Push-Email And Mobile enforcement of company policies, secure access - PDF document

in case it gets lost or stolen, enterprises also require easy administration, patching, Push-Email And Mobile enforcement of company policies, secure access Devices In The Enterprise to corporate resources etc. These requirements become more pressing the more capable mobile Siemens AG, Corporate Technology devices become with respect to storage space, CT IC CERT processing power and connectivity. Dr. Heiko Patzlaff heiko.patzlaff@siemens.com A vital feature for the use of smartphones in the enterprise is push-email. The required Sophos PLC infrastructure will be part of the considerations in Vanja Svajcer the following chapters that compare the security of Symbian, WindowsMobile and BlackBerry vanja.svajcer@sophos.com devices. 1. Introduction 2. History of Symbian, Over the last couple of years smartphones have BlackBerry and Windows become an indispensible part of the IT Mobile infrastructure of enterprises worldwide. They are not only used for voice communications but Symbian is a multi-tasking capable microkernel people also use them to check their emails, operating system mainly used on ARM CPUs. It schedule appointments, have access to the has its root in the EPOC operating system of the corporate directory, to store data and even to edit Psion PDA and is maintained and developed presentations and office documents. since 1998 by a consortium of vendors including Nokia, Motorola and Sony/Ericsson. There is no universal agreement on what Symbian is the basis for several competing user constitutes a true smartphone but usually having interfaces, the two most significant being S60 a full feature set according to the above and UIQ. By far the most widespread UI is the description is seen as an indication that separates S60 interface used in Nokia phones. The UIQ a smartphone from the more common feature interface is used by Sony/Ericsson and Motorola. phones and basic phones. The current incarnation of the Symbian OS is The smartphone market, albeit still small version 9.5, released in 2007. Up to version 9.1 compared to the overall phone market, has released in early 2005 the operating system displayed strong growth over the last few years provided only limited security features. and is expected to continue to grow more With version 9.1 a radical break was made which dynamically then the rest of the industry. In 2007 abandoned backward binary compatibility and about 120 million smartphones were sold introduced a new platform security model. worldwide, representing a 10% share of the Although most new phones running on Symbian overall phone market. use the S60 R3 interface which is based on Symbian 9.x, many older models in use are still The security of smartphones is largely running the S60 R2 software. determined by the underlying operating system. The main contenders in this area are Symbian Research in Motion (RIM) introduced the first with a 65% market share, Windows Mobile BlackBerry (BB) device in 1998. BlackBerries based devices with 12%, Research in Motions support PDA and mobile phone features but are BlackBerry with 11% and Apples iPhone with most notable for their push-email functionality. 7% worldwide market share. The market share in The Push-Email feature of BlackBerry utilizes a individual countries such as the United States proprietary protocol and requires a separate differs substantially from these overall numbers. infrastructure component, the BlackBerry Enterprise Server (BES). Whereas BlackBerry The use of smartphones in enterprises puts some traditionally appealed to business users, the extra requirements on the security of these current 8xxx model lineup include the devices. While individuals demand a phone that BlackBerry Curve and the consumer oriented is resistant to hacking attacks, worms and misuse

model BlackBerry Pearl that feature digital concern. Lastly, while an individual user might cameras and music players. rightfully demand full control over the device - how he is allowed to use it, what applications he RIM licenses its email client to 3rd parties can install, which configuration and setup he is including Nokia which gives users the option to to choose - this freedom no longer is seen as a use a range of non-BlackBerry devices in a positive feature if the device is to be operated in BlackBerry infrastructure. a corporate environment. Since the user no longer is the data owner he needs to be restricted Windows Mobile (WM) was originally in the actions he can perform. introduced as the Pocket PC 2000 operating system in 2000. It is based on the Windows CE Various risks impact all three components of a kernel and supports the Win32 API on mobile push-email architecture - the mobile device, the devices. The current version is Windows Mobile transit network and the corporate network. 6.1 based on Windows CE 5.0 but many smartphones in use still run on Windows Mobile The main risks affecting the device are 5.0. Microsoft introduced the DirectPush - loss or theft - technology with its Messaging and Security loss of sensitive data Feature Pack (MSFT) in 2005. DirectPush can be - malware - deployed on an existing Exchange 2003 SP2 unauthorized access (hacking) infrastructure and is supported by all new - unauthorized modifications of security Windows Mobile based devices. Microsoft settings by the user licenses DirectPush to 3rd parties and Nokia as - loss of availability (spam) - well as Apple provide or will provide push-email toll fraud (dialers) support based on DirectPush on their devices. While data is in transit it might potentially be Whereas Symbian and BlackBerry are tied to intercepted, read, blocked or altered. Even if the particular mobile device manufacturers actual content of the exchanged data is protected Microsoft chooses to be device agnostic and a third party might still be able to perform an license its operating system to a range of analysis of the communication patterns that manufacturers. In the past the Taiwanese could reveal vital clues. If for example board company HTC was the main provider of members and other employees start exchanging Windows Mobile based devices. Recently other email with a large outside investment firm this larger companies such as Samsung, could be an indication of a pending carve-out of Sony/Ericsson and Motorola have licensed the a troubled business unit. operating system and provide handsets based on This point is especially relevant if the third party WM. has a holistic view of the traffic as is the case with mobile phone operators or governmental agencies in countries where regulations allow 3. Push-Email Architectures them access to this data. and Risks Lastly, the mobile devices require access to the Whereas a standalone mobile phone poses a corporate network. Enabling this access might potential security problem only for the individual open up holes in the perimeter that can be user the situation changes drastically when it is attacked. being used for accessing corporate resources. All mobile devices have in common that neither The implementation of push-email requires the the end user nor the company deploying them mobile device to become a network endpoint, has the same kind of control as is the case with constantly connected to and exchanging data other computing devices in the enterprise such as with the corporate network. The compromise of routers, laptops or printers. Whereas in the latter a single device therefore impacts the security of cases both hardware and software are provided the whole network. Moreover, with push-email, by third party vendors at least some type of the mobile device exchanges and stores control remains in the sense that the data that potentially sensitive data such as emails, they exchange can be monitored. This is no appointments and contact data. How to secure longer the case with smartphones. Here a large this data on the device and in transit is another part of the hardware and software infrastructure