Patrik Ekdahl
Ericsson Research - Security
Creating Security for BYOD
Bring Your Own Device
“BYOD refers to the act of employees using their personal mobile
devices for work-related purposes.”
- Mason report 2012
•
Consumerisation
•
IT departments are too slow to adopt.•
Personalisation
•
need for employees to feel unique.•
Work-life integration
•
traditional workday no longer exists.•
drive for more flexible technology solutions.•
Productivity enhancement
•
using familiar technologies•
increased availability•
Cost
History
2000 2007 2008 2013 Blackberry 957 iPhone 2010 Several larger companies implement HTC Dream 2012 NIST draft on guidelines for BYOD security.Corporate access
Blackberry style
Corp. network
Internet
BESInternet
Mail Server Internet Gateway VPN Internal DataCorporate access
Blackberry style
Corp. network
BES
Internet
Mail Server VPN
Corporate access
Mobile Device Management style
Corp. network
MDM Frontend
Exchange Server MDM Application
Internal Data
Mail Calendar
Prop. Data Access
Today’s landscape
Don’t know 4% No 51% Yes 45%IT’s support of BYOD
(All devices, US SMEs)0 5 10 15 20 25 100 75-99 51-74 50 26-49 1-25 0 Don’t know
Percent of Employees Who Bring their own SmartPhone
Reality
In more than 90 % of the
companies, people bring
Some more numbers..
of IT executives surveyed say that employees are using unsupported devices or apps because of personal preference, not because they need them to do critical work.
72%
Some more numbers..
of IT executives surveyed say that employees are using unsupported devices or apps because of personal preference, not because they need them to do critical work.
72%
(from a UniSys survey 2012)
IT more likely to block Angry Birds than to provide secured alternatives to public cloud storage.
Some more numbers..
of IT executives surveyed say that employees are using unsupported devices or apps because of personal preference, not because they need them to do critical work.
72%
(from a UniSys survey 2012)
75%
of IT organizations don't let people use their own apps for work purposes, with a substantial subset saying such usage should be grounds for dismissal.IT more likely to block Angry Birds than to provide secured alternatives to public cloud storage.
Some more numbers..
of IT executives surveyed say that employees are using unsupported devices or apps because of personal preference, not because they need them to do critical work.
72%
(from a UniSys survey 2012)
75%
of IT organizations don't let people use their own apps for work purposes, with a substantial subset saying such usage should be grounds for dismissal.38%
percent of the employees decided to ignore such edicts. These people are the ones who drive the business and tend to be in positions of authority.IT more likely to block Angry Birds than to provide secured alternatives to public cloud storage.
Information owner model
Device owner
Information owners
•
Execute any apps they like.•
Trust that data will not be viewed/erased by enterprise actions.•
Detach from an enterprise without loosing personal data.•
Trust the device to•
protect data•
access data•
process data•
store data•
Terminate access to their data at any timeDevice owner
Company
Bank ...
Device architecture
Hardware Context Firmware Context OS Context Application ContextsApplication Processor, Baseband Processor, Memories, Peripherals, ROM Code
Bootloader, Initialization Code Kernel
Information Domains
Hardware Context Firmware Context OS Context Application ContextsApplication Processor, Baseband Processor, Memories, Peripherals, ROM Code
Bootloader, Initialization Code Kernel
Information Domains
Firmware Context OS Context Application ContextsBootloader, Initialization Code Kernel
APP-1 APP-2 APP-3 APP-4 APP-5
Information
Data access
Application Contexts Information
Contexts IO-1 IO-2 IO-3 IO-4 IO-5
Data access
Application Contexts Information
Contexts IO-1 IO-2 IO-3 IO-4 IO-5
Data access
Application Contexts Information
Contexts IO-1 IO-2 IO-3 IO-4 IO-5
APP-1 APP-2 APP-3 APP-4 APP-5
Policies
Sealing the information
Rich OS
APP-3 APP-2
APP-1
Policy Enf. Engine
IO-2
Sealing the information
Rich OS
APP-3 APP-2
APP-1
Policy Enf. Engine
IO-2
IO-1 IO-3
Measuring
Rich OS
APP-3 APP-2
APP-1
Policy Enf. Engine
IO-2
Measuring
Rich OS
APP-3 APP-2
APP-1
Policy Enf. Engine
IO-2
IO-1 IO-3
Check point
Rich OS
APP-3 APP-2
APP-1
Policy Enf. Engine
IO-2
Check point
Rich OS
APP-3 APP-2
APP-1
Policy Enf. Engine
IO-2
IO-1 IO-3
Rich Environment
Trusted Environment
Execute any apps they like.
Trust that data will not be viewed/erased by enterprise actions.
Detach from an enterprise without loosing personal data.
Trust the device to protect data
access data process data
store data
Trusted Applications
Rich OS
APP-3 APP-2 APP-1Trusted Kernel
(with PEnE)
TA-2 TA-1 TA-3Secure Storage
Anchoring
Rich OS
APP-3 APP-2 APP-1Rich Environment
Trusted Kernel
(with PEnE)
TA-2 TA-1 TA-3Trusted Environment
Secure Storage
Anchoring
Trusted Kernel
(with PEnE)
TA-2 TA-1 TA-3Secure Storage
•
Roots of trust
•
Execution
•
Storage
•
Verification
•
Reporting
•
Measurement
•
Isolation from Rich OS
Management
Trusted Kernel
(with PEnE)
TA-2 TA-1 TA-3Trusted Environment
Secure Storage
Management
Rich OS APP-3 APP-2 APP-1 Rich Environment Trusted Kernel (with PEnE) TA-2 TA-1 TA-3 Trusted Environment Secure StorageCorporate Server
Administration data packages
•
Install / uninstall
•
Key provisioning
Management
Rich OS APP-3 APP-2 APP-1 Rich Environment Trusted Kernel (with PEnE) TA-2 TA-1 TA-3 Trusted Environment Secure StorageCorporate Server
Administration data packages
•
Install / uninstall
•
Key provisioning
•
State enquiring
•
TLS connection
•
Data fetch
•
State reporting
Check point
Rich OS
APP-3 APP-2 APP-1Trusted Kernel
(with PEnE)
TA-2 TA-1 TA-3Secure Storage
Check point
Rich OS
APP-3 APP-2 APP-1Trusted Kernel
(with PEnE)
TA-2 TA-1 TA-3Rich Environment
Trusted Environment
Secure Storage
Execute any apps they like.
Trust that data will not be viewed/erased by enterprise actions.
Detach from an enterprise without loosing personal data.
Trust the device to protect data
access data process data store data
