Tuesday Dec 31, 2013

MDM + Oracle Fusion in the Cloud - Simeio Solutions

Introduction
In the previous posts in this series of blog posts, we covered many concepts, from Mobile Device Enablement, BYOD, Mobile Device Management (MDM), Mobile Application Containerization & Mobile Identity Management. While the focus on all the prior series were around the pro’s and con’s and best practices, we would like to take a detour in the conclusive post of this series and focus on  the cloud and how it co-relates to the “mobile” landscape.

BYOD, MDM and Cloud Computing by themselves are technologies that are becoming an integral part of the IT landscape at a rapid pace. While organizations have invested in infrastructures that allow their employees to work remotely via technologies like VPN, the technology stack in the advent of the MDM / BYOD age needs to extend to allowing for remote access via these mobile devices too.

Cloud Computing
In the information era, innovative concepts come along and emerge as a new trend. Not all trends are made equal. Cloud Computing is one such term that has not just emerged as a trend, but has enabled technology to take a leap forward in terms of  scale and usability. It has taken a quantum leap forward in terms of ambition. As with most technologies, there are many benefits that can be gained, but along with understanding the benefits, the business risks must also be evaluated.  While evaluating such benefits, it’s important to not just look at the short term benefits but also the long term objectives and goals of an organizations strategy.

What Is Cloud Computing
The definition of the term is just one of many that we have been introduced with in the industry. But what does it actually mean? Let’s take a brief look at a few definitions of the term:

Wikipedia: “Cloud computing is a phrase used to describe a variety of computing concepts that involve a large number of computers connected through a real-time communication network such as the Internet”

NIST: “Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared  pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released  with minimal management effort or service provider interaction”.

Merriam-Webster: “The practice of storing regularly used computer data on multiple servers that can be accessed through the Internet”.

For Dummies : “The “cloud” in cloud computing can be defined as the set of hardware, networks, storage, services, and interfaces that combine to deliver aspects of computing as a service”.

Before we provide you any more references to confuse you further, let’s take a pause here. We cited the top 3 sources of references. And each have their own variation of the definition. So which definition is more apt? Do they all mean something different or do they all mean the same? The short answer is, they are all the same. Any which way you read it, it translates to “cloud computing” being a model. A model that has certain characteristics.

The characteristics of a cloud network essentially are it being an on demand service, ability to scale to exponential proportions at a rapid pace, the ability to aggregate and resources from across multiple platforms and the ability of it being measurable.

The four fundamental deployment models of a cloud service are a public cloud, a private cloud and a hybrid cloud. Where the terms public private by themselves are indicative of its use, and the term hybrid as it’s itself definition goes is an amalgamation of the 2 models.

BYOD in the Cloud:
BYOD’s success is equivalently proportional to the variety of devices and platforms that it introduces to the IT systems. For organizations that are proponents of the BYOD ideology, the key factor that determines the ease of onboarding of users onto the corporate network is the use of Virtual Private Networking (VPN) technology. Enabling users to tunnel into the network via VPN allows organizations to enable their user to access files and/or control the applications on local machines that they require for their daily routines regardless of the platform or device they are using or their location as long as they are connected to the cloud.

Therefore, it is imperative that cloud connectivity plays an important role in enabling such access across platform or device agnostic systems.  BYOD needs to be part of a wider, holistic approach to Cloud computing.

Now take into account the general Cloud options. The problem with this is that you can lose control of the data while not losing responsibility for it. You don’t even know where it is. At a technical level, this might not be important; however at a legal and regulative level it definitely is. Moreover, your only ultimate control over your own data is your contract with the Cloud provider - and if the provider fails, contracts are no substitute for data.

The BYOD concept is evolving very quickly and the changes are influencing "how enterprises have adopted this technology" vary considerably. They are forcing IT section chiefs to think more intrusively and acquire tools to control this situation without restricting the end user experience. MDM or Mobile Device Management is one such very handy tool but as BYOD concept continues to spread, businesses would require many other services in integration with MDM. Two of such services are Mobile Device Management (MDM) and Content Management.

MDM in the Cloud:
Cloud based device management doesn't minimize application or operating system bloat but what it does do is leverage the Internet's bandwidth for delivery, monitoring and metering. If an organization is geographically dispersed and diverse, cloud based MDM becomes a necessity rather than a requirement. A smart way to setup a cloud based MDM solution is to place the organizations asset management system in the cloud and allow the processes to take place via user's personal bandwidth. It's kind of an extension of BYOD but in this case it's BYOB, where the "B" is bandwidth.

By using an employee's personal bandwidth for that "last mile" leg of the delivery process, the corporate network's bandwidth, even on a segregated network, remains available for monitoring, operating system delivery, server patching, administration, and other required maintenance activities.

Cloud-based MDM will be most effective with user devices, which will always outnumber data centered ones. User devices burn up the bandwidth due to the sheer numbers of them.

When we refer to MDM in the cloud, a key issue that pops into mind is “security”. Arguably the greatest challenge faced by organizations embracing BYOD is that of security; ensuring that personal devices aren't compromised in themselves and don't pose a security threat to the rest of the network. Allowing BYODs introduces many more vulnerabilities at various steps in the network and so there are many ways in which these risks can and need to be addressed.

The first step is to reduce the risk of the personal device being compromised in the first place. This is particularly pertinent where employees are bringing their own device in to connect to the businesses LAN. To achieve this, some organizations have conditions of use which require that the user's device has specific anti-virus and management software installed before it can be allowed onto the network. However, the risks can also be reduced by ensuring that personal devices are only allowed to connect to the local network via a VPN rather than a direct connection, even when the user is on site.

Using a VPN is a must for users in remote locations as the secure tunnel of a VPN prevents any information being intercepted in transit. It can be tempting for employees working off-site (or even on site) on personal devices to email documents, for example, backwards and forwards but the security of such communications can never be guaranteed.

What's more that approach requires that at least some work data is stored locally on the personal device - a cardinal sin in terms of data protection. Again both VPNs and cloud solutions can negate the need to store local data. Using a VPN will allow the worker to operate on the local network, accessing, working on and storing everything they need on there, rather than on their own device. Secure cloud services on the other hand can be used to provide collaborative workspaces where users perform all their work in the cloud so that colleagues, wherever they are, can access it. However care should be taken to check the security measures used by cloud providers before signing up to such services whilst the user must also ensure that someone who misappropriates a device can't then easily access their cloud account (through lack of device security and stored passwords etc).

Since MDM itself is a relatively new concept there is disparity in opinion regarding the implementation of a cloud based system. While most organizations prefer a cloud based solution, others are not willing to let go of a very recent transition made from traditional networks to MDM. Some however have opted for a hybrid solution where data processing is done on servers A purely cloud based solution however is more beneficial to the requirements of companies especially if they're on a small scale.

  1. Setup Time : The setup time for a cloud based system is very little. This is because the data is ultimately on a cloud and the creation of a system which gives access to multiple devices can be easily done.
  2. Setup Cost : Budget constraints are common problems faced by small companies. The BYOD automatically removes the strain of providing devices to employees whereas cloud systems enable mobile device management without the need of spending money on technical equipment such as server machines, cables, power outlets and switches.
  3. Maintenance : Regular maintenance of the server will be unnecessary. If the software has the latest updates and is working properly, chances are the server is providing optimal performance as well.
  4. Costs : One of the most appealing features of MDM is the low initial cost of set up. What is overlooked however is that the running or operating costs of the cloud systems are reasonable as well. Payment is done simply on usage basis and according to the number of devices connected to the cloud system.
  5. Ease Of Access : The cloud may be accessed from any locations which means that workers in remote locations will be able to work from home or other locations.

Oracle Fusion Middleware:

Cloud computing may appear to be spreading like wildfire with both enterprise and personal users jumping at the chance to take advantage of the cost effectiveness, scalability and flexibility that it offers. However, there is a strong debate amongst industry experts, and beyond, as to whether this uptake, however rapid, has been severely tempered by a lack of trust and understanding around cloud services from prospective clients.

Many propose that, as has been the case in many markets that have preceded cloud computing, the answer to client wariness is standardization with the aim of delivering transparencies. In other words, create a market where a client can shop between multiple providers and judge their security levels, data handling, performance and service stability on comparable metrics.

Oracle Fusion middleware does just that. It’s based on standards and enabled organizations to standardize their platform offerings.

Oracle Fusion middleware enables you to secure mobile (native and Web) applications with Oracle Access Management. This includes authenticating users with existing credentials; enabling two-factor authentication; and using mobile authentication to enable secure Web services and REST APIs, REST-to-SOAP transformation, and identity propagation.

Version 11.1.1.8 of the latest release of Oracle WebCenter Sites provides an integrated mobile Web solution that enables business users to author, edit, and preview content for different groups of mobile devices—all from within the same interface that is used to manage their main Website. Oracle WebCenter Framework is an Oracle JDeveloper design-time extension that breaks down the boundaries between Web-based portals and enterprise applications. It also provides the runtime portal and Web 2.0 framework on which all Oracle WebCenter technology runs.

The Best of Breed
With Oracle Fusion middleware, you gain access to the best of breed in technology platforms and tools that would not just enable your organizations BYOD program to sprint forward but would enable to enhance the service delivery model by providing your organization with the core tools and technology that would not just power your BYOD and MDM strategy but also enable you to leverage the exact same platform for your enterprise wide security strategy.

If you’d like to talk more, you can find us at simeiosolutions.com











Friday Dec 13, 2013

Passing the Puck to the CTO - BeachBody's Miracle Moment of Identity

BeachBody CTO, Arnaud Robert, was prepared for competitive business at an early age.  Showing success on the ice as a captain of his hockey team, taught Arnaud that there are many similarities between the game of hockey, in particular, the position of team captain, and that of today's CTO.  As Arnaud points out, today's CTOs must remain very nimble and capable of acting much like that of a team captain.  Regardless if we are talking pucks and tasks, periods and quarters or games and projects, the methodologies in managing has given Arnaud a focus with the BeachBody business that he has used to expand the BeachBody enterprise in the areas of Identity Management and Mobile Enablement.

Take a moment to watch this great video from Arnaud and see if you and your CTO can relate to the hockey challenges, and how you are responding in the areas of Identity.


Wednesday Dec 11, 2013

Facilitating Secure BYOD: Deep Dive - Simeio Solutions

In our first post, we explored BYOD, its imminent challenges and tool sets which one can employ to overcome these hurdles. The second post gave you peek into Mobile Device Management (MDM) and the set of problems it alleviates.

In this post, I will briefly introduce you to a relatively lesser know Mobile Security term known as 'App Containerization'. Then we will continue to explore the Oracle Access Mobile and Social product offerings. This time, the emphasis would be on 'How' OAMMS facilitates a secure mobile experience and help you gain insight into what really happens behind the scenes.

Mobile Application Containerization: What does it really mean?
As the name clearly indicates, it is a mobile 'application' level security mechanism as opposed to 'device' level protection with an emphasis on providing finer-grained application-level controls, not just device-level controls. Application Containerization can allow organizations to protect their data on any mobile device by ensuring that security restrictions are applicable only when the user interacts with the enterprise/official business applications.

How is it different from Mobile Device Management?
Mobile Device Management (MDM), empowers IT with device level controls such as executing remote data wipe, enforcing device password policy etc. It is an indispensable tool for corporations. However, from an end user perspective, MDM brings to fore, concerns such as

Employee privacy invasion - Why should the organization have ACCESS to my personal photos, emails etc?

Employee personal data sustainability concerns - What if my company wipes out ALL of my personal data on my device in order to reduce risk for couple of corporate applications?

All that matters is to keep enterprise data secure, not to intrude user's privacy.

'Containerization' is a technique which can help organizations combine the best of both worlds. It is categorized under the 'Mobile Application Management' (MAM) domain.  This is a new generation mobile security technology which ensures tight reign over corporate data on mobile devices without being too intrusive for the end user. Personal and Containerized applications can coexist on the mobile device, but each containerized application's data stays within the confines of its own 'container'. Communication to corporate servers or other 'containerized' applications are completely 'secure'.

App Containerization Fundamentals and Strategies

  • Works on the concept of 'Sand-boxing' the application execution.
  • Provides a secure run-time container for each managed application and its data.
  • Clearly segregates personal and corporate applications and associated data irrespective of the device.

Few of the techniques which are employed for application containerization have been listed below

Application Wrapping
This strategy involves processing the application via the 'App Wrapping' tool and creating a security wrapper around it. This process does not require any additional 'coding'.

Customized Code Based Integration
Specific Software Development Kits (SDKs) can be leveraged in order to 'code' the functionalities which cannot be delivered via 'Application Wrapping', Mobile application developers can use APIs in the SDK to weave the capabilities of the mobile security platform within the applications.

Dual Persona
This is a containerization technique wherein corporate and personal applications are installed under separate areas which are abstracted as 'personas'

Encrypted Space
Applications and data may be kept within the confines of an encrypted space, or folder.

A comprehensive App Containerization strategy combined with device level protection can go a long way in providing end-to-end mobile security.

Where does Oracle come into the picture?
Through its recent acquisition of Bitzer Mobile, Oracle's rich portfolio of mobile security offerings has been further strengthened.  Oracle can help organizations with comprehensive solutions in order to manage the security of enterprise data held on employee's mobile devices.

Why Containerize Your Apps?
Containerization  improves user experience and productivity as well as ensures enterprise safety and compliance by,

  • Enabling secure and seamless data and service sharing between containerized apps. Users can access, edit, sync, and share corporate documents or other workflows that require multiple applications to work in coherence with each other.
  • Restricting a user’s ability to access, copy, paste or edit data held within the application container.
  • Enforcing security policies that govern access to the containerized data
  • Allowing employees to switch between personal and corporate applications seamlessly, without risk of compromising company information.


Let us pick up the thread from the very first post of this series, and take a deep dive into the Oracle Access Manger Mobile and Social product offerings.

Oracle Mobile and Social Feature Set

OAMSS features can be broadly categorized into the following

Mobile Services
Mobile Services segment of the OAMMS connect mobile devices and applications to existing IDAM services and components and enables organizations to reap full benefit of its existing IAM investments
Salient features of 'Mobile Services' are as follows

Authentication
Under the hood, the basic Authentication process is powered by Oracle Access Manager.  A typical use case encapsulates the following set of events

  • The user launches the mobile application on his device which the him to the Mobile SSO Agent.
  • Assuming that the device is already registered, the Mobile SSO Agent sends the user name, password, and Client Registration Handle to the Mobile and Social server for validation.
  • Mobile and Social Server responds with a User Token as a result of the above process and this token is further utilized by the calling mobile application to request for an Access Token.
  • After fulfillment of Access Token by the Mobile and Social server, the business mobile application can leverage this token to make calls to the resources/enterprise applications protected by Oracle Access Manager or Oracle Enterprise Gateway.


OAMMS Authentication Process

Authorization
The Authorization is taken care of by Oracle Entitlements Server (OES) which is driven by policy-based configurations. OES manages authorization for mobile devices and application with the help of 'mobile device context' which is nothing but a type of 'Identity Context' attribute.

Identity Context is made up of attributes known to the multiple identity and access management components involved in a transaction and it is shared across Oracle’s identity and access management components

Single Sign On
With SSO in place, user can multiple mobile applications on the same device without having to provide credentials for each application. Mobile SSO can be leveraged by both native and browser-based applications. A mobile application installed on the mobile device needs to be designated as a mobile SSO agent in order for mobile bases SSO to work.

  • The Mobile SSO agent application acts as a mediator between the Mobile and Social server and the other applications on the device that need to authenticate with the back end identity services.
  • It orchestrates and manages device registration, risk based authentication.
  • Ensures that the user credentials are never exposed to the mobile business application.
  • It can time-out idle sessions, manage global logout for all applications, and help in selective device wipe outs.

Device Registration
Oracle Adaptive Access Manager (OAAM) policies are executed by the OAAM Mobile Security Handler Plug-in.

  • The OAAM Security Handler Plug-in creates two security handles
    • oaam.device handle, which represents the mobile device
    • oaam.session handle, which represents an OAAM login session for a client application
  • The above mentioned 'handles' drive the 'device registration' process
  • OAAM policies can be configures to force device registration process to require Knowledge Based Authentication (KBA) or One Time Password (OTP)

Oracle Mobile and Social leverages adaptive security measures such as OTP by delegating to specialized components such as Oracle Adaptive Access Manager (OAAM)

Lost or Stolen Device Management
The Mobile and Social service works hand in hand with OAAM and counters these risks by providing a way to tag a device as lost or stolen and then implement policies that are designed to be invoked when a compromised device tries to gain access to sensitive resources via the mobile applications.

  • If the device has been reported lost or stolen, OAAM can be configured to challenge a user before providing access to the mobile applications and its associated data.
  • OAAM policies can also be designed to wipe out the device data if the device attempts to communicate with the Mobile and Social server after being reported lost or stolen.
  • OAAM policies can be configured to protect against 'Jailbroken' devices and wipe out the data. Mobile and Social service needs to be configured with jailbreak detection on.
Internet Identity Services
Internet Identity Services allow Oracle Mobile and Social to act as a relying party and leverages authentication and authorization services from cloud providers. Mobile applications can consume Social Identities securely and customers to federate easily with social networking sites

These services benefit the end users as well as the developers

User centric - The users are presented with convenient multiple log-in options and can use their existing credentials from cloud-based identity services to log in to mobile applications.

Rich OOTB support - Currently, OAMMS supports major Social Identity Providers such as Facebook, Google, LinkedIn, Twitter, Yahoo, Foursquare and Windows Live

Extensible - Developers can add relying party support for additional OpenID and OAuth Identity Providers by implementing a Java interface and using the Mobile and Social console to add the Java class to the Mobile and Social deployment.



Oracle Mobile and Social services can be easily extended to support other service providers, thanks to its flexible architecture based on 'Open' standards such as OAuth and OpenID

End to end flow wherein Identity Services are used in conjunction with OAM (for authentication)
  • A protected application is accessed by the user which in turn is intercepted the WebGate.
  • The Mobile and Social server presents a login page to the user after OAM analyses the authentication policies applicable to the resource.
  • The login page presents a menu of Social Identity Providers (e.g. Facebook) and the user is redirected to the login page for the selected Social Identity Provider
  • The user types a user name and password into the Social Identity Provider's login page which is validated by the Identity Provider redirects the control back to the Mobile and Social server.
  • The Mobile and Social server further processes the Identity assertions supplied by the Identity Provider and after retrieving user identity information, redirects the user's browser to Access Manager. This time HTTP headers in the page request provide Access Manager with the user's authentication status and attributes.
  • Access Manager creates a user session and redirects the user to the protected resource


User Profile Services
User Profile Services allows mobile applications to perform a variety of LDAP compliant directory server tasks.

  • Directory administrative tools can be created wherein an authorized administrator can invoke CRUD operations on users and groups, manage passwords and entities like managers etc.
  • Corporate or community white pages are another common application using User Profile services.
  • These services are inherently secure and protected by either an OAM token or a JSON Web Token (JWT), and they can also require device and application registration
  • OOTB support for seamless integration with popular LDAP compliant directory servers such as Oracle Directory Server, Oracle Internet Directory, Oracle Virtual Directory, Active Directory etc

SDKs and REST APIs
SDKs help developers embed identity security features into mobile applications and promote usage of existing identity infrastructure services.

  • They promote ease of development of mobile applications by serving as a security layer and driving features like authentication, authorization, user profile services and secure storage.
  • The SDKs also serve as an 'abstraction layer' which allows system administrators to add, modify, and remove identity and access management services without having to update mobile applications installed by the user.
  • OAMMS provides dedicated APIs for each of its feature categories, namely, Mobile, Internet Identity and User Profile services

Oracle Mobile and Social Services provides separate client software development kits (SDKs) for Apple’s iOS and Google’s Android.

The SDK functionalities are segregated into four distinct modules

  • Authentication Module - Processes authentication requests on behalf of users, devices, and applications.
  • User Role Module - Provides User Profile Services that allow users and applications to get User and Group details from a configured Identity store.
  • REST Handler Module - Provides access to REST web services and automatic injection of tokens for Access Manager protected REST web services.
  • Cryptography Module - Provides simplified APIs to perform cryptography tasks like hashing, encryption, and decryption.
  • Secure Storage Module - Provides APIs to store and retrieve sensitive data using the preferences storage of Android.


Generic REST API
Oracle Mobile and Social Services exposes its functionality through a consistent REST interface thus enabling any device capable of HTTP communication to send REST calls to the Mobile and Social server. These can be leveraged when it is not possible for to utilize the SDKs directly for communicating with the Mobile And Social backend components.

API Security
Oracle API Gateway (OAG) acts as a filtration layer for inbound for REST calls into the Mobile and Social server. It integrates seamlessly with OAM and OES to provide authentication and access control.

In the Mobile and Social solution context, OAG provides services such as

  • Validating JSON Web Tokens (JWT) embedded within REST calls
  • Mapping of XML to JSON for consumption by mobile devices
  • Validation of HTTP parameters, REST query and POST parameters, XML and JSON schemas
  • Protection against Denial of Service (DoS), SQL injection, and cross-site scripting attacks.
  • Auditing and logging web API usage tracking for each mobile client.

OAG and OES leverage their individual capabilities to provide context-aware authorization of mobile business transactions, authorization for REST APIs, and selective data redaction in the response payload.
Sequence of steps involved in OES powered authorization and 'redaction' process

  • A mobile application request which is intercepted  by OAG delegates authentication to OAM.
  • OAG leverages an integration adapter called OES Java Security Service Module (SSM). to interact with OES to authorize the request.
  • After successful authentication and authorization, the user  is granted access to requested resource (business application).
  • Further authorization is driven by OES based on configured policies and it might end up in 'redaction' of some confidential information from the response.
  • OES thus provides the 'redacted' response to OAG which further propagates it back to the requester

OAG and OES working in tandem

Conclusion
I hope you have gained a fair idea of the challenges which enterprise mobility requirements poses and the various options which Oracle FMW product suite has to offer to modern day organizations to empower and enable to them overcome these hurdles and successfully mobilize their workforce. Customers who are already utilizing products such as Oracle Access Manager and Adaptive Access Manager can easily leverage Oracle Mobile and Social to extend the same security capabilities to mobile applications.  Our final post will introduce you to the nuances of Mobile Device Management (MDM) for facilitating secure BYOD programme in the 'Cloud'.

About the Author
Abhishek Gupta is a Senior IAM Engineer at Simeio Solutions. He has over 5 years of experience in the IAM space and has been involved in design, development and implementation of IAM solutions for Simeio's customers with a prime focus on Oracle IAM Suite.


Tuesday Dec 03, 2013

Mobile Device Management (MDM) Within Your Enterprise - Simeio Solutions

Introduction
One of the major challenges facing every enterprise in the Bring Your Own Device (BYOD) age is how to maintain control of the devices used to access proprietary data. In this post, the second in our four-part series on BYOD and the changing mobile landscape, we’ll take a look at this issue in more detail.

It’s difficult to overstate the challenge. As organizations enable broader access to more and more information – including highly valuable and sensitive intelligence and intellectual property – they need to ensure that the devices used to access that information are secure, that the devices can be remotely managed and de-authorized, and that information on those devices can be destroyed or disposed of securely. But at the same time, the rise of BYOD means giving up a large measure of control over those devices because they are no longer owned by the organization but rather by individuals who maintain full control and authority over them.

In just a few short years, we’ve moved from uniform, company-owned desktops tethered to the office to diverse, individually-owned mobile devices that can literally be taken – and lost  – anywhere in the world. This mobile revolution has enabled an entirely new kind of workforce and unprecedented productivity and business opportunities, but it has also created a concomitant surge in risk. Addressing this risk has become an organizational imperative, which is why Mobile Device Management (MDM) has become a high priority at most enterprises.

A Plethora of Platforms
When you consider all the moving pieces that are involved in mobile computing – multiple hardware device types and manufacturers, operating systems, applications, telecommunications carriers, and supporting back-end infrastructures – the challenge of securing your mobile devices can seem all the more daunting.

Most enterprises would consider securing the platform vendors, hardware providers and telecommunication carriers to be “out-of-scope” due to the sheer volume of platform vendors and the telecommunication carriers that provide the backbone service to users across continents. It is far more practical to control and enforce restrictions on the individual devices.

In the early days of mobile computing, organizations could select a single platform to support (e.g. Blackberry), which made the job far more manageable. The adoption of BYOD, however, means you’ll need to support a wide variety of platforms, including Google Android, Apple iOS, Microsoft Windows and Blackberry, the four primary players at the moment.

There is no right or wrong platform when it comes to addressing security and MDM. Each platform comes with its own set of features, benefits and associated risks:

  1. Blackberry : The Blackberry has enjoyed tremendous popularity among IT organizations. The Blackberry software provides enterprises with servers and software that offer unparalleled remote management capabilities, but it comes at a cost. Blackberry has also recently lost significant market share to competitors, and many are questioning its survival.
  2. Apple iOS: Many consider the iPhone and iPad to be the most innovative products when it comes to revolutionizing the mobile industry. Unfortunately, many also consider iOS to be one of the weakest platforms when it comes device management. While the ability to deploy and distribute apps is a breeze, managing these devices remotely could prove to be a quite a challenge. Apple has responded to this criticism with a new OS version and hardware with improved security and integrated MDM features.
  3. Google Android: Android is by far the most popular platform as measured by market share. However, it is also known for its notorious variety of devices and flavors of operating environments. Even with the diverse array of OS options available, some Android devices come with enterprise grade software services that enable remote management (although some do not).
  4. Microsoft Windows: Microsoft is a well known player in the mobility space, but the reliance on third party toolsets, systems and servers to manage devices by leveraging the vendor published device management protocol make it a complex deployment.

Despite the pros and cons, organizations today must be ready to support any and all of these platforms without compromising the organization’s security.  Securing the devices, the application and the data that these devices hold goes way beyond simple authentication platforms that are currently in place. There is also the need for compliance enforcement to ensure that each of these devices are secured and do not in any way become a pathway for exploits and intrusions into larger systems that form part of an enterprise’s proprietary infrastructure.

Past, Present and Future
As device adoption changes over time, it is crucial to be prepared to address these evolving changes as they occur. An oversized platform may reduce in size as time rolls by. Your organization might currently have predominantly iOS and Android devices, but could change to a predominantly Windows based service as time evolves, or vice versa. It is important to acknowledge these evolving patterns and gear up for an ever evolving device adoption strategy.

The current market adoption of the various platforms has Android at 61%, iOS at 20.5%, Windows at 5.2%, Blackberry at 6% and Other devices at 7.3%.


However, there is a huge difference between the overall market share and enterprise use, where Blackberry – despite its fall from grace with consumers – continues to be a dominant player. BlackBerry still has a market share of about 38% among businesses with more than 10,000 employees, as well as more than a 33% share in government and financial institutions . But this appears to be changing rapidly.

This is exactly the kind of situation where a good MDM strategy would enable organizations to traverse any change in market dominance that may occur over time.  Adoption and market share also tend to vary by geographic region. For example, Android adoption could be very high in Asia Pacific while relatively low in North America. Therefore it is necessary to also look at an organization’s geographic employee dispersion ratio while building a strong MDM strategy.

By 2015, it’s projected there will be 7.5 billion mobile devices globally. By 2016, it is estimated that global mobile device usage will grow by 20% in the Android space, 10% in the iOS space, 30% in Windows phones, and 3% more Blackberry users. According to a recent Forrester Research Report, mobility and BYOD programs in use by North American based information workers are expected to triple by 2014. Also, the use of tablets at work is rising at an exponential rate. Today there are 50% more tablets being used in the enterprise than just a year ago.

The bottom line is that the future could hold anything. It could be an exponential increase of one of the aforesaid platforms or an emergence of a new platform altogether. You must be ready in any case.



An Effective MDM Strategy
Building an effective MDM strategy is of great value to any enterprise. We believe there are three key criteria when chosing or developing an MDM solution:

1)  Develop a single, unified solution with the flexibility to address virtually any device or platform.

Given the rapidly shifting market shares and already large and rapidly growing number of mobile devices, it would be a Sisyphean task to maintain one device management tool per device. A better strategy is one that has a broader focus on converging technologies that power a variety of devices.

Having a unified MDM service allows for global policy enforcements. It also allows for rapidly provisioning and de-provisioning devices onto the network with split liability – where individuals agree to cede some control over their personal device, often in exchange for a stipend or sharing of expenses with the enterprise.

Such a unified MDM service gives employees more control over which devices they are allowed to bring in. It also gives employers more control over what these devices can do when on the corporate network.

2)  Cover the complete lifecycle – especially in between the two endpoints.

Your MDM solution shouldn’t be limited to the provisioning and deprovisioning aspects of a BYOD program but should focus more on the period in between those two endpoints, including the ability to:
  • Control what runs on the device when connected to the corporate network
  • Determine whether security protocols have been adhered to
  • Do an over-the-air (OTA) update of an applications, configurations or device firmware
  • Support audit requirements
  • Track the location of the devices themselves

3)  Look to the cloud

Organizations embracing “cloud computing” have been steadily increasing, which comes as no surprise with the increased growth in the mobility space. Cloud based Mobile Device Management solutions have emerged as well, which organizations can leverage in tandem with their internal cloud transformation processes.

Prioritizing investments in effective strategies not only allows for on-boarding a new MDM platform at a much rapid pace, but also helps ensure the security and integrity of systems that the organization exposes to the cloud in addition to the devices that are now onboarded into the organization’s network.


MDM Best Practices
At Simeio Solutions [http://www.simeiosolutions.com/], we’ve established a set of best practices to help our clients implement a successful enterprise MDM strategy. These include:

  1. Enablement for a multi-platform, vendor-agnostic device on-boarding. Even so, enterprises should allow only the mobile devices that have the best possible control and security built in.
  2. A strong security policy. Enterprises must strive to employ a good encryption methodology, which is a key to building a strong security policy. Device encryption methods can help encrypt the local storage, but enterprises must ensure that it covers all the risk areas including the internal and external systems as well.
  3. Maintain a device registry. Take a periodic inventory of all the devices connected to the corporate network.
  4. Remote over-the-air updates. It is essential to Identify unusual situations such as jail breaks, lost devices, device theft, number of repeated failed login attempts or failure to connect to the network for lengthy periods (e.g. more than a month), and enabling those mobile devices for remote wiping, automatic padlocking and account locks.
  5. Maintain an application white-list. Tentative white-listing of applications allows only authorized software to be installed on the mobile devices and prevents the malicious software from entering the corporate network.
  6. SSL and VPN Connectivity. Enterprises should employ VPN access to enjoy the benefits of shared networks without any security concerns in transmitting sensitive data over the internet, since VPNs encrypt the data in transit.
  7. Regular security updates and patches. Enterprises need to ensure that the mobile devices connected to their corporate network are installed with regular security updates along with updates of new upgrades and patches for the mobile operating systems (iOS, Android OS, Blackberry OS, etc).
  8. Deploy intrusion detection and prevention systems (IPS/IDS). IPS helps to proactively respond to security threats initiated on the corporate network by smartphones and tablets. Enterprises could extend their existing IPS systems to monitor mobile devices and help deter risks associated with remote attacks.


MDM and Security
Addressing security is a critical component of an effective MDM strategy. Inevitably, you’ll have a laundry list of security issues that must be considered and addressed. You may need to look at security from many perspectives, including how to secure the data on the device, or the security around how a device or use is authenticated prior to enabling access to information or resources, and even how the data being transmitted is secured from tampering and ensuring confidentiality.

Security as it pertains to MDM involves encryption algorithms such as RSA, MD5, and AES. It also involves token services like HOTP, OATH, TOTP. You will need to pay attention to protocols such as HTTPS, LDAPS, and other secure means of transmission. There are also session handlers, Two Factor authentication services, secure delete, and device management capabilities including remote wipe, remote lock, and remote install.

The three major component of a strong MDM security framework are:

  1. Data Access Security Mechanisms
    • User and Device authentication
    •  Authorization and policy enforcement
    • Integration with other token services  that leverages existing identity management infrastructure services to access services such as Salesforce.com or Box.net
  2. Data Storage Security Mechanisms
    • Encrypt data at rest, both on the device as well as on the server side applications and service components
    • Secure delete and the ability to overwrite existing data
    • Protection of keys credentials and tokens used to decrypt data and make the data available for use
  3. Data Transmission Security Mechanisms
    • Establishing a secure connection between the device and the company’s infrastructure
    • Creating and managing sessions for required set of transactions
    • Handling HTTP requests in the appropriate manner
    • Encryption of data transmitted over the channel

Bring it all together
Scaling to support all of the possible mobility enabled devices could incur significant hardware costs and create management complexity. Even though scalability may seem like a distant concern for some enterprises, the proliferation of mobile devices and applications growing at the current rate  will make that concern a reality sooner than later. Enterprises will do well to incorporate long-term scalability requirements into their plans early on.

Luckily, a variety of solutions have emerged to help organizations meet this challenge. Oracle, for example, has a suite of tools that can make it easier for organization to deploy a strong MDM solution. They can even make it easy for employees to onboard their own devices to the corporate infrastructure in split liability mode.

Oracle Beehive is one such tool. It provides an integrated set of communication and collaboration services built on a single scalable, secure, enterprise-class platform. Beehive allows users to access their collaborative information through familiar tools while enabling IT to consolidate infrastructure and implement a centrally managed, secure and compliant collaboration environment built on Oracle technology.

Oracle Utilities for Operational Device Management is another example. It was developed by Oracle solely for the purpose of meeting the needs of asset management for “smart devices.” The software manages devices such as meters, access points or communication relays and communication components attached to various devices that are too complex for traditional asset management systems. It handles critical functions, such as managing and tracking updates and patches, as well as supporting governance and regulatory audits and smart grid Network Operations Center (NOC) processes.

Oracle Platform Security provides an abstraction layer in the form of standards-based application programming interfaces (APIs) that insulate mobile app developers from security and identity management implementation details. With OPSS, developers don’t need to know the details of cryptographic key management or interfaces with user repositories and other identity management infrastructures. Thanks to OPSS, in-house developed applications, third-party applications, and integrated applications benefit from the same, uniform security, identity management, and audit services across the enterprise.

These are just a few examples of the tools available that can help you design and deploy an effective MDM solution. In our next post, we’ll take a look at Mobile Access Management, another key aspect of managing mobile devices in the BYOD age.

About the Author:

Rohan Pinto is a Senior IAM Architect at Simeio Solutions who is responsible for architecting, implementing and deploying large-scale Identity Management, Authentication and Authorization (RBAC, ABAC, RiskBAC, TrustBAC) infrastructures with specific emphasis in Security.


About

Oracle Identity Management is a complete and integrated next-generation identity management platform that provides breakthrough scalability; enables organizations to achieve rapid compliance with regulatory mandates; secures sensitive applications and data regardless of whether they are hosted on-premise or in a cloud; and reduces operational costs. Oracle Identity Management enables secure user access to resources anytime on any device.

Search

Archives
« December 2013 »
SunMonTueWedThuFriSat
1
2
4
5
6
7
8
9
10
12
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
    
       
Today