Creating Security for BYOD â€“ Current Approaches - SICS

Patrik EkdahlEricsson Research - Security

Creating Security for BYODCurrent Approaches

Wednesday, April 17, 13

Ericsson External 2013-04-11

Bring Your Own Device

2

“BYOD refers to the act of employees using their personal mobile devices for work-related purposes.”

- Mason report 2012

• Consumerisation• IT departments are too slow to adopt.

• Personalisation• need for employees to feel unique.

• Work-life integration• traditional workday no longer exists.• drive for more flexible technology

solutions.

• Productivity enhancement• using familiar technologies• increased availability

• Cost

Drivers



History

3

2000 20132007 2008

Blackberry 957 iPhone

2010

Several larger companies implement

BYOD policies

HTC Dream

2012

NIST draft on guidelines for

BYOD security.

Ericsson R380



Corporate access

4

Blackberry style Corp. network

Internet

BES

Internet

Mail Server

Internet Gateway

VPN

Internal Data



Corporate access

4

Blackberry style Corp. network

Internet

BES

Internet

Mail Server

Internet Gateway

VPN

Internal Data

WiFi-Browser



Corporate access

5

Mobile Device Management style Corp. network

MDM Frontend

Exchange Server

MDM Application

Internal Data

Mail Calendar

Prop. Data Access

TLS



Today’s landscape

6

Don’t know4%

No51%

Yes45%

IT’s support of BYOD (All devices, US SMEs)

Source: iGillottResearch 2013

0

5

10

15

20

25

100 75-99 51-74 50 26-49 1-25 0Don’t know

Percent of Employees Who Bring their own SmartPhone

RealityIn more than 90 % of the companies, people bring their own SmartPhone.



Some more numbers..

7

of IT executives surveyed say that employees are using unsupported devices or apps because of personal preference, not because they need them to do critical work.

72%

(from a UniSys survey 2012)



Some more numbers..

7


72%


IT more likely to block Angry Birds than to provide secured alternatives to public cloud storage.

but what does IT know..? According to another survey..



Some more numbers..

7


72%


75% of IT organizations don't let people use their own apps for work purposes, with a substantial subset saying such usage should be grounds for dismissal.





Some more numbers..

7


72%


75% of IT organizations don't let people use their own apps for work purposes, with a substantial subset saying such usage should be grounds for dismissal.

38% percent of the employees decided to ignore such edicts. These people are the ones who drive the business and tend to be in positions of authority.





Information owner model

8

Device owner Information owners

• Execute any apps they like. • Trust that data will not be viewed/erased by enterprise actions.• Detach from an enterprise without loosing personal data.

• Trust the device to • protect data• access data• process data• store data

• Terminate access to their data at any time

Device owner

Company

Bank

...



Device architecture

9

HardwareContext

FirmwareContext

OSContext

ApplicationContexts

Application Processor, Baseband Processor, Memories, Peripherals, ROM Code

Bootloader, Initialization Code

Kernel

APP-1 APP-2 APP-3 APP-4 APP-5



Information Domains

10

HardwareContext

FirmwareContext

OSContext

ApplicationContexts



Kernel




Information Domains

10

HardwareContext

FirmwareContext

OSContext

ApplicationContexts



Kernel


InformationContexts

IO-2IO-1 IO-3 IO-4 IO-5



Data access

11

ApplicationContexts

InformationContexts





Data access

11

ApplicationContexts

InformationContexts





Data access

11

ApplicationContexts

InformationContexts



Policiesand a Policy Enforcement Engine (PEnE)


Sealing the information


Rich OS

APP-3APP-2APP-1

Policy Enf. Engine

IO-2IO-1 IO-3

Rich Environment Trusted Environment


Sealing the information


Rich OS

APP-3APP-2APP-1

Policy Enf. Engine

IO-2IO-1 IO-3



Measuring


Rich OS

APP-3APP-2APP-1

Policy Enf. Engine

IO-2IO-1 IO-3



Measuring


Rich OS

APP-3APP-2APP-1

Policy Enf. Engine

IO-2IO-1 IO-3




Check point

14

Rich OS

APP-3APP-2APP-1

Policy Enf. Engine

IO-2IO-1 IO-3




Check point

14

Rich OS

APP-3APP-2APP-1

Policy Enf. Engine

IO-2IO-1 IO-3


Execute any apps they like. Trust that data will not be viewed/erased by

enterprise actions. Detach from an enterprise without loosing

personal data.

Trust the device to protect data access data process data store data

Terminate access to their data at any time



Trusted Applications

15

Rich OS

APP-3APP-2APP-1

Trusted Kernel(with PEnE)

TA-2TA-1 TA-3


Secure Storage



Anchoring

16

Rich OS

APP-3APP-2APP-1

Rich Environment


TA-2TA-1 TA-3

Trusted Environment

Secure Storage



Anchoring

16


TA-2TA-1 TA-3

Trusted Environment

Secure Storage

•Roots of trust•Execution•Storage•Verification•Reporting•Measurement•Isolation from Rich OS•Narrow well-defined API



Management

17


TA-2TA-1 TA-3

Trusted Environment

Secure Storage



Management

17

Rich OS

APP-3APP-2APP-1

Rich Environment


TA-2TA-1 TA-3

Trusted Environment

Secure Storage

Corporate Server

Administration data packages

•Install / uninstall•Key provisioning•State enquiring



Management

17

Rich OS

APP-3APP-2APP-1

Rich Environment


TA-2TA-1 TA-3

Trusted Environment

Secure Storage

Corporate Server

Administration data packages

•Install / uninstall•Key provisioning•State enquiring

•TLS connection•Data fetch•State reporting



Check point

18

Rich OS

APP-3APP-2APP-1


TA-2TA-1 TA-3


Secure Storage



Check point

18

Rich OS

APP-3APP-2APP-1


TA-2TA-1 TA-3


Secure Storage

Execute any apps they like. Trust that data will not be viewed/erased by

enterprise actions. Detach from an enterprise without loosing

personal data.

Trust the device to protect data access data process data store data

Terminate access to their data at any time



Standardization efforts

19Wednesday, April 17, 13


Conclusions

20

Using a Trusted Execution Environment we can build a owner-controlled BYOD solution

with hardware anchored trust.

•Non-proprietary solution exists•Multiple stakeholders•Device Owner is in control•No need for BES•Hardware anchored separation•Information•Execution•Remote administration


21


Creating Security for BYOD â€“ Current Approaches - SICS

Documents