pillars (See figure 2). Component Security Every component used in Mobile Architecture requires specific administration tasks to secure it. A high level architecture involves following components which have to be secured DATA Tier Secures and controls enterprise data, the data integrity, data at rest and data transmission. This component secures Databases too Application Database, Cache database, messaging database and logs on them. Data Encryption, securing infrastructure and backup artifacts by file system permissions, Data vaults are few measures to secure data. 4
A Mobile Security Strategy aims to meet every business requirement by optimizing four dimensions that make up mobile security Components - Securing the Device, Data and Infrastructure Communication - Securing Data as if flows between the different layers Application Security - Securing the data in the mobile app Authentication & Authorization - Access Controls, different authentication plug-ins Figure 2: The four components of a comprehensive mobile security strategy DEVICE - Secures and governs devices, Apps and data on devices. MDM over the air, managing, monitoring and supporting enterprise/ BYOD devices by controlling and protecting the data/configuration settings reducing costs and business risks. SERVERS - Secures platforms and infrastructure of Enterprise servers, SUP/ SCC Servers, MDM, MAM and Licensing Servers. Communication Security Enterprise data transferred in communications from Enterprise systems to MEAPs to Data Tier to Device / Apps has to be secured. Messaging communications, replication communications, device push notifications, data synchronizations, authentication credentials at multiple layers, etc are few examples where critical enterprise data is transferred. Application Security Apps should be secured differently based on the type of synchronizations (RBS, MBS), type of connectivity (odata/gateway, Workflow container), prompts for authentication and based on device type (Corporate / BYOD). Mobile Application Management (MAM) tools provides Application Security, Dynamic Policy Management, Application analytics. Mobile Application Protection (MAP) tools provide Application Security capabilities like selective remote wipe, per app VPN, location masking, geo-fencing, etc. MAM and MAP do not replace MDM, infact they complement MDM, providing an extra layer of security. 5
Back to the Future: Securing your Unwired Enterprise Authentication and Authorization Authentication and role-based access control (RBAC) are core security features supported by all application types to control and secure access to enterprise assets. There are many methods of authentication and authorization to mobile devices LDAP, SSO and AD to name a few. Leveraging existing enterprise authentication and authorization mechanisms and enhancing them to support mobile devices is the best practice to secure user s credentials and privileges onto mobile devices and apps. Authentication and authorization mechanisms can be enhanced using Data Vault, Session management, MEAP authentication plug-ins, authorization controls. Secured Pre-packaged Mobile Apps from Innovapptive s mpower App Suite mpower AppSuite TM Innovapptive recognizes the need to build enterprise grade secured mobile applications. To help enterprises embrace Innovapptive s SAP Certified mpower App Suite, within a security rich environment, Innovapptive s mpower App Suite comes pre-packaged with a robust native and wrapper app security. Innovapptive recognizes that the new app security methods are shifting device management and security into mobile apps and removing dependencies of hardware. App wrapping separates security from the development process and provides fine-grain usage and security policies within Innovapptive s mpower App Suite. By wrapping security into each app, the Innovapptive Mobile App Protection solution by Mocana helps administrators meet security needs in deploying Innovapptive s SAP Certified mpower App Suite. The security module within Innovapptive s mpower App Suite is configurable and provides enterprises the ability to apply consistent, replicable controls across our apps based on organizations defined security policies and guidelines, without writing any code. This flexibility provides you the ability to secure confidential corporate resources on managed and unmanaged corporate devices, including devices that an enterprise does not control or are not on an enterprises network. Enterprises can unlock true business value of mobility without worrying about the security threats by simply configuring an app or a group of apps by selecting the related security policies, and add functions for encryption, data protection, authentication, and virtual private networks (VPNs). In addition, the Innovapptive mpower App Suite helps you fulfill compliance and audit requirements, such as those for the health insurance portability and accountability act (HIPAA), regulations for the payment card industry (PCI), and other industry rules. 6
Innovapptive unlocks business value with our configurable and secured mpower Apps Suite Solution Innovapptive s pre-packaged and secured mpower App Suite quickly protects your valuable corporate data with enterprises choice of security functions and policies, including app level encryption, data protection, authentication, and VPN. In addition, you can choose from a variety of security policies, including User authentication Data loss prevention Secure data transfer between wrapped apps Data-at-rest encryption with cryptography certified by Federal Information Processing Standard (FIPS) 140-2 Jailbreak or rooting detection Per-app VPN tunnel Contextual usage Controls for cut, copy, and paste Securing Communications and Preventing Data Loss Innovapptive s mpower App Suite are protected by the Mocana MAP ready solution and keeps data in motion safe by communicating with an app over a 256-bit encrypted tunnel. This prevents potential rogue applications and malware from accessing your enterprise network. It prohibits unauthorized copying and pasting from specific applications to help stop data leaks. A smart firewall policy lets you block several types of potentially insecure network traffic from the app and require proper digital certification before communicating with a server by requiring user-authentication passwords for access to an app. Mocana MAP ready solution helps the mpower App Suite to ensure that the data is quickly made inaccessible when devices are lost or stolen. The solution supports app-data wipes based on certain conditions, such as too many failed authentication attempts. Geo-fencing adds another layer of protection by restricting app usage and availability within a specific geographic perimeter. Enterprises can also set expiration date on an app to create limited-time access. If a device is compromised by jailbreaking or rooting, enterprises can rapidly disable the app and prevent access to stored data. Authentication merely requires a user name and passcode. Assisted passcode recovery is available. Once authenticated, users can connect to enterprise servers through a VPN tunnel, which is maintained and auto connected even if a user moves from one network to another. 7
Back to the Future: Securing your Unwired Enterprise Figure 3: Innovapptive s mpower Apps Suite is Mocana MAP ready Safe mobile apps and an exceptional user experience provided by Innovapptive s mpower Apps Suite The pressure for mobile business processes comes from all sides of the enterprise. Executives and users at all levels want the convenience of mobile apps. Enterprise mobility is a competitive differentiator that helps organizations respond more quickly to their customers, partners, and employees. Enterprises are also realizing that pre-packaged mobile apps provide quick win opportunities to increase productivity, improve efficiency, and speed time to market. With Innovapptive s Mocana MAP ready mpower App Suite, business processes can be mobile and safe from misuse even when devices and apps are used by partners, contractors, and customers. Enterprise users can interact with the mpower App Suite in familiar ways without installing an additional client or separating their business and personal apps. 8
For more information To learn more about Innovapptive s mpower App Suite, Enterprise Mobility Strategy and Consulting, Rapid Deployment Solutions and Custom Development Services, contact your Innovapptive sales representative, visit our website www.innovapptive.com or you can email Innovapptive directly at sales@innovapptive.com Copyright Innovapptive Inc. 2013 Innovapptive Inc. One Riverway, Suite 1700 Houston, TX 77056 USA Produced in the United States of America August 2013 All Rights Reserved 1 Securing mobile devices in the business environment An IBM White Paper 2 SAP Solution Brief Secure Enterprise Apps in Seconds Across Managed and Unmanaged Mobile Devices 9