MOBILE

SECURITYTTYTYi O S

VS.

A N D R O I D

VS.

B L AC K B E R R Y

VS.

W I N D OW S

P H O N E

DeepDiveC

op

yr

igh

t ©

20

15

in

foW

or

lD M

eD

ia g

ro

up.

all

rig

ht

s r

es

er

ve

D.

st

ep

he

n s

au

er

U PDAT E D

Deep Dive

InfoWorld.com Deep Dive series 2PA A S

iOS vs. Android vs. BlackBerry vs. Windows Phone

Deep Dive

2InfoWorld.com M o b i l e S ec u r it y

Google’s Android for Work and Samsung’s Knox promise serious security, but how do they stack up against Apple’s iOS and the rest? By galen gruMan

Mobile

security

Deep Dive

InfoWorld.com Deep Dive series 3PA A S

Apple’s iPhone and iPad long ago pushed

out the BlackBerry as the corporate standard for

mobile devices, in all but the highest-security

environments. earlier this year, google — whose

android platform reigns outside the corporate

world — got serious about mobile management

with a new effort called android for Work. and

samsung upped its the game with a new version

of its android security suite, Knox.

now we have android 6.0 Marshmallow and

ios 9, both of which offer refinements to their

respective existing mobile management capabili-

ties, particularly in the areas of app management.

What’s new in iOS 9released in mid-september, apple’s ios 9 has

very few new policies for managing iphones,

ipads, and ipod touches. But there are a few:

using an mobile device management (MDM) tool,

it admins can now force ios updates as well as

stage their deployment across supervised devices

— corporate-issued devices under full it control.

there are also new policies in ios 9 to control

whether devices can roam on cellular networks,

to enable or disable screen recording, and to

control whether they can use apple’s Mail Drop

feature to send large attachments. (Mail Drop

stores the documents in iCloud and sends the

recipient not using an apple device a link instead

to download the attachment from; apple device

users see the normal attachment in their email,

even if it exceeds their email server’s attachment-

size limits, because apple Mail reattaches the file

automatically behind the scenes.)

for supervised devices only, there are new

controls over apple Watch pairing, the use of

iCloud photo library, keyboard shortcuts, auto-

matic app downloads, and news app setup, as

well as over the users’ ability to change the device

name, password, and wallpaper. those super-

vised policies are designed mainly for shared-use

devices, such as in schools or retailers.

apple’s major changes in ios 9 manage-

ment focus on its Device enrollment program

and volume purchase program services. Dep

is the service to manage fleets of supervised

ios devices and in-house apps, and vpp is the

program to manage corporate apps from the

app store across that fleet of devices.

ios 9 adopts the os X approach to app

management, whereby it can associate a specific

app to any number of devices and/or users,

rather than managing each device’s or user’s

apps independently. apple has also simplified

how Dep catalogs apps, so it can build an app

library without having to poll all devices each

time. apps can now be installed on supervised

devices even if the app store is disabled on

those devices, and in-house apps can be installed

silently, without user confirmation.

What’s new in Android 6.0 Marshmallowthe big change in android Marshmallow is that

its adopts ios’s approach to app permissions.

that means users can now change the permis-

sions that apps have whenever they want, not

just choose those permissions at app installation.

Many users didn’t know what all

those requested permissions meant,

plus they had to accept all or none.

now, users can go to the settings

app to see what permissions each

app uses and revoke or enable each

permission independently.

Better, it can also manage these

app permissions just as granularly

for apps that reside in android for

Work or other managed container

(for ByoD deployments) or on fully

managed (supervised) corporate-

issued devices, notes imran ansari,

android product manager at MDM

Deep Dive

M o b i l e S ec u r it y InfoWorld.com Deep Dive series 3

Get More Mobile Thought Leadership• Samsung Knox 2.4 vs. Google Android for Work

• How to rethink security for the new world of IT

• Real data security for all is now getting its start on mobile

• Mobile and PC management: The tough but unstoppable union

• Mobile management: Making sense of your options

• Unchain your mobile users and just protect the data

• Liquid computing: The next wave of the mobile experience

• Consumerization of IT: How IT should manage personal technology at work

Deep Dive

4M o b i l e S ec u r it y InfoWorld.com Deep Dive series

provider soti.

android Marshmallow’s other

policy refinements are similar in

their incremental nature to ios

9’s. for example, new policies

let it force a device’s screen to

stay on or a Wi-fi connection to

remain active while the device

is plugged in. ansari says that

this feature will appeal to it for

public-facing deployments, such

as for kiosks, payment terminals,

ordering systems, and lobby

sign-in systems.

android Marshmallow also lets admins

disable the use of a smartwatch as an authenti-

cation token, so a smartwatch cannot be used

to bypass a password requirement. and it lets it

force installation of os updates as they become

available, as well as delay those updates for as

long as 30 days, so it can test apps on a new os

version first.

finally, android Marshmallow offers new

policies to control whether users can safe-boot

their device (booting into safe mode can bypass

MDM controls) and to control whether notifica-

tion details can appear on a paired smartwatch’s

screen, to keep company information secret.

What Android for Work does and doesn’t dothe biggest change in android management,

however, came last february with the release

of android for Work as part of an android 5

lollipop update. that technology added new

security and management capabilities, plus the

ability to do corporate deployments of android

apps from the play store.

android for Work containers — which run

business apps in a separately managed work-

space on your device — are part of the android

5 lollipop and android 6 Marshmallow oses

and support any google play store apps. But

android 3.0 ice Cream sandwich through 4.4

KitKat require users to install the android for

Work app, which can run only apps that have

the android for Work apis implemented.

either way, you need a compatible mobile

management server to handle the policies

applied to apps running in the container, such

as enforced vpn use or copy-and-paste restric-

tions. Mobile management vendors supporting

android for Work include BlackBerry, Citrix

systems, google, iBM, Mobileiron, sap, soti,

and vMware airWatch.

What android for Work only partially

addresses is the malware problem among

android apps, both due to the high incidence

of malware residing in the google play store

and to the common file system in android

that lets malware infect apps via data files. for

example, the feds have said that industrial-class

spyware used in advanced persistent threats has

entered the google play market. With android

for Work, it admins can prevent users from

installing unapproved apps from the play store

in the business workspace to better protect the

corporate environment.

By contrast, ios uses rigid sandboxing to

keep apps from accessing other apps, and it

severely restricts document sharing to block

malware. BlackBerry and Windows phone have

small app libraries and a semiporous approach to

sandboxing, so malware has not been an issue

for them to date — though there have been

outbreaks of BlackBerry malware in the past.

android for Work also does not make

encryption the default on existing android

devices (many models, especially the cheap ones,

lack the horsepower to handle encryption).

google promised last october that android

5 lollipop would enable encryption by default

on all new devices. (upgraded devices’ encryp-

tion state is unchanged.) But there’s no require-

ment that the devices use a crypto chip, so users

could see major performance hits. infoWorld’s

Apple’s approach is to handle apps and their contents directly, which means app developers must implement the APIs for a management server to be able to work with them.

Android for Work capabilities

A two-page guide to the management capabilities that Android for Work enables IT

admins to apply to content and apps. s o u r C e : M o B i l e i r o n

D o W n L o A D

Deep Dive

5M o b i l e S ec u r it y InfoWorld.com Deep Dive series

policy

AppleiOs 7, 8, 9

GoogleAnDrOiD 4, 5, 6

SamsungAnDrOiD 5 + KnOx

BlackBerryBlAcKBerry 10

MicrosoftWinDOWs phOne 8, 8.1

Allow device encryption yeS yeS yeS yeS yeS

require device encryption yeS yeS [1] MDM yeS yeS

encrypt storage card NA yeS yeS yeS yeS

Minimum password length yeS yeS yeS yeS yeS

Minimum number of complex characters (password)

yeS yeS yeS yeS yeS

password history yeS yeS yeS yeS yeS

Device wipe threshold yeS yeS yeS yeS yeS

Disable removable storage MDM No MDM MDM No

Disable camera yeS yeS yeS MDM No

Disable sMs text messaging No No MDM MDM No

Disable Wi-Fi MDM No MDM MDM yeS [2]

Disable Bluetooth MDM No MDM MDM No

Disable irDA NA No No No No

require manual sync while roaming

yeS No yeS MDM No

Allow internet sharing from device

MDM No MDM MDM MDM

Allow desktop sharing from device

MDM No MDM No No

Disable email attachment access

yeS MDM yeS No yeS

Disable pOp3/iMAp4 email MDM No MDM yeS No

Allow consumer email No No MDM yeS No

Allow browser yeS MDM MDM No MDM

configure message formats (hTMl or plain text)

No No MDM No No

include past email items (days)

yeS No MDM yeS yeS

email body truncation size (KB)

No No MDM No yeS [2]

hTMl email body truncation size (KB)

No No MDM No yeS [2]

include past calendar items (days)

yeS No MDMyeS No

require signed s/MiMe messages

yeS No MDM MDM yeS [2]

require encrypted s/MiMe messages

yeS No MDMMDM yeS [2]

require signed s/MiMe algorithm

yeS No MDM MDM yeS [2]

require encrypted s/MiMe algorithm

yeS No MDMMDM yeS [2]

Allow s/MiMe encrypted algorithm negotiation

yeS No MDMMDM yeS [2]

Allow s/MiMe soft certs No No yeS MDM yeS [2]

ExchAnGE ActivESync (EAS) policy Support coMpArEd

( “ M D M ” M e a n s a s e pa r at e M o b i l e D e v i c e M a n a g e M e n t s e r v e r i s r e q u i r e D )

[1] storage areas only. [2] Windows phone 8.1 only.

Deep Dive

InfoWorld.com Deep Dive series 6M o b i l e S ec u r it y

sister publication greenbot found that google’s

own nexus 6 slows to a crawl with encryption

on, for example.

of particular concern to it, google has quietly

backtracked on its promise that new lollipop

devices would be encrypted by default. in fact,

several new lollipop devices are not. the new

android Marshmallow also does not enforce this

promised encryption.

By contrast, ios devices have been encrypted

by default (with no disable option) since 2010,

and BlackBerry devices have been encrypted for

at least a decade — both have the needed crypto

chip to avoid performance hits. But Windows

phone 8.1 devices come with encryption disabled

by default, and an admin must enable it.

(Windows 8.1 is the first version of Microsoft’s

mobile platform to support device encryption.)

it’s unclear whether the forthcoming Windows

phone 10 will enable encryption by default.

Knox aims for corporate-issued Android usersannounced two years ago, samsung’s Knox

has had a difficult rollout and now has google’s

android for Work competing with it. But the

company has stuck to the product, quietly

unveiling the new Knox 2.4 version this month.

Knox works only with selected smartphones

and tablets from samsung, because it integrates

directly with the hardware in a way similar to

how BlackBerry does for its own smartphones

and Bes management server. thus, Knox is a

realistic option only for companies that issue

compatible samsung devices to employees.

for such companies, Knox 2.4 (which runs

only on android lollipop devices) provides active

Directory password integration for its secure

workspace, bulk enrollment of devices over the

air, and the ability to track users’ business and

personal data usage.

Mobile device management has essentially stabilizedgoogle’s android for Work move came on the

heels of the efforts of Microsoft to improve the

security of Windows phone, which historically

has had weak security and management capa-

bilities. Windows phone 8.1, released last fall,

finally gave the Microsoft smartphone platform a

reasonable level of basic capabilities, though well

behind what other mobile platforms provide.

BlackBerry devices have long offered mobile

device management (MDM) controls in the oper-

ating system and key bundled apps to manage

user permissions. ios added such capabilities in

2010. android followed a few years later, and

in fall 2014 Windows 8.1 was the last major

mobile os to provide a strong set of device-

management apis. (BlackBerry devices also

provide a secure network and chip-level antide-

vice spoofing, which competitors don’t have and

are key reasons that high-security environments

rely on BlackBerry still.)

With the market for BlackBerry devices fading

fast, BlackBerry has focused on reshaping its

formerly BlackBerry-only Bes tool into a unified

mobile management tool, BlackBerry enterprise

service (Bes) 12, for managing ios, android, and

Windows phone 8 devices — all widely supported

by other MDM tools — in addition to its current

BlackBerry 10 and legacy BlackBerry 5 and 7

devices. But Bes12 has failed in the market-

place, causing BlackBerry to buy long-time MDM

provider good technology instead.

also, ios, android, Windows phone 8, and

BlackBerry 10 all support Microsoft exchange

activesync (eas) policies, which provides basic

but common cross-platform management for

less-rigorous security environments that it can

administer from an exchange server, office

365, google at Work, lotus notes, or Microsoft

system Center, as well as from any MDM server.

table 1 shows which policies are supported by

each major mobile platform.

Content and app management is where mobile security is now focusedthese days, the mobile management vendors’

focus is on content and application security since

device management is all but settled. apple’s

ios 7 apis were the first to address the issue at a

platform level, providing standard apis for apps

to use to manage their content and usage.

apple last made a big leap in mobile security

and management in 2013, when ios 7 pushed

apple’s management and security into new

areas, including application management and

APIs vary widely across the major mobile OSes, and each requires a management tool. Most MDM tools support multiple mobile OSes, providing a single console for IT admins.

Deep Dive

InfoWorld.com Deep Dive series 7M o b i l e S ec u r it y

capabilityAppleiOs 7, 8, 9

GoogleAnDrOiD 4, 5, 6

SamsungAnDrOiD 5 + KnOx 2.4

BlackBerryBlAcKBerry 10 Bes12

MicrosoftWinDOWs phOne 8, 8.1

encryption AeS 256, user has no disable option

AeS 128, user has disable option, only some models support encryption

AeS 256, user has disable option, only Knox devices support encryption

AeS 256, user has disable option in personal workspace

AeS 256, user has no disable option

Fips 140-2 certification yeS (level 1)

No SoMe MoDelS (level 1)

yeS (level 2)

yeS (level 1)

Over-the-air data encryption yeS yeS yeS yeS yeS

s/MiMe yeS No yeS yeS yeS [2]

vpn yeS yeS yeS yeS yeS [2]

configure vpn yeS yeS yeS yeS yeS [2]

per-app vpn yeS yeS [3] yeS yeS yeS [2]

restrict/block app stores yeS No yeS yeS yeS

Business licensing and provi-sioning

yeS yeS [3] yeS [3] yeS No

restrict/block wireless lAns yeS No yeS yeS yeS [2]

configure allowable access points

yeS yeS yeS yeS yeS [2]

signed apps required yeS No yeS yeS yeS

selective wipe of business apps and data only

yeS yeS [3] yeS yeS yeS [2]

remotely update business apps

yeS yeS [3] yeS yeS yeS

secure boot yeS yeS [1] yeS yeS yeS

Active Directory container signin

NA No yeS [3] No No

App sandboxing yeS yeS yeS yeS yeS

Disable copy and paste yeS yeS yeS yeS yeS [2]

Disable icloud/Microsoft Account/Google Account sync and storage

yeS No yeS yeS yeS [2]

Disable data roaming yeS [4] No No yeS No

Disable smartwatch pairing yeS [4] yeS [5] yeS NA NA

othEr nAtivE MAnAGEMEnt cApABilitiES coMpArEd

( t y p i c a l ly r e q u i r e s a M o b i l e D e v i c e M a n a g e M e n t s e r v e r t o u s e )

licensing management. the recent ios 8 and ios

9 have only a few additions.

apple’s approach is to handle apps and their

contents directly, which means app developers

must implement the apis for a management

server to be able to work with them. furthermore,

ios allows only one instance of an app on a

device, so users can’t install a personal copy free

of restricts and a business copy managed by it.

apple didn’t invent the api-managed apps

notion; in 2011 several startups offered mobile

application management technology that required

[1] added by some smartphone makers. [2] in Windows phone 8.1 only (and vpn support is partial). [3] in secured container only. [4] supervised devices running ios 9 only. [5] android 6 only.

Deep Dive

InfoWorld.com Deep Dive series 8

It’s a no-brainer that iOS and BlackBerry OS have what it takes for almost any business’s security needs.

M o b i l e S ec u r it y

app developers to implement proprietary apis

and proprietary management tools. they went

nowhere. apple’s approach in ios 7 makes the

technology available to all apps and all manage-

ment servers, eliminating the lock-in barrier.

since then, most vendors have taken the

containerization approach, which essentially

partitions it-managed apps and the data they

work on, into a separate workspace not acces-

sible by the user’s personal apps. users have to

switch between the two workspaces, as if they

were using two devices.

for years, several providers such as Divide have

offered such containers for ios and android, but

they required that the apps running in them be

tied to their proprietary apis, which in turn were

tied to a specific vendor’s mobile management

server. thus, they’ve gained little adoption.

in 2013, samsung announced a container

technology called Knox that was available

for a handful of its galaxy smartphones and

supported by few mobile management servers,

so it too has gained very little adoption. But the

company is renewing its Knox effort with the 2.4

version released on april 10, 2015.

also in 2013, BlackBerry introduced

BlackBerry Balance, the first platform-level

containerization approach, for BlackBerry 10

devices. it also has a Balance container app,

called secure Work space, for ios and android.

in spring 2014, google purchased contain-

erization vendor Divide and later said it would

make containerization part of android — now

the android for Work technology that became

available in february 2015.

Container policies differ widely from

container to container, which can make manage-

ment difficult. however, now that popular

mobile management servers support both ios’s

apis and android’s containers, it admins should

be able to create consistent policies that are

largely compatible across the two platforms

— much as they can when using the extended

device management apis in ios and android.

note that BlackBerry’s Bes12 supports some

of the ios 7 app-management apis, few than

those from, for example, Citrix, Mobileiron, and

vMware airWatch. among the ios 7 app poli-

cies supported by Bes12 are per-app vpn, single-

app mode, single sign-on, and apple volume

purchase plan (its corporate app store).

Bes12 supports some app-management apis

for BlackBerry devices, but the policies available

vary widely based on the type of app managed:

Java, recompiled or fire os-compatible android,

BlackBerry 5- or 7-native, or BlackBerry

10-native. frankly, it’s a mess.

Native security and management API capabilities comparedas noted previously, the platform apis vary

widely across the major mobile oses, and each

requires a management tool. Most MDM tools

support multiple mobile oses, providing a single

console for it admins.

some also offer client apps — basically, a

proprietary container with proprietary business

and communications apps — that add capabilities

not found in the native apis. table 2 shows some

of the more commonly requested management

features typically implemented through apis.

ioS APi tour. apple, for example, has

several dozen apis for device management that

use remotely installed configuration profiles not

only to configure various ios settings (such as

preconfiguring vpn or allowed access points)

but also to manage app behavior (such as disal-

lowing the forwarding of corporate messages via

personal accounts in Mail). app-related policies

include the ability to prevent app removal, lock

a user to a specific app (such as for kiosk or

retail usage), and prevent paid apps from being

purchased. all are part of what ios calls a super-

vised environment, in which the iphone or ipad is

treated as an appliance.

ios’s apis for application management

include managed open in, per-app vpns,

managed copy and paste across apps, and single

sign-on, as well as true license management and

profile-based app installation. ios 8 also has apis

to disable the new handoff capability, iCloud sync

for managed apps, backup of enterprise books,

and annotation to enterprise books. supervised

devices also get the ability to disable erasure of

all content and settings, restriction configuration,

and presentation of Web results in a spotlight

Deep Dive

InfoWorld.com Deep Dive series 9M o b i l e S ec u r it y

search. ios 8 supported per-message s/MiMe

and both iKev2 and always-on vpns, as well. ios

9 adds several features, as previously described,

such as control over cellular roaming, use of

MailDrop, and ios updates.

Android APi tour. although google

hasn’t published details of its android at Work

apis on its android developer or it admin sites,

alexander romero, an android engineer at

Mobileiron, walked me through them.

to address the android malware problem,

android at Work can let it restrict the provi-

sioning of apps in the business workspace to

only those approved by it. that means users

can’t install apps themselves in the secured

workspace if it enables this policy. it can also

install, update, and remove apps in the business

workspace without user involvement.

there are policies to disable copy and paste

from the business workspace into the personal

one (but not vice versa) and to prevent screen-

shots being taken in the business workspace. it

can also determine which it-managed apps use a

vpn for access, as well as retract personal apps’

communication from the corporate vpn.

android Marshmallow adds, as previously

noted, a few policies, such as to deploy os

updates to managed devices and to manage app

permissions.

google also says the google play app store

can now provision apps to android devices

through volume business licenses, similar to

apple’s volume licensing approach introduced in

ios 7. Called google play for Work, the revised

app store supports free apps already and will

“soon” support paid apps.

samsung had its own set of device apis

for android 4 called safe apis, which allow it

admins to disable cameras, Bluetooth, tethering,

voice recording, sD cards, and Wi-fi. you have

to use a safe-compatible device and manage-

ment server to use those extra policies. the safe

apis were replaced with its similar Knox apis in

android 5.

Windows phone Api tour. in Windows

phone 8, Microsoft supports the ability to revoke

applications, restrict email forwarding, remotely

enroll or unenroll devices, and remotely update

business-provisioned apps.

one capability in Windows phone 8 not

available to other mobile oses is its integration

with active Directory. this means that compat-

ible MDM tools can access the active Directory

groups, then assign policies to those groups

rather than maintain a separate set of groups in

the MDM tool from the set in active Directory.

the feature reduces the risk of employees not

being in the correct groups for the policies that

should apply or falling through the cracks when

terminated in, say, active Directory but not in the

MDM tool’s user database.

Microsoft uses a central manager in

Windows phone 8 called DM Client that contains

all the relevant user and corporate profiles (like

the Windows registry, in effect), rather than

rely on a set of separate installed configuration

profiles (like the os X system folder, in effect).

How to think about mobile device managementno matter what platforms you support, there are

three bands of management requirements for it

to think about, advises ojas rege, vice president

of strategy at Mobileiron.

the first set of requirements is around

configuration and protection of lost or compro-

mised devices. that typically requires password

enforcement, encryption enforcement, remote

lock and wipe, remote email configuration,

certificates for identity, remote connectivity

configuration (such as for Wi-fi and vpns,

though rege says this configuration capability is

not essential if usage is only for email and over

cellular networks), and detection of compro-

mised oses (whether jailbroken, rooted, or

malware-infected).

the second set of requirements is around

data loss prevention (Dlp), which covers privacy

controls (such as for user location), cloud-usage

controls (such as for iCloud, oneDrive, and

google Docs), and email Dlp controls (such as

the ability to restrict email forwarding and to

protect attachments). “More regulated environ-

ments may require no. 2, and these policies

are still tBD for Windows phone,” rege notes.

By contrast, ios, BlackBerry, and android have

supported most of these needs since (respec-

tively) ios 4, Bes 5, and android 3, though a few

Deep Dive

InfoWorld.com Deep Dive series 1 0M o b i l e S ec u r it y

— for example, managing email forwards — are

handled outside the os by MDM client apps

such as Mobileiron’s.

the third set of requirements is around apps,

such as their provisioning and data security. Both

apple and Microsoft have mechanisms to do at

least basic app management — ios can essen-

tially hide an app so that it’s no longer available

to a user, and Windows phone 8 can update

corporate apps remotely — and both google

and samsung now offer this capability within

their secured containers.

But mobile application management (MaM)

capabilities are mostly still up to the mobile

management vendors to deploy and can vary

widely across MDM tools, rege says.

all four platforms provide mechanisms for

businesses to deploy their own apps directly to

users, so they can deploy and manage corpo-

rate apps separately from those that users get

from the app store. (apple, google, and now

samsung have volume licensing and distribution

mechanisms in place.) Mobile management tools

can connect these mechanisms to group policies

and content-management controls.

it’s a no-brainer that ios and BlackBerry os

have what it takes for almost any business’s

security needs, even if it doesn’t have much in

the way of apps that would make users want

it. android, especially with android for Work or

Knox 2.4 or later in use, is a plausible platform

— and they reduce the malware potential at

least in the secured container part of the device.

and Windows phone, which has long held

down the rear, is becoming more appropriate for

midlevel security requirements. n

Galen Gruman is an executive editor at

infoWorld and its columnist on mobile and

consumerization of it.

Deep Dive

InfoWorld.com Deep Dive series 1 1

Mobile and PC management: The tough but unstoppable union

M o b i l e S ec u r it y

One day, you’ll manage all client devices from a central

policy console, but it won’t be a fast or easy journey

By galen gruMan

You know that a trend has peaked when the

establishment jumps on board. that’s happening in

the world of mobile management, pioneered years

ago by niche companies such as good technology

and Zenprise and startups like Mobileiron and

airWatch. now, establishment companies such as

Ca technologies, Citrix systems (which bought

Zenprise), Dell, eMC vMware (which bought

airWatch), iBM, and Microsoft are aggressively

pushing their mobile management tools.

Just as the establishment is getting into mobile

management (aka MDM), the field itself is poised

for a shift away from mobile only. tablets, both

the category-defining ipad and the “deconstructed

laptops” promoted by Microsoft and other

Windows device makers, are both like smartphones

and like laptops. for some people, they replace

laptops; for others, they supplement them. in any

event, the lines between computers and mobile

devices are blurring.

even where there are clear divisions, users are

working with multiple devices. suddenly, any sepa-

ration on the management side gets hard to keep

separate in reality — password, access, and other

policies overlap hugely, no matter if the tools don’t.

st

ep

he

n s

au

er

Deep Dive

InfoWorld.com Deep Dive series 1 2

That’s why MDM is shifting away from mobile to encompass anything and everything a user might access: smart-phones, tablets, computers, even cloud desktop services.

M o b i l e S ec u r it y

that’s why MDM is shifting away from

mobile to encompass anything and everything

a user might access: smartphones, tablets,

computers, computers, even cloud desktop

services. some are personally owned, some

are work-owned, most are mixed-use in prac-

tice. they cover a range of operating systems:

multiple versions of Windows, os X, ios, and

android for sure, perhaps linux, Windows

phone, Chrome os, and BlackBerry os as well.

But getting to that state of universal

client management is not easy. fundamental

technology differences exist on these clients,

affecting what can be secured and managed

and how it can be secured and managed. still,

vendors are moving in that direction because,

they say, large businesses have decided that in

the not-too-distant future they would like to end

the separate pC and mobile silos and manage

devices collectively.

When it comes to management, Windows is not like the othersWhat would it take for a tool to truly be unified?

the reality is that Windows is managed using

very different technologies and assumptions than

the other popular operating systems are. the

reasons are historical and deep: “in the carrier

context for mobile, you couldn’t worry about

the os — the carriers did it. But in Windows,

you always had the control over it,” recalls neal

foster, executive director of product marketing

for mobile management at Dell.

outside of Windows and BlackBerry’s tradi-

tional Bes, the typical approach is to deliver a

payload to a device containing policies. from

there, the device implements those policies

through its standard apis. it’s an approach that

Ca’s varadarajan calls simplex: you push out

the policy package and it gets implemented

whenever the device receives and “digests” the

payload. When the device later tries to access

your servers, a policy check is done to see if the

correct policies are in place.

this payload approach is great for mobile

devices because you can issue them whether

or not you have a connection — in fact, you

can issue them when you don’t have a connec-

tion, so you don’t have to provide a safe space

first to even deliver the policies. But you have

no constant monitoring such as for compliance

auditing; you only know when a device tries to

connect what policies it reports are installed.

apple and others have made such payloads

undeletable by users, but it lacks the constant

assurance that some industries seek.

Windows assumes a very different world, one

where computers are inside a trusted firewall,

don’t leave the trusted network, and in fact are

treated as an attached node, not an occasional

guest. that’s the fundamental notion behind the

domain join managed through active Direc-

tory and system Center. of course, over time

as laptops became popular, Windows manage-

ment had to adapt to handle access over outside

networks, typically using vpns to extend the

trusted network through the internet.

the domain-join approach allows for more

active engagement between the client and the

server, as well as for more constant auditing. But

it does poorly in the in-and-out world of mobile

devices, which explains why even Microsoft hasn’t

used the domain-join approach in Windows

phone and Windows rt. “the domain join for

pCs implied a context for environment,” says

Dell’s foster, “but more and more, pCs are not

connected via a domain, so that context is gone.”

it’s telling that Microsoft doesn’t use domain

joining in its mobile-oriented mobile manage-

ment tool, intune. instead, it uses a client app

on the pC that basically consumes the payloads,

then configures Windows accordingly and acts

as a safe space, similar to the sandboxes used

natively in ios and os X and via third-party soft-

ware in android.

over time, the payload approach may

become the standard approach, even in

Windows. Microsoft’s Windows os team

declined to speak to infoWorld about its views

on management, and the server group didn’t

want to speak for the os group. But “with

Windows 8.1, it’s possible to manage a pC like a

mobile device, such as by laying down an agent

to do system Center stuff or use a management

api. Windows rt does that, too,” says andrew

Conway, director of product marketing at Micro-

soft for Windows server and system Center. yet

Windows phone 8.1 does support domain joins,

Deep Dive

InfoWorld.com Deep Dive series 1 3

Most companies don’t manage desktop and mobile from the same team.”rAM vArADArAjAN, general Manager at Ca

M o b i l e S ec u r it y

so Microsoft may also be trying to keep both

approaches available as the market continues to

experiment.

The path to unified management Certainly, the MDM pioneers see the shift to

unified management coming, and several have

expanded their mobile offerings to include Macs,

since apple has unified many of the apis across

ios and os X to simplify the process. Many

partner with other providers to offer not a truly

integrated suite to cover pCs and mobile, but a

twinned product set that allows some sharing or

coordination of policies.

But it’s the establishment providers who are

most active in trying to reconcile the desktop

and mobile worlds into a common management

environment, covering everything from asset

tracking to security policy enforcement, for a

simple reason. these establishment providers

typically have Windows-oriented tools, covering

the vast majority of client devices in the work-

place and providing a starting point most

familiar to it: Windows pCs. (Microsoft says that

70 percent of enterprises today use its system

Center for that purpose.)

their offerings run the gamut from pairing

two separate tools with some commonalities,

such as policy sharing or common admin console,

to a single tool that handles client differences

behind the scenes. Most organizations still

have separate teams managing pCs and mobile

devices, and the single-tool approach works only

when an enterprise ends that separation.

“Most companies don’t manage desktop and

mobile from the same team. Desktop manage-

ment has been around a long time, and pC

management is considered a normal activity,

whereas mobile is considered something new

and done by a separate team,” notes ram

varadarajan, general manager at Ca. “We’re not

seeing a propensity to go to one management

system in one shot, but as a phased evolution,”

says Dell’s foster.

that poses a chicken-and-egg dilemma for

providers. right now, mobile devices are managed

by a different team than pCs are. Mobile devices

quickly fell into the domain of exchange admins

as the early mobile use cases were around email,

and apple adopted Microsoft’s exchange active-

sync protocol as its default management tech-

nology, which google then did for android.

thus, it organizations typically seek two

tools even as they talk about eventual unifica-

tion. “We’re seeing a trend toward more unified

management,” notes Microsoft’s Conway. “Most

corporations don’t want this island of mobile any

more; they want to treat it all as one,” says Ca’s

varadarajan.

But until they unify the it teams, a unified

tool doesn’t make a lot of sense. the answer, of

course, is for it to centralize the management

team first, bringing whatever tools are in place

to that unified team. from there, it can consider

replacing those tools with a unified management

tool as vendors begin to provide them.

Ca, Dell, and Microsoft are good examples of

how management providers are trying to move

to a unified management approach. Chances are

that the providers you’re talking to or working

with fall within the continuum they represent.

Ca is looking to provide a single console

for all management, notes varadarajan. the

platform differences get hidden behind the

scenes, and the easiest places to unify are where

platforms share policies even if their execu-

tion differs. “We do see already a common

management tool for os X and Windows. ios

and android are not that different,” he says,

suggesting that the unification challenge is easier

than you may assume because there’s already

some convergence across platforms on key attri-

butes. “sure, the measures and implementations

we use might be different. for example, we have

different agents on Windows, os X, and mobile,

but they do largely the same things.”

in other words, providers will need to fork

their tools internally. “forking is a skill that is

underrated, but it has to be embraced for higher

goal of uniformity,” varadarajan says. as an

‘‘

Deep Dive

InfoWorld.com Deep Dive series 1 4

Hoping to impose a common set of devices, appli-cations, and services is a pipe dream. But that doesn’t mean IT shouldn’t seek unity.

M o b i l e S ec u r it y

example, “os X and ios use many of same apis

but different semantics. i expect the same thing

in android pCs over time, and i can see the

possibility in Windows given Windows phone’s

big differences with pC Windows.”

of course, some policies simply don’t apply

to some devices, but a unified tool would know

that and would ignore irrelevant policies while

flagging policies that are relevant but can’t be

deployed to a specific device. a crude example

of that is apple’s os X server, whose manage-

ment console arranges its policies in three

groups: ios, os X, and ios and os X. enterprise-

class tools will treat these differences more

elegantly, but they will exist.

varadarajan also notes that the client isn’t

the only part of the equation. you have servers

and network appliances, and they can do a lot of

the work when devices connect, such as moni-

toring traffic, validating access, and enforcing

policies on the server side directly. Back-end

management is key to unified device manage-

ment, because all the devices work through that

back end, which is the gateway to the company

information and services.

Microsoft is taking two paths: extending

its traditional system Center to the new, more

intermittent world and delivering a payload-

oriented tool via intune. But it’s not an either/or

proposition. intune can be used to manage pCs,

not just mobile devices, via a client app, though

its primary use case is for mobile devices, notes

Microsoft’s Conway. the pC-focused system

Center can be used in concert with intune

on mobile devices, so system Center handles

the asset management and configuration and

intune handles the deployment of security and

device policies.

Windows 8.1 starts Microsoft’s pC os down

the path that apple began with os X lion: using

apis for mobile-style payload-based management.

Dell’s approach is the most traditional: it has

a basket of specific tools for various manage-

ment needs, some for mobile, some for pCs,

some for both. Customers pick the tools they

need, whether or not their teams are unified,

and Dell offers consulting services to integrate

the tools for the customer’s specific needs.

“We’re finding that customers are all very

different, so there’s a lot of custom work, à la

professional services,” says Dell’s foster.

Unified management does not mean managing a unified technology stack the computing world is one of heterogeneity, a

mix of device types, operating systems, applica-

tions, and services. the notion that everyone

uses a standard pC with a standard os image

and application set is quaint — and on its way

out. “you have to embrace heterogeneity. if you

are angry with heterogeneity, you are doomed,”

says Ca’s varadarajan.

Cloud storage is a great example of that

notion, says Dell’s foster, citing office 365,

google Drive, and apple iWork. “But no one

does it all well, so users tend to mix and match.”

that same mixing and matching applies to

applications, devices, and other services because

no single platform does everything well. that’s

going to be a true for a long time, especially

because technology has gotten so personal that

there is rarely one best set of tools even for

people doing similar jobs.

hoping to impose a common set of devices,

applications, and services is a pipe dream. But

that doesn’t mean it shouldn’t seek unity. it

just needs to look elsewhere. Common poli-

cies are one place to look. But there are others.

“the greatest thing that has been adopted are

single-sign-on models like oauth and saMl. so

the way you get control is not by proxying but

managing the access in the first place,” foster

says. you pair that higher-level standardization

with what foster calls “endpoint posture” —

ensuring that permitted devices meet your stan-

dards on issues such as passwords, encryption,

data isolation, and identity validation — then

you put both in a common policy framework on

permitted access based on role and other factors.

ironically, the path to unified management

goes through an embrace of diversity and

heterogeneity. there are enough commonalities

to create a management fabric. But both the

vendors and it need to approach it that way. n

Galen Gruman is an executive editor at

infoWorld and its columnist on mobile and

consumerization of it.

Deep Dive

InfoWorld.com Deep Dive series 1 5M o b i l e S ec u r it y

PC sales continue to decline, mobile

sales continue to climb, people work at

home, and the notion of strict work/life

separation for equipment is on its way

out for many information workers.

yet most it organizations and

security vendors insist on applying

legacy thinking for information security

that simply cannot work in the modern world of

heterogeneous, anywhere, and mixed personal/

business computing. they keep trying to build

mobile prisons, extending perimeter defenses

across the digital world or creating satellite

fortresses on every device. no one willingly

enters a prison, and the gulag and straitjacket

approaches favored by it and security vendors

simply will be bypassed by business users,

who’ve been doing so for years on the desktop.

it’s time to stop the madness and protect

what really matters: the information that moves

among all the devices. to do so, the industry

needs to stop trying to turn smartphones into

fortresses that people can’t use and forcing the

use of proprietary app containers that can’t scale

a heterogeneous, interconnected digital

environment or that provide read-only

access (what’s the point, then, of having the

file?). instead, it’s time we focus on protection

at the information level, essentially using the

notion of digital rights management (DrM) that

travels with the data itself. the only way to make

that work is through an industry standard.

there are two great models for how this can

work. one is Microsoft’s exchange activesync

(eas) protocol, which provides a de facto stan-

dard for basic device security that ensures good

security hygiene such as forced device encryption

and enforced password use. this single protocol,

if broadly adopted, gets rid of most of it’s often-

stated “what if the user loses the device?” fear.

the other is the Wi-fi alliance, the group

ensuring interoperability of the 802.11 devices

that in the beginning could not talk to each

other though they were based on the same ieee

standard. the alliance is now trying to create

the same assurance of interoperability for video

streaming via its Miracast standard. By having an

interoperable information-level security standard,

Unchain your

mobile users

and just protect

the data

IT and the security industry are both focused on dubious protection plans. This proposed standard shows a better wayBy galen gruMan

Deep Dive

InfoWorld.com Deep Dive series 1 6

Authoring and editing tools should be able to assign both usage rights and two of the access rights: the password require-ment and the encryption requirement.

M o b i l e S ec u r it y

it would be assured that critical information

remains protected no matter what apps are

accessing it and no matter on what devices.

today, we have a muddle of competing

proprietary standards from more than a dozen

companies. their containers typically work only

with it-developed apps that use their specific

api and management tool, and sometimes

with commercial apps that adopt that propri-

etary technology. that proprietary nature puts

everyone at risk: it and developers are wed

to a single company in a frothy market where

vendors come and go. users are severely limited

in the apps and devices they can use — most

of these systems, for example, don’t work on

Windows or os X, even though pCs remain

the biggest source by far of data loss, whereas

mobile is a minor factor.

some in the security industry understand

that today’s mobile device management (MDM)

and mobile application management (MaM)

tools can’t both protect information and support

realistic work scenarios. Mobileiron, for example,

has floated the idea of an industry standards

group to define an information-level security

standard. it’s a good suggestion, but it should

not be limited to mobile — and it needs to work

like the Wi-fi alliance in that it doesn’t become

a lip-service standards group vendors use to

delay interoperability in hopes their proprietary

platform might “win” in the meantime.

any such standard also needs to avoid scope

creep. there’s a place for MDM (the equivalent

of having locks on your doors and an alarm

system, a first level of defense), but it should

not get commingled with an information-level

security standard. there’s also a place for MaM,

for organizations that need to essentially convert

commercially available computing platforms

into appliances, such as retailers or public safety

organizations. But it too should not get commin-

gled with an information-level security standard.

We don’t need a theory of everything; in fact, it

would assure that nothing ever happens.

What the InfoTrust standard should do instead, the information-level security stan-

dard — let’s call it infotrust — needs to do the

following:

provide basic usage rights. usage rights

need to be embedded in documents, so they

move with the document. adobe acrobat is an

example of a file format that support this notion,

and all popular file formats and productivity

apps — Microsoft office, libreoffice, openof-

fice, apple iWork, google Docs/Drive/apps, and

so on — need to offer similar usage rights that

transport from one app to another. the rights

should include:

• restrictions on previewing content

(such as in os X’s, ios’s, and Windows’

document-preview capabilities)

• restrictions on changing content

• restrictions on copying content

• restrictions on changing and/or

assigning usage rights and access rights

enforce basic access rights. it shouldn’t

be an endpoint device’s or app’s responsibility to

control access to content, the approach used by

many MDM and MaM products today. instead,

the documents should carry the access require-

ments with them, so the apps can validate

access. the requirements should include:

• password access (as acrobat and office

today support)

• policy access (such as requiring it be in

an encrypted environment or be open

able only by people in a specific active

Directory group)

Allow local policy management. authoring and editing tools should be able to

assign both usage rights and two of the access

rights: the password requirement and the

encryption requirement. that way, small busi-

nesses such as law offices can protect their docu-

ments directly, and trusted employees can share

documents with others outside the corporate

environment (freelancers, contractors, business

partners, governments, and so on).

Apply to all platforms, not just mobile. another key principle is that infotrust is not a

mobile information security standard. it’s for all

devices: smartphones, tablets, computers, cloud

services, and platform technologies yet to be

invented. again, it’s not about the device, but

the information, which flows across all sorts of

devices and apps. the device, app, and service are

irrelevant, unless they don’t support the standard.

Deep Dive

InfoWorld.com Deep Dive series 1 7

Identity manage-ment needs to be done at the source. That means InfoTrust needs APIs to commu-nicate with existing enter-prise identity management tools.

M o b i l e S ec u r it y

operating systems, applications, and cloud

services will need to support infotrust to act

on the embedded policies in the documents,

just as they need to support eas today to apply

password and encryption policies. But as a

lingua franca that enables full participation in

the emerging world of anywhere computing, the

key vendors have every reason to participate and

not end up being excluded. the tech industry

has plenty of examples of what happens when

companies delay joining such essential band-

wagons — just ask what used to be novell or

iBM’s former lotus group.

not manage more than is necessary. note what’s not included: controls over sharing,

an encryption option, controls over allowed

applications, access management, and identity

management. sharing controls are not needed

because the documents carry their own permis-

sions; if they are shared (lost, stolen, emailed,

copied to a thumb drive, whatever), the

receiving party has to satisfy the access require-

ments to gain access. it’s the same notion as

trusting that encrypted documents are safe in

today’s privacy-breach regulations. speaking of

encryption, that means the documents are auto-

matically encrypted, unless they have no access

rights applied.

there’s also no need to worry about what

app or service that users have on whatever

device or computer they’re working with. if

the app doesn’t support the access and policy

requirements, the document can’t be opened

in that app — end of problem. the goal, as my

colleague terry retter likes to characterize it, is

the ability to be secure even when operating in

the middle of times square.

if a business has other reasons to enforce

the use of specific apps (such as for compliance

logging or to monitor and control distribution of

supersensitive documents), it should use a MaM-

style tool to restrict users to that tool for those

specific documents that need the extra compli-

ance. But there is no reason to burden everyone

for such a subset of use cases.

today’s MaM and MDM tools are essentially

network-based, requiring a device or app to

check in with a central server to validate and

even enforce its permissions and policies. that’s

not scalable for information management — you

can’t require a server call every time a document

is opened or is acted upon when in use. yes,

sessions can preserve the policies when offline,

but that’s cumbersome and is of no help when

you’re offline before you open the document.

network-based validation needs to be required

for only the most critical documents.

instead, access management has to be

done at the source, so enterprises need to use

tools like sharepoint or any of the many other

information repository systems to control who

gets access in the first place. that doesn’t mean

repository systems need to be the distribution

points, of course — the repository simply needs

to add the permissions to the documents based

on whatever policies it wants to set using the

policy management tools of their choice. that

way, if a document is emailed, its policy goes

with it. that’s much more secure than today’s

situation, where if anyone gets a document out

of the managed repository, it’s now free and

clear of all policy attributes.

Dozens of vendors who do such policy-based

management tools could adopt infotrust. they

could also extend its capabilities in the same way

that apple’s ios and os X use Microsoft eas

as the basic lingua franca for policy control but

added apis for more controls that third-party

management tools could choose to enforce. that

gives everyone a sufficient set of information

management capabilities for the vast majority

of their needs and lets vendors layer additional

controls for the truly special ones. that model

works well for eas across ios, os X, android,

BlackBerry 10, and Windows phone.

likewise, identity management needs to be

done at the source. that means infotrust needs

apis to communicate with existing enterprise

identity management tools, such as active

Directory, to validate user permissions (and even

existence) on documents for which password

security alone is insufficient. likely, the oper-

ating system will need to provide the local

service that the app communicates with, and

the os will handle the server communications

— similar to how eas is implemented today.

the use of documents with server-based identity

protection will require an internet connection to

Deep Dive

InfoWorld.com Deep Dive series 1 8M o b i l e S ec u r it y

validate against the identity management server,

but there’s no way around that reality.

A plea to the tech industry: Make InfoTrust a reality i strongly encourage Microsoft, apple, and

google — the three platform and app vendors

through which so much business data is acted

on — to get together to develop the infotrust

standard. leading, progressive mobile and

desktop security vendors such as Mobileiron,

good technology, airWatch, Centrify, appCen-

tral, and apperian should be key players.

perhaps one or two should even chair the effort

due to their more neutral relationships with the

platform vendors.

traditional, backward-thinking vendors (such

as those in the antivirus industry) should be

kept at arm’s length, at least in the initial stages.

they’ve shown repeatedly that they can’t get out

of the broken defensive-perimeter trap.

it keeps saying its security concerns are

about protecting information. so, tech vendors,

stop focusing on straitjacketing devices and

apps and instead protect that valuable informa-

tion wherever it is. n

Galen Gruman is an executive editor at

infoWorld and its columnist on mobile and

consumerization of it.

sh

ut

te

rs

to

CK

/ s

te

ph

en

sa

ue

r