Insecurity

Firewall Evasion Techniques and Countermeasures

2015-02-03T06:55:00.000-08:00

Life finds a way. This is one of my favorite quotes from one of my favorite movies and books, Jurassic Park. Internet traffic, like life, will break free and expand to new territories. There is a vast amount of examples of people changing their behaviour to get what they want when you attempt to deny them access to whatever that is.

When it comes to security the line between good and bad is often hard to see. Certainly malicious actors work to bypass security controls to get footholds and steal confidential information. Other times they are working to bypass controls to just to avoid control and/or oppression.

There are several groupings of tactics to bypass network security appliances. The challenge of evasion is that there are many groupings and many tactics. Tactics in different groupings can be leveraged at the same time dramatically compounding the issue. The purpose of this post is to describe the tactics employed to evade network security systems, identify what is required from a network security system to prevent bypassing, and generally where to find it.

For some examples of using these evasion techniques please search the rest of the blog for evasion.

Network & Transport Layers

Many of the evasion techniques that exploit lower level protocols are handled by the underlying OS of network security appliances. Often the IP stacks are configured to be prevent many of the tactics by default. The challenge is that many of the tactics at the network and transport layers are natural functions of the protocols that are being used in a malicious way. This most often results in the most elegant of attacks. Blocking them outright could lead to a high probability of blocking benign traffic, which results in user experience issues, which results in complaints, which results in disabling the features.

One of the most common network and transport layer based evasion is fragmentation. There are several ways to exploit IP fragmentation. As an example in a small packets segmentation attack the attacker will fragment all of the packets to be very small. The idea is that network solutions have a a limited amount of memory to manage each session. If there are lots of small packets the attack payload will be broken up into small enough pieces that each individual packet looks benign. Where things start to fail is when the memory buffer fills up and the devices starts to allow packets through to the target host that don't look bad. Once the target host reassembles them the attack will likely be actualized.

Another example is to abuse the session by chaff. An attacker can send multiple fragmented packets with the same sequence number but different payloads. On top of that you can manipulate various other parts of the packets. One example is to leverage PAWS (Protection Against Wrapped Sequence). PAWS is designed to improve TCP performance in high speed networks. Servers have a theoretical limit of 2³² sequence numbers per session, so starting at 0 and going to 2³². So when a session hits that finite number the sequence number starts back at 0. This can be abused by sending multiple packets with the same sequence number and different timestamps so that the old one may be discarded and the new one slips through. Sending the malicious payload second may overwrite the first and be bypassed. Operating Systems will handle these differently and confusion is the name of the game.

This type of packet mangling is most often be handled by the network processing engine of security appliance. Most systems will have protection settings either in the device settings, in an interface protection profile, or like the illustration below in a zone protection profile.

figure 1: zone protection

It is important to note that these are functions of the protocol that may be used for regular traffic. Most solution vendors will not enable all of them by default to avoid potentially blocking legitimate traffic. It is important to look for them in the operating manual and configurations of the device and ensure you enable the ones that will work in your environment. You may have to take some risk and enable them to find out if they cause problems for regular traffic so it is equally important to find out where they are reported when triggered in case you need to troubleshoot.

Session & Application Layers

Protocols such as NetBIOS (Network Based Input Output System) and RPC (Remote Procedure Calls) are widely used session layer protocols. These protocols are typically interacted with by application directly and users typically do not need interact with them directly. They are commonly used for network based communications of applications that may not have their own network capabilities built in. In this way the applications can be developed in a standard way using one of the session layer protocols and have those protocols handle the communications between nodes. As a result the attacks are similar to that of the transport layer protocols. That being said in most network security appliances these session layer protocols are controlled by protocol decoders and/or rules/policies rather than at the network layer.

There are many ways to evade network security appliances by tunneling one application through another. By encapsulating a denied type of traffic inside a permitted type of traffic the blocked traffic may slip through security policies.

For example a security policy may permit something like ping which relies on ICMP echo requests and echo replies. The same policy may not allow web browsing using HTTP. ICMP could be used to encapsulate the HTTP traffic. If the security appliance isn't looking at the application ping closely enough it will think there is just ping traffic and permit it. Another example would be wrapping bittorrent traffic with DNS. If bittorrent is not permitted but DNS is the appliance may let this traffic through because it thinks it is just DNS based on some basic characteristics. In the case of unknown malware positive security could potentially prevent it proactively. If the malware is tunneling over DNS but is otherwise unknown, a security appliance that properly identifies the applications will prevent the malicious traffic even though it has not seen it previously. See an example of tunneling through ICMP here and another example of tunneling through UDP here.

Almost any kind of traffic can be tunneled inside another protocol. You can also tunnel whatever you want through other applications like DNS, NTP, HTTP.

figure 2: positive security policy

The solution to evading security appliances at the session and application layer is application identification and a positive security model. Application identification may be a multiple stage process. There may be some pre-prosessing at the protocol layer that will weed out obvious things like violations of the protocol standard. Otherwise there will be some form of decoders and heuristics that will identify what the application is outside of just the standard port and protocol. As depicted in the examples just above you should be able to detect when there is HTTP traffic tunneling through ping because ping isn't supposed to have HTTP headers inside it.

Positive security means allowing the types of traffic you want and implicitly denying anything else. A positive approach to security can only be implemented when proper application identification is working. When you can trust that allowing DNS will only allow DNS traffic and not tunnel bittorrent or IRC or web traffic to a command and control server, you have positive enforcement.

Encryption

The purpose of encryption is to provide confidentiality and integrity of data. The data in transit in this case is obfuscated so that prying eyes can possibly tell where you are going but not what you are doing there. This means that when network traffic is encrypted many network security appliances will be blind to what is inside. Many popular websites today have defaulted to HTTPS when you visit them (Google, Yahoo!, Facebook, and Twitter), and more are moving to encryption because of recent leaked information about spying. The underlying technology in HTTPS is SSL (Secure Sockets Layer).

A simple example is someone using an HTTPS proxy server outside of the network to get to other websites. The security appliance would see HTTPS which is likely allowed because it's so pervasive. The proxy server makes it appear the user is browsing a random HTTPS site, but really it is tunneling traffic to another website. So the user makes a connection to the proxy and the proxy makes the connection to the target, likely blocked, website and the entire transaction is encrypted. The security appliance does not have any visibility into what is going on inside the traffic.

You have visibility to be sure that webmail is in fact what they are doing.
You have visibility to determine if there is malware or malicious links inside the encrypted traffic, and
You have visibility to see if sensitive data is leaving the environment.

The solution is to decrypt the SSL traffic. A certificate needs to be installed on each of the client devices. When users make connections to HTTPS sites their traffic is encrypted to the security appliance using your certificate. The security appliance then makes the connection to the destination website using their certificate. This way the security appliance has decrypted traffic on it before passing. When breaking encryption for corporate use the idea is not to read peoples emails and invade their privacy. The goal is so that you can permit something like a personal webmail account and know you are safe because;

It is important to note that SSL (and inherently HTTPS) is a standard protocol and widely deployed in many applications so decryption can be accomplished by any application using this standard protocol. Network security appliances will have troubles with encryption protocols that are proprietary or non-standard.

Conclusion

Managing evasions is challenging. If one (wo)man can make something another can break it. Within each of the sections above there are currently dozens of examples of evasions for each section. Many of these techniques can be used simultaneously to slip through. New evasive techniques are developed regularly. It is important to keep up to date on them and understand how you can prevent them in your environment. As a result the only way to ensure that a network security appliance will prevent every evasion is to pull the plug. Following are some best practices to prevent evasive techniques today.

Look for network security solutions that are stream based. Stream based systems will continuously monitor every packet in the stream. The cost is heavy CPU/memory requirements and the benefit is that it will reassemble all of the packets properly so that it can identify any malicious behaviour. The alternative is a session based system that will typically look at the first packets and if those look ok will trust the rest, which has obvious consequences. While there may be ways to beat a stream based system like working around the stream buffer timers, they are still much more effective than session based and are the best we've got right now.
Read the manual. Many of the features to prevent lower level evasions will be documented in the deployment guides. Because these features can sometimes break applications they are not always enabled by default.
Determine if the network security solution is capable of positive security enforcement. You should be able to permit the traffic you want with confidence, and everything else should be dropped by default. This means having the ability to properly decode traffic and identify applications. It also should have a single policy. If you have to permit some traffic and then block parts of that traffic elsewhere the solution will be inefficient and ineffective.
Decrypt the SSL traffic. 30% or more of all network traffic is encrypted. If you can't see what is in there you are blind to 30% of traffic. This is imperative to prevent malware and data loss.

References:

http://www.monkey.org/~dugsong/fragroute/fragroute.8.txt
http://www.cs.uit.no/~daniels/PingTunnel/
http://www.mcafee.com/us/resources/misc/guides/evader-users-guide.pdf
http://en.wikipedia.org/wiki/Remote_procedure_call

The Zero Inbox

2014-10-29T10:26:00.000-07:00

The Zero Inbox.

People hold onto emails like they are dollars.

There are oodles of e-mail applications that are all trying to help you get to this point. You've heard of this but for most people the concept of having zero email in their inbox is like finishing grocery shopping. Eventually you just have to go back, and there are always those things that you buy that just linger around in the cupboards. Similarly, you may have a handful of emails that stick around. And that's ok.

The idea here is to keep your inbox volumes as low as possible. You should be able to respond to almost every email addressed to you within a business day.

Over the years I have worked with all levels of employees who don't respond to their emails. Many take the stance that they are too busy to respond to all of their email. They get too much email. The problem with taking the stance of a proactive excuse for not responding is that not responding is a very slippery slope. Ignore one on purpose, and eventually you will ignore one by accident. It is also perceived as rude, dissonant, self-important, lazy, unproductive, incapable, and many other negative adjectives.

When I've asked (or peeked) into some of these inboxes I'm flabbergasted so see often see hundreds, and even more often thousands, of messages in their inbox and thousands of messages that are unread in all of their folders.

I'm going to be the one to break it to you. You cannot effectively manage email if you leave everything in your inbox. While some people are better than others at it, it always fails.

Following are the main high level techniques I leverage to keep my inbox volumes as low as possible, while providing great response times.

Don't Be a Slave to Email

You shouldn't need to be tied to your inbox all day long, as addictive as that can be. And if not following subsequent steps in these guidelines will make it feel like that much more of a waste of time.

This is exemplified while traveling. Many times while traveling you will have a little bit of time in the morning and/or some time in the afternoon to manage your inbox. Even when going on vacation one of the most overwhelming thoughts is getting back and having to catch up via email.

If there are dozens of emails on a certain topic in your inbox after an absence pick up the phone and ask for a summary. It will likely be faster and more accurate. Then file, delete, or archive those messages.

Otherwise even when your schedule is very busy schedule two times a day mentally where there will be time to get through email. Typically all amounts of email can get dealt with in a business day if proper filtering and deleting are being done. After returning from a week vacation I can typically get through all of my emails within a couple of hours using these tactics.

Messages That Need a Response

I'm starting with this message type because;

It highlights how important messages can get lost in the masses and never get responded to.
It applies to all of the message types.

Instead of looking at a message and doing nothing, do something. Respond. If you have a question to ask before providing a final response, ask it. If you know the answer to a question, answer it. If you need more information, ask for it. This may sound trivial. It's really as easy as that. Some people really like to think a lot before responding. This can take some practice. Think about your response for a minute, write it down, and hit send. That way you can delete that message/thread and move on with your life. Most emails are not as life altering as we think.

Personal vs Work

Keep these separate. If you keep you work and personal emails separate you may have a better chance at managing one better than the other at the very least. My mother doesn't even know my work email. Even when family and friends get my work contact I ask them not to use it, forward the message to my personal account, and respond from there.

This also offers some additional piece of mind. When you want to step away from your work but still see what's going on with the rest of your life, they aren't so intertwined, surrounded by each other.

External Mailing Lists

Everybody subscribes to mailing lists. Some immediately come to mind like retailers, magazines, sports, forum digests, etc.

Some of them you never read. You know which ones they are. Unsubscribe. Get them out of your inbox and stop having to think about every one of these.

Some of them you like to at least scan the subjects or get to them from time to time. This is where you want to create a filter and automatically move these into a folder. Get them out of the way until you have time to get to them. When you do look at them and decide you don't want to go any deeper get rid of them using delete or archive.

Internal Mailing Lists

These are typically going to be work related. This does not include all_in_company type emails, those are different, sort of. However if the all_in_company messages are frequent and too long for you to get to in a day then treat them the same. These are more the internal chatter mailing lists. We have many of them for people in the same roles to ask questions to the larger group. You are not expected to read or respond to any of them. They are there when you are looking for an answer or want to provide one. Create a filter that automatically moves these out of your inbox now and move them into a folder. Once a week go back to that folder. If you don't have time or inclination to read them delete or archive the messages.

The other type of mailing lists are the automated informational messages. Someone uploaded a new file to the shared drive. A new order came in. A report was generated. The intention of these messages is to look for things that stand out. Filter these and move them to a folder. Take a peek at that folder once a day or once a week and then delete or archive the messages.

Everything Else

At this point you should only have messages in your inbox that are sent directly to you that you need to consume and potentially respond to.

If it's something you need to read, read it, then file it, delete it, or archive it.

If it's something you need to respond to, respond to it, then file it, delete it, or archive it.

There will always be a few messages left in there. Some examples of messages I frequently have lingering in my inbox are;

Upcoming events/meetings. I like to keep the invitations handy in case it needs to be sent to someone. Sometimes the email may have content that the calendar invite does not, although most of the time I update the calendar invite. There are also a couple about some people I am meeting this week and I like to keep them there until the event is over for some reason.

Todo's. One of them is for a proof of concept I want to try and don't want to forget.
Requests. Another is for some documentation someone advised me to create that I haven't got around to.

The recurring theme here is to take action as soon as you can when looking at an email, then moving or deleting that email to move it out of the way. There will be many more to follow that one and people will likely appreciate it much more to get a response than not.

Hope this helps!

Firewall Evasion with UDP (PingTunnel)

2014-10-07T07:54:00.001-07:00

This is a follow up post to using PingTunnel to bypass security controls by tunneling traffic over ping. For this example we will use the same tool but do it over UDP instead. For the background, architecture, and other specifics please see this post here.

The reason you would want to tunnel is well documented in the previous post. The reasons why you would want to use UDP instead of ICMP are;

Maybe ping is blocked and DNS is not.
UDP seemed to perform much faster than ICMP. I'm guessing this is because UDP is better at dealing with out of order packets but wasn't able to find any evidence to prove that.

When using PingTunnel using UDP the performance was so much better over ICMP. As a result my favorite way to tunnel the traffic is using the SSH proxy method below. You will likely be able to SSH into the system configured as the ptunnel server, which means that no additional HTTP proxy server needs to be deployed or found.

Ptunnel Server

On the ptunnel server you can run ptunnel without any additional options. The -v 4 increases the output which can be good for troubleshooting. The -x allows you to specify a password. The new argument we have added is -udp which switches from the default of ICMP to UDP;

ptunnel -udp -v 4 - x <password>

There are a few ways that you can use the tool to browse websites.

Local HTTP Proxy

In this configuration a proxy is started on the client device. From there what you send to that proxy will go over the tunnel. You still specify the target website, so the limitation is that you need to change the destination address in the ptunnel command for every site you want to get to.

ptunnel -udp -p <ptunnel server IP> -lp <local port to open> -da <target website URL> -dp <open port on website>

So my command looked like this;

ptunnel -udp -p 192.168.55.146 -lp 8080 -da www.thepiratebay.se -dp 80

From there open a browser and browse to http://localhost:8080. This should load www.thepriatebay.se in this example.

Remote HTTP Proxy

In this configuration you can use an HTTP proxy in addition to the ptunnel server.

So traffic will go from your client to the ptunnel server over ICMP to an HTTP proxy specified after -da. The proxy can be one that you setup on the ptunnel server or an open one you find.

The ptunnel server will send the request to the HTTP proxy. The HTTP proxy will make the requests to the target website. The HTTP proxy can be running on the same host as the ptunnel server.

The benefit is that you can set everything up once and browse any website that the HTTP proxy can get to.

ptunnel -p <ptunnel server IP> -lp <local port to open> -da <open HTTP proxy server IP> -dp <open HTTP proxy server port>

The other setup you will need to do is change your browser proxy settings to be localhost on the port you specified with lp.

So my command looked like this;

ptunnel -p 192.168.55.146 -lp 8080 -da 192.168.55.146 -dp 3128

The switch your browser to use localhost for the HTTP proxy on port 8080

SSH SOCKS Proxy

Similar to the way you can proxy through an HTTP proxy, SSH can be used as a SOCKS proxy.

So the traffic will appear to be ICMP traffic from the client to the ptunnel server and then the HTTP requests will be encrypted in an SSH tunnel, and finally the SSH server will make requests to the target server. The SSH proxy can be running on the same host as the ptunnel server.

The other setup you will need to do is change your browser proxy settings to be localhost on the port you specified with lp.

ptunnel -p <ptunnel server IP> -lp <local port to open> -da <localhost> -dp <open SSH server port>

then...

ssh -p 8080 -C -D 8081 <username>@localhost

So my commands looked like this;

ptunnel -p 192.168.55.146 -lp 8080 -da localhost -dp 22
ssh -p 8080 -C -D 8081 remnux@localhost

Then switch your browser to use localhost for the SOCKS proxy on port 8081.

In this case the security appliance used determined this as unknown-udp. The traffic was going over UDP port 53 which is DNS, however because the payload didn't behave like DNS it was grouped as unknown-udp. This is a good example of why unknown-udp and unknown-tcp should not be permitted in a network. The recommended use of these applications is to identify any of your in-house custom applications being dropped into the unknown, create an app so that it is known, and then stop allowing the unknowns.

The appliance also offered a packet capture because it was unknown so that you can figure out if it is desired or not. Here is that capture. It pretty much looks like garbage because that is SSH tunneled within UDP.

Firewall Evasion with ICMP (PingTunnel)

2014-09-29T13:29:00.002-07:00

Most networks today use a network based access control system to permit certain traffic and deny others. Since the inception of firewalls and web filters users (and malware) working behind them have strived to bypass the firewalls in order to do whatever it is they want to do.

For those who are more visual here is a video walkthrough of the following in a video

Tunneling is a very common and effective way to bypass access control systems. Tunneling techniques can be used to bypass firewalls, Network Intrusion Prevention Systems, Web Security Gateways, and WiFi sign in pages.

Tunneling to bypass security is achieved by encapsulating a denied type of traffic in a permitted type of traffic. Because there are many ways to identify HTTP tunneled within HTTP I decided to dig deeper into another protocol used for troubleshooting that is also typically permitted, ICMP. Ping in particular uses ICMP echo-request to ask if a host is alive on the network and echo-reply to respond to that request.

For this edition we will use a tool called PingTunnel or ptunnel. PingTunnel works in a client/server model. The same software is used on both the client and server.

Requirements:

Get the software and build it on your platforms. The documentation on the developers website is great http://www.cs.uit.no/~daniels/PingTunnel/.
A system on the Internet that accepts ping that you also have administrative access to. This is for the PingTunnel server. The easiest solution here is to use a computer in your home network. You will also need to create a NAT rule on your modem/router/firewall to forward Ping to this host in your network. There are lots of tutorials on how to do this. Otherwise a VPS will also work but you will need to pay for that. Guess it depends on how serious you are about bypassing the security control.
Patience. Tunneling HTTP in ICMP is not super fast.

The network will look like this. You will be on a client running ptunnel (192.168.45.128). The device blocking access will be in between you and the rest of the Internet. On the outside will be your ptunnel server (192.168.55.146) and the destination hosts you are trying to access.

Stage 1 - The client will see traffic destined to the target website and encapsulate that traffic in ICMP. The security device will likely permit the traffic and send it do the ptunnel server.

Stage 2 - The ptunnel server will decapsulate the traffic and make a normal web request to the target website.

Stage 3 - The target website will respond with normal HTTP to the ptunnel server.

Stage 4 - The ptunnel server will re-encapsulate the responses in ICMP and send them back to your client which will display the page.

Ptunnel Server

On the ptunnel server you can run ptunnel without any additional options. The -v 4 increases the output which can be good for troubleshooting. The -x allows you to specify a password;

ptunnel -v 4 - x <password>

There are a few ways that you can use the tool to browse websites.

Local HTTP Proxy

In this configuration a proxy is started on the client device.

From there what you send to that proxy will go over the tunnel to the ptunnel server. The ptunnel server will make the request to the target website.

You still specify the target website, so the limitation is that you need to change the destination address in the ptunnel command for every site you want to get to.

ptunnel -p <ptunnel server IP> -lp <local port to open> -da <target website URL> -dp <open port on website>

So my command looked like this;

ptunnel -p 192.168.55.146 -lp 8080 -da www.thepiratebay.se -dp 80

From there open a browser and browse to http://localhost:8080. This should load www.thepriatebay.se in this example.

Remote HTTP Proxy

In this configuration you can use an HTTP proxy in addition to the ptunnel server.

So traffic will go from your client to the ptunnel server over ICMP to an HTTP proxy specified after -da. The proxy can be one that you setup on the ptunnel server or an open one you find.

The ptunnel server will send the request to the HTTP proxy. The HTTP proxy will make the requests to the target website. The HTTP proxy can be running on the same host as the ptunnel server.

The benefit is that you can set everything up once and browse any website that the HTTP proxy can get to.

ptunnel -p <ptunnel server IP> -lp <local port to open> -da <open HTTP proxy server IP> -dp <open HTTP proxy server port>

The other setup you will need to do is change your browser proxy settings to be localhost on the port you specified with lp.

So my command looked like this;

ptunnel -p 192.168.55.146 -lp 8080 -da 192.168.55.146 -dp 3128

The switch your browser to use localhost for the HTTP proxy on port 8080

SSH SOCKS Proxy

Similar to the way you can proxy through an HTTP proxy, SSH can be used as a SOCKS proxy.

So the traffic will appear to be ICMP traffic from the client to the ptunnel server and then the HTTP requests will be encrypted in an SSH tunnel, and finally the SSH server will make requests to the target server. The SSH proxy can be running on the same host as the ptunnel server.

The other setup you will need to do is change your browser proxy settings to be localhost on the port you specified with lp.

ptunnel -p <ptunnel server IP> -lp <local port to open> -da <localhost> -dp <open SSH server port>

then...

ssh -p 8080 -C -D 8081 <username>@localhost

So my commands looked like this;

ptunnel -p 192.168.55.146 -lp 8080 -da localhost -dp 22
ssh -p 8080 -C -D 8081 remnux@localhost

Then switch your browser to use localhost for the SOCKS proxy on port 8081.

Caveats:

As stated earlier it is not super fast. If you are trying to load pages with lots of content they will likely timeout.
Getting SSL to work was very rare in my environment, even over the proxies.
You may need to run this on *nix/mac systems
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
The security appliance I am using was configured to permit the traffic and log it for demonstration purposes. As you can see from the screenshot below it does differentiate between regular ping and ping tunnel. If this were in a production environment with positive security policy that allows ping, the ping tunnel would not have been allowed, and therefor the traffic would have been prevented.

Shout out to Daniel Stødle for developing this software!

Back to Basics - Network Design

2014-04-09T08:02:00.000-07:00

Networking is fun. It should also be pragmatic. There are many networks in production that have been architected like a service provider network, or how networking companies want them designed. This is not to say that these networks aren't providing service, as they all are, just not to the scale of an ISP. These designs are likely implemented by people who love networking and just want to see as much of it as possible, at the expense of being impractical and expensive.

While robust and highly scalable, in most (outside of ISP's all) environments this is like putting out a match with a firehose.

An illustration.

Many environments attempt to employ a very robust architecture like the one diagramed above that contains;

Border Routers that connect to the Internet and are the first hop for the IPs provided by the ISP.
Core Routers or Switches that handle routing between internal networks.
Distribution Routers or Switches that aggregate Access Switches. They will either pass traffic between locally connected access switches or forward traffic up to the core.
Access Switches that provide physical ethernet connectivity for endpoints (clients and servers).
Security Gateways that may include multiple layers of firewalls, Network IPS, Web Gateway, and Email Gateway.

In most environments there are typically a few other erroneous network elements. Routers to connect to partner network, legacy environments that people are intimidated to change, proxy servers, and VPN concentrators.

The challenge with this architecture is that it introduces many points of management, many points of failure, many points of capital costs, and lack of visibility into what is transiting the network. The last point is critical. Because much of the internal traffic will go from a endpoint to a switch then to another switch without hitting the security gateways it cannot be scrutinized.

For better management and security all of this functionality can and should be collapsed into 2-3 layers.

Firewalls (we will use security platform in placement of for a better description)
Access/Distribution Switches

In the architecture above we would terminate the Internet connection to the security gateways(s). Getting high availability from an Internet connection has the same challenges regardless of the type of device. HA Internet would require two cables from the same ISP or a cable from two separate ISP's. If necessary we implement dynamic routing protocols like BGP for high availability or OSPF for MPLS across the WAN interfaces of the security gateways. Threat modules should be enabled on the security gateways to perform Network Intrusion Prevention and Malware detection. All of the site-to-site and client based VPN's should terminate here too.

By policy switches should connect to the security gateways inside interfaces as much as possible with as few other switch hops as possible. This allows us to route traffic from the access switches up to the security gateways so that security security policy is applied to as much internal traffic as possible. Many environments end up with one large pair of core switches that we put into layer2 mode (imagine the diagram above without the need for the switches between the access switches and security gateway). When there are so many access switches required that the security gateway doesn't have enough ports to support them all, then distribution switches must be introduced as depicted in the diagram above.

Further reduction in equipment may be had by using VLANs on the distribution switches for both LAN and DMZ (and any number of other VLANs currently required) rather than having a dedicated switch for each network. As you will notice though traffic between the LAN access switches is blind to the security gateway, like in this drawing below. This is why the more ports we can connect switches directly to the security gateway the better.

There are a number of benefits to this design:

Capital cost savings. We have eliminated at least three layers of physical appliances. While the cost of individual security gateways may increase due to their larger capacity, there is still cost savings of 50% on the overall equipment costs due to the reduction of metal boxes.
Operational cost savings. All of the complex routing and filtering is being done on a single security gateway (or HA pair). Most of the daily modifications and troubleshooting will be on a single pair of devices. The switches can all be in simple layer2 mode. This is less places to look for trouble which saves time. Because the operational team will be spending most of their time in the security appliances they will develop strong skills fast which will also reduce the time to repair. Lest we forget rack space, power, and cooling.
Better security. The more traffic that we route on an internal core network the less traffic will be visible to the security gateways. By putting the default gateway for all networks on the security gateway traffic between those networks will be scrutinized.

With the direction of modern datacenters it is equally important to ensure that the security platform you select can be deployed in virtual and public cloud environments to provide continuity.

Complexity and obscurity are the real enemies of security and availability. Simplicity and efficiency are the friend.

Resetting Client Device Management

2014-04-01T07:01:00.000-07:00

Data is like water. It ends up flowing freely through devices and cloud services like water down a river. And users are bringing in an evolving group of devices and using more services that make up the riverbed. Users are bringing their own smartphones, tablets, wearables, and laptops, and leveraging more cloud storage. Enabling BYOD with one or two tool is like controlling the directions of the riverbed.

Mobile Device Management is a critical component of any infrastructure today. Most of our environments are borderless. Users are doing work from all over the place and are no longer confined to the corporate office. And they are using whatever they want to get that done.

Users aren't (typically) being malicious when they use their personal devices (the malware is though) they are just doing it to be more comfortable and productive. To completely prevent users from bringing their own phones, tablets, and laptops requires a very militant and expensive array of solutions properly secure the data so that it remains in your network.

Enabling BYOD through a a couple of strategic technologies is more cost effective than trying to prevent it and gives users and your business the agility they are looking for. Not to mention that it gives you much better levels of assurance as to where your data is.

Managing the devices, applications, and data has always been critical to protecting your corporate assets. It's just not something that has always been done.

Modern solutions can manage policy, applications, and data on Android, IOS, Mac, and Windows 8 devices.

This is an overview of what MDM should get you;

User Driven Enrollment

One of the top 3 concerns for I.T. has been the extra work required to support BYOD.

It's called Bring Your Own Device, which should also imply Manage Your Own Device. Unfortunately it doesn't work this way. Many non-I.T. users still struggle with setting up email and WiFi on their phones and tablets. When the company I work with moving to BYOD our I.T. team went from a single resource supporting BlackBerry's and BES (which is an MDM) to the entire team having to help out all day.

With an MDM the process is to tell users to download an app or visit a URL and enter their email address and email password. From there any policies that the administrators configure for the user role or type of device will be pushed and installed. This is easier for the user who doesn't want to have to call for support. It's also easier for the support people who are trying to move away from mundane calls and become more strategic.

While it should go without saying, it's equally important to message this to the management team. People managers should be able to direct their teams to download the app or visit the URL and sign in. People managers should also be able to communicate that if something has not been pushed to the phone after enrolment, like VPN, then it's because there is a policy explicitly preventing it. So please don't ask support.

Device Management

Once the user has successfully signed into the onboarding app or URL we can set the devices up for them. No more having to ask someone over the phone to tap this or that as they fumble around trying to configure an email account.

The MDM will push whatever configuration bits you want to the device through the device API's. The most common MDM configurations we see pushed to Android and IOS devices are similar to the ones we would commonly leverage BES for on BlackBerry's;

Device password/PIN - Most users will not set this up on their own. I.T. is the owner of the data and if the users device is lost or stolen this is a first line of defense in protecting that data.
Email/Calendar/Contacts - Rather than fumbling with the users over the phone to walk them through these configurations it's much simpler to configure it once in an MDM and push it to authenticated users.
WiFi - Similar to the Email/Calendar/Contacts this is much easier to configure. As an additional benefit a WiFi password maintained by I.T. could be pushed to the device. Because the user doesn't know that password they would not be able to join other devices to your WiFi (very desirable) unless they enroll in the MDM.

There are many other features that an MDM can configure like VPN profiles and device certificates. It's best to check with the vendor you are interested in to find out specifically what they support at the time. This is still a quickly evolving area and thanks change.

The device management component must be taken for what it is, a tool to take a significant amount of load off the desks of I.T. administrators so that they can deal with bigger issues.

Application Management

Application Management is a feature that lends to the stance of enabling users through I.T. rather than preventing them.

With application management administrators can wrap applications with MDM management. This allows administrators to push applications to the user devices. Because there is a management wrapper also allows them to remove those applications from the devices when the user no longer requires access.

There are two very common use cases for application management. The first is paid applications. One way to make it clear to users which paid applications are supported by the organization is to purchase them and publish them through an enterprise app store. When the user goes into the app they may see some document editing apps, CRM, or accounting.

The other use case is part of data management. If there is an application that the user can store corporate data in it is advantageous to wrap this application so that the administrator can remove the application, and inherently all of the data.

When the device is de-provisioned you can safely remove all of the paid apps and even data while keeping the users personal data intact.

Data Management

Data management is the newest and most important evolution of MDM. Data is what we are trying to protect. If it weren't for the data we wouldn't need the smartphones in the first place.

The way data is managed is through application management. A secure content folder application provided by the MDM vendor can be deployed. This container application can link to the MDM vendor's cloud storage or even potentially into your own internal file share server. From there you could theoretically prevent cloud storage applications like Box, Dropbox, and Google Drive from running. Because it is the users device this is often not practical.

The other way is to figure out which cloud solution your users are typically using most often. You can find often find this out by monitoring your network security gateway/web filtering logs. Once you know which app users prefer you can potentially sign people up for corporate accounts. Then wrap the application and push it out to their enrolled devices.

Unless you have technology in place to prevent users from bringing their own smartphones, tablets, and laptops they are finding ways to make them work on their own. This means that your data is getting onto unmanaged, and inherently vulnerable, devices. Best practice today is to guide your data, like the riverbed that guides the river. MDM is a technology that can help you do this on all modern client device platforms and should be considered a critical component of the new borderless network.

A Year With The BlackBerry Z10

2013-11-13T08:23:00.001-08:00

It's been just about a year since I received a beta version of the BlackBerry Z10 smartphone. This is the first touch screen phone produced by BlackBerry. The device I received is the same hardware specifications that has been generally for sale since.

Like most smartphones there are things that are great and others that are less than.

The Hardware has been fantastic. This phone has been raw without a case or screen protector the entire time. It has slipped out of my hands many times. Even took a spill down a flight of stairs. As you can see from the photos it has held up very well. Some very minor denting on the rubber coated back. Some insignificant scratches around the corners on the front. Very impressive for a glass front of this size paired with a relatively clumsy human. Definitely standing true to the BlackBerry brand.

The Battery has been the longest lasting battery in an all touch smartphone I have used. On a typical day I'm a pretty heavy user. I take meeting notes on the phone, send a few handfuls of messages, and answer emails between meetings and while on the go (basically every hour). The phone gets unplugged from the charger at around 7am and doesn't typically need to get plugged in again until 11pm on a lighter day and more like 10pm on a heavier day. On really heavy days when I know I'm going to also be out late it definitely will get a quick charge mid day to make sure I have that distraction late at night. The charger also fills up the battery in around an hour which helps. One of the reasons for the battery lasting this long is also a bit of a downside. On my other devices there are usually a lot of apps that are running in the background constantly synchronizing something. You will naturally turn the screen on more when there are more things to do on the device. So the lack of apps, while disappointing, contributes to the battery lasting all day.

The Gestures are still the most intuitive of all the major operating systems that I use. Swiping up from the bottom to unlock the screen. Swiping up and to the right to get into the Hub. Both of these gestures are so intuitive that I constantly find myself trying them on other tablets that I use every day.

The Predictive Type in BlackBerry 10 is definitely amazing. It definitely is intuitive if you type in full sentences and most of the words it does find as advertised. The swipe gestures to complete words is also very intuitive and convenient. It has definitely been one of the fastest touch screen phones for me to type on. Something that has started to drive me nuts (wild exaggeration) is the auto complete on certain words. It is supposed to learn your speech patterns and predict what you are going to say. A few things that were only typed a couple of times that it has hung on to for the entire year;

Trying to type anything singular case it goes with plural and any time I want to type something in plural it goes singular. Since the 10.2 update it's actually got a bit better but still is the number one thing I manually correct most often.

Trying to type LOL and it replaces it with LPL. Maybe I should stop typing about bodily functions.

Day changes to say when I want day and say to day. Arg.

The BlackBerry Hub app that consolidates your messaging accounts can keep things very productive, or not. In Hub I've configured my gmail accounts, Outlook.com, Twitter, and LinkedIn. All personal accounts. My work email is not configured in the Hub. When it's time to unplug for the day I can easily look at my phone to see what's going on without having to get sucked into wading through work emails. I still dip into my work emails a lot after hours but it's nice for everything personal to be in one place and keep work outside of it when you need a break. You can put everything in the Hub if you are so inclined.

The Lack of Apps is still somewhat disappointing. On one hand it helps to keep the device usable for what it is most often used for, email, calendar, and contacts. This has been the primary function of the device for me and it has been great at all of them. On my other devices I definitely have dozens more apps installed. The thing that I have realized though is that I just like to install apps and know that they work. Many of those apps do not actually get used. One app that is greatly missed is Google Music. Having to tether the phone and synchronize music seems like an antiquated task, doesn't get done, and the library gets stale. Again the lack of apps running in the background synchronizing data contributes to the phone's resources being conserved and increasing the battery life, which is an upside.

With the (constant) recent launch of new devices with new operating systems I'm currently torn on what to use. This device is still in great shape. It does exactly what I need and want it to do most of the time, and has the power with 2GB of RAM and battery life to do it. Quite frankly the speed to market from the competition causes me endless anxiety. Always wanting the new device or the latest operating system when they come out annually is a lot for someone who loves technology but not consumerism.

A Month With The Lenovo Helix

2013-10-07T11:58:00.000-07:00

As previously discussed we have implemented a CYOD (Choose Your Own Device) program. The device I chose was the Lenovo Helix, an Ultra Book tablet hybrid.

Here is an interim review of the device after a month of full time use.

Windows 8

I've been using Windows at work for 15 years, up until approximately 1 year ago. This was my first experience with Windows 8. In a sentence Windows 8 feels like it has two personalities. It's obvious that there is the Metro tablet interface and desktop mode.

What was surprising was the lack of integration between them. For some reason I was under the impression that if you configured something in one it would configure the other. Here are some examples.

- When you configure a Microsoft Exchange account in Metro it doesn't configure Outlook in desktop or vice versa.

- When you configure Box in Metro it doesn't configure Box in desktop or vice versa.

The only app I've found so far that seems to install once and run in both is Google Chrome web browser. I haven't found a difference in the layout of the app in either mode other than the fact that it seems to go full screen in Metro.

Finding apps and settings was also a challenge initially. The fundamental difference is that you now search for everything. The old Windows way was to click start and navigate through a menu hierarchy of your most frequently used apps and data. The new way is to mouse or pull from the right side of the screen and search. It seems to be quite efficient after you realize what's happening.

Having a large tablet with full Windows desktop has been quite convenient. Most of my meetings involve me demonstrating data in spreadsheets, presentations, and drawings. Much of the time when you open office documents on other platforms some of the formatting or layout will change. It's nice to know that while I can get that data on all of my devices, it will look exactly the same when I present it as when I created it when using this device.

Hardware

The hardware has been classic Lenovo. The device is ergonomic and sturdy. It is definitely built for business, and business travel.

The battery is decent. I've typically been able to get through a day with the device, although it does get plugged in most of the time. Battery life would be around 4 hours at normal screen brightness and on the entire time.

The keyboard is the new Lenovo chicklet style. The Lenovo keyboard is one I've been using happily for many years and this evolution felt familiar and good. It always creates a tearing decision to consider leaving the keyboard behind to save weight and take the tablet only. The trackpad is actually much better. Gestures like sliding your fingers up and down to scroll through multi-page documents works much better than in the jittery past.

The screen is nice and clear. I've got the resolution set to 1680x1050 because I can see everything more clearly. It does look sharp in 1920x1080 it's just I strain to see things. The touch on it is great too. In desktop mode I still prefer to have the keyboard and mouse. The Windows desktop UI was designed for a pointer and it's definitely a struggle without one.

Using the device in tablet mode has started to become very natural and downright delightful. It is very convenient when going to a meeting to ditch the extra weight and collapsing of the keyboard and take only the tablet. Using a few already running apps in desktop mode is no problem providing you only need to do minor navigation. Doing some light email and calendar work in the Metro UI is also inline with a typical tablet interface experience.

Conclusion

This device aims to further consolidate the number of devices we carry. Phone, tablet, and laptop. At least this one consolidates two of those.

Using tablets for work can create a very different work dynamic. Creating content at our desks is typical. It's been very interesting to walk into meetings and hand someone my tablet. It connects the other participants to your meeting. You know they're not hiding behind their own screen watching emails. Pretty cool.

If you are a Windows user who travels a fair bit this could be a perfect fit for you. Particularly if most of your work while traveling is email and content consumption rather than creation. If you can leave the keyboard at home this device is only 1.8 pounds which for frequent travellers with T60's over their shoulder will greatly appreciate.

CYOD - The Device Selection

2013-09-12T12:16:00.001-07:00

As pointed out here we are working through a Choose Your Own Device program (CYOD) to weigh the benefits against BYOD.

We were offered to choose one of a standard group of devices. The goal of the program was for the participants to use the device either as their primary or secondary device.

These are the devices the pilot group was offered, where I landed, and how I got there.

My goal was to choose a device that was as far from all of the other devices I currently use, and use it as my primary device.

These two points led me straight to the Lenovo Helix

All of the Ultrabooks were eliminated quickly because I already have one. They are definitely some slick options and I am partial to the Lenovo X1 Carbon. Super slick design and very strong hardware.
The tablet options are powered like traditional Apple and Google tablets of recent years. Definitely great tablets it's just that I already have that too so this wouldn't have been much of a differentiator.

The fact that it's convertible is very attractive. The screen pulls away from the keyboard. So while you're mobile if you want to drop some weight and don't think you'll be creating too much content you can leave the keyboard around and be left with a really powerful Windows 8 tablet. It also happens to have more ports than many of the other devices to choose from.

With the keyboard it's not really an Ultrabook at just under 4 pounds, and is heavier than my existing Ultrabook which was a concern. Once you pull the keyboard away though it's only 1.8 pounds which is slightly heavier than a typical tablet today and significantly lighter than my 3 pound Ultrabook. So far I've been leaving the keyboard at the office and traveling with the tablet only and definitely notice the weight difference in my bag.

The specifications are like an Ultrabook. Where most tablets have an Intel Atom processor, this one has a full Intel i7. Most tablets may have 2GB of memory, this one has 8GB. Most tablets have 32GB of disk space, this one has 128GB. Very much more powerful than a traditional tablet.

It's running Microsoft Windows 8 which is taking some getting used to.

It's only been a couple of days with the device and so far I'm really enjoying it.

Using it as my primary work device it's docked most of the time. While docked I'm finding myself in Windows 8 desktop mode pretty much all of the time. I was also happy to find that my Apple Thuderbolt VGA adapter works with this device so I can use my 22 inch display while in the office.

The device is super peppy right now. It will be interesting to see how Windows 8 holds up after some use and some updates over time. It's been very nice traveling with only 1.8 pounds in my bag. At home I've been using the Windows 8 tile interface just to go through emails and it's been nice to use. Some of the gestures are interesting and convenient.

- Swipe from the left of the screen slightly AND back gets you the currently running programs.
- Swipe from the right side of the screen gets yo the search and options menu. This is definitely an important one to know.
- Swipe from the bottom of the screen up gets you the menu specific for the application currently in view.
- Swipe from the top down allows you to pinch the current program and close it.

Something to realize about the different interfaces is that they are almost two different operating systems.

For example the mail program in Metro isn't going to configure Outlook on the desktop or vise versa. As another example configuring Box sync on the desktop is not going to configure the Box app in Metro or vise versa. Installing Google Chrome however gets done on the desktop and when it's running is technically running in the Metro interface.

Just some brief observations for those who may be giving Windows 8 a whirl.

Check out the specs below. Here is a direct link to the Lenovo Helix website http://shop.lenovo.com/us/en/tablets/thinkpad/thinkpad-helix/

Choose Your Own Device

2013-09-05T06:34:00.000-07:00

Providing users with flexibility in the devices they use for work is one of the most discussed topics in technology.

Bring Your Own Device (BYOD) provides the greatest flexibility for users. With so many variations available to the end users, BYOD also brings significant complexity from a management perspective. Addressing all of the complexity is considered best practices regardless of the program, BYOD, CYOD, or employer provided devices. Some organizations are still just not ready.

Where BYOD is meant to allow users to use whatever client device they want to work, CYOD allows users to choose from a list of employer approved and deployed devices.

There are many large organizations that offer CYOD to their employees to provide users with a more comfortable work environment while retaining administrative control. We have already rolled out a BYOD program with some levels of success. Now the organization I work with is rolling out a CYOD program to determine if it is a better fit.

The program works like this;

Users are being selected based on their role and work activities. The goal is to figure out which type of users will appreciate and embrace the program most.
The devices are all Ultra Books and tablets that will run Windows 8. The goal is to focus on portability.
The devices will be deployed by I.T. with a corporate image of Windows 8. The image will be connected to the domain. From an access perspective it will be like using any other corporate deployed system other than the form factor. The goal is to make I.T. feel like this is the same as deploying the corporate standard laptop. One of the only challenges I foresee is what to do about hardware failures. My guess is that the users will have to live with a loaner a little bit longer than normal because we won't be able to stock all of the variations of devices.

The administrative, and inherently security, benefits of CYOD to organizations investigating these programs are significant when compared to BYOD.

The hardware can be certified by the I.T. team. This means that they have certain levels of assurance as to how the device will perform in their environment. It also means that spare parts can be kept around.
The Operating System image can be standardized. This means the hardening guidelines can be implemented and all of the required software can be pre-installed and configured including security software.
Network based authentication like 802.1x can be enabled to ensure only authenticated users are connecting to the network as described here.

Deciding to join the program is a choice given to the users at this point and was an easy decision. The list of devices is definitely restricted but you still get to choose something, and unlike BYOD you still get the full support of I.T.

More to come on the devices and more perspective on the program.

Save 40-60% On Your I.T. Security Spend

2013-08-27T06:40:00.001-07:00

How would it impact your business to save 40-60% on your overall Security spend, and get more, potentially better Security?

This is the question I ask clients most during consulting engagements. Typically there are a variety of responses that end with the question "how?".

On average organizations spend 5% of their total I.T. budget on security solutions and probably have the bare minimum. When those organization attempt to adequately secure their environments or are driving towards compliance they spend 8-12% of their total I.T. budget on security solutions. They are purchasing many point products that don't work well together. And because they are purchasing point products from several manufacturers there is no real relationship and the manufacturer and potentially reseller will want to make more because this is the only deal they are getting.

Imagine cutting your I.T. security spend in half.

The following example is real and common. Recently we looked at the three security solutions a client purchased through us. This organization definitely purchases many more security solutions, these are just the ones we have visibility to. I am keeping the clients name private because most organizations don't want anyone to demonstrate what could be perceived as a lack of strategy. I am keeping the manufacturers private to keep this unbiased (even though there are a couple of manufacturers I do this with more often with than others).

To renew the following three solutions this is what the client would pay for a new three year term;

Endpoint Anti-Virus - $320,000
Full Disk Encryption - $156,000
Web Security Gateway - $182,000

The organizations current security renewal comes in at approximately $658,000.

We put together a package from two major security software and hardware manufacturers that included suites and a couple of their point products. One of the manufacturers is already represented in the environment in the Full Disk Encryption solution. We typically try to find at least one manufacturer the client has an existing relationship with when doing this and often look to an endpoint solution because they can be more painful to change.

This is where the new solutions landed on price for three years.

Vendor A - $276,000
Vendor B - $224,000

By consolidating security vendors we have saved this client approximately 42%, and got them more security.

What's more consider that this is only a few technologies and that there are a couple more typically implemented to protect client computing devices. Then consider the fact that you are probably spending 5 times this number in the datacenter. You can do that math on what those savings look like.

Strategizing with one security vendor can help to accelerate longer term plans with regards to security by helping to narrow the vendor selection and work on pricing.

The only question we typically get at this point is of the risk of having layered security from a single manufacturer. The various solutions offered from the leaders in this space today are very different. It's no longer that you are getting the endpoint anti-virus signatures on the email gateway.

Security is one of those things that sounds sexy in the news when something bad happens, but is considered nice to have in most organizations. Because security crosses all technology boundaries (servers, storage, networking, clients, etc) it is easy to see how point products are purchased reactively to fill a gap. Developing a strategic partnership with as few security manufacturers as possible will yield the best capital savings, operational savings, and because things will likely work get you better security.

As usual please feel free to reach out if you would like to discuss further.

BlackBerry Q10 review

2013-06-12T16:02:00.000-07:00

It's been great working with the BlackBerry team. And one of the perks is getting our hands on new devices. I've been using the Z10 since November and have been really enjoying it. A review and video can be found here.

Many of the people I've been working with have been anxiously awaiting the latest BlackBerry with full, physical qwerty keyboard. It's here, and probably exactly as you would expect. There are lots of great things in the new BlackBerry 10 operating system that has already been covered. For this post we will focus on the new device.

For those who were a fan of the Bold family of devices this is the natural progression. This iteration is thinner, lighter. Yet this new model also has a screen that is approximately 30% larger. Physically its moderately larger than the Bold and is smaller than the Z10. As you've likely seen it has a fiberglass backing. The backing is actually unique to each handset because it is cut from a piece of fabric which will change with each cut. It looks awesome and feels great. It's got some slight grip to it but is not sticky. Similar to the rubber backing on the Z10. The sides of the device taper from the back to the front. When you are holding it this tapering gives you a very secure grip which is becoming uncommon. It does feel like a tank of a phone compared to much of the competition and I wouldn't anticipate some drops having much affect on it.

The keyboard is approximately the same size. The difference is that rather than the curve across the top this one is straight, making more room for the screen. Typing seems to be the same experience. Something that I noticed immediately is that typing on a keyboard has become a little awkward for me. The predictive type is very effective on the Z10. As long as you are close to the correct letter the predictive text will figure out the rest. With the physical keyboard you actually have to hit the keys much more deliberately and accurately. Because there is a physical keyboard you also can't switch to landscape mode to type.

There is a software update over the Z10. The two major welcome enhancements I've noticed are; the background colour of the SMS application is black instead of white. I was trying this to no avail on the Z10. It is easier on the eyes and drains the battery slower. The other is that because there is a physical keyboard always present you can just start typing what you want and the correct application will open. For instance type a phone number and it will prepare to dial, type an email and it will find the contact to email. Similar to the Bold.

Overall a very nice device. For physical keyboard and former BlackBerry Bold fans this will be your best fit device.

P.s. I wrote this post on the phone :).

Addressing Bring Your Own Technology

2013-04-22T10:47:00.002-07:00

How to implement a Bring Your Own Technology strategy is still one of the most rampant conversations we have everyday with businesses. There is no single technology that is going to make the implementation successful. The goal of this guide is to outline the variables that need to be addressed so that you can find an approach that will best fit your organization.

There are a few reasons organizations choose to have users bring their own technology. The first step in figuring out what to do about BYO is to figure out why you are doing it. What's interesting is that as time goes I'm finding that people aren't really sure if they are trying to enable BYO or prevent it. Either way this guide will have you covered;

Employee satisfaction - Because of all the great smartphone and tablet options available, business users are leveraging their consumer smarts and wanting to bring them to the business meeting. It is difficult to stop users from walking in with these devices so may as well prepare for it. There is also a new generation of users who are used to using certain types of devices.
Cost savings - There can definitely be some cost savings to users bringing their own equipment to work rather than providing them. You just need to plug in a few variables to figure out if this applies to you. Here is a post on the topic.
Increased security - There may be an opportunity to keep data in your private datacenter under a program like this. Either way, BYO needs to be addressed because people, users or not, can probably bring their own devices into your network today. Just because you say no doesn't mean they can't.

BYOT involves technologies such as laptops, tablets, and phones today. For this article all aforementioned devices types will be included when considering policies and associated controls.

Policy

Each of the policies developed should start with your Why statement. It is important to articulate specifically how you want the program to look so that you know what changes will need to be made.

A BYOT Policy must be developed first to define what the program means to your organization. Answer the following questions in the form of statements and you should be off to a good start.

What roles in the organization are allowed to participate?
Who pays for the hardware?
Who pays for the telco plan where applicable?
What type of management of the device will the organization implement?
Who and what is allowed to connect to the network?

From the organizations I've been working with most will allow the use of all employee owned smartphones and tablets. The employee's pay for their own devices and plans. The company will often provide a monthly stipend for the telco plan on the phones and not allow the user to expense anything over above and beyond. The devices will be managed by the organization in order to push a pin, email, calendar, contacts, and corporate wifi profiles. Then be able to partially or fully wipe the device if the organization ever feels that the data is at risk.

Some differences; In many financial institutions this is being permitted to small groups without access to sensitive data. Some organizations only allow one type of device. We have seen some organizations only allow Android where others only allow Apple.

A Network Access Control policy may already exist in the environment because the wired and wireless networks have been in place for so long. It is important to clearly define how users are permitted to connect their own devices to the network. And more importantly implement enforcement of this policy automatically rather than leaving it to the user. Think about your environment today. Is there anything in place to prevent a user or guest from plugging into an Ethernet port and getting the same access as a regular user?

What roles in the organization are allowed to connect their own devices to the network?
What networks are they permitted to leverage (wired and/or wifi)?
What network resources will they be able to connect to internally from their own device?
What type of devices will be allowed to connect?
What type of device management will the organization implement, if any?

This is an area where we definitely see a lot of inconsistency. If you are going to allow users to connect their personal devices there are definitely ways to do it in a safer way. One way would be to identify BYOT devices by device type, Operating System, and user. When users in the BYOT program connect to either the wired or wifi networks you can place them in an IP subnet with a single IP address. This would prevent them from communicating with any other IPs directly. This is an important restriction because if you do not manage the device you have no way of cleaning compromised systems. In a single IP subnet all traffic from the users device would have to come back to the firewall for interrogation. From there we can permit them to use our DNS server, Outlook Web Access, and perhaps our Citrix or VDI. This type of configuration can significantly reduce the potential of a users own device compromising other devices in your environment. It also reduces some of the risk of data loss by keeping all of your data on your systems rather than allowing them to get it on to theirs and walk out of the facility with it.

Infrastructure

Now that you have articulated how you want the program to be executed it's time to look at some of the infrastructure to see if it can handle it.

Think about users downloading and updating their systems and apps. They are going to prefer to do that in your high speed network than their residential Internet connection.

Many organizations don't have WiFi deployed yet. Many others who do deployed it many years ago as a secondary luxury network. One thing in common with many devices that users will bring it under this program like a smartphone, tablet, or even ultrabook will not even have an ethernet port. A wireless site survey will help to determine if there are enough access points to support the new devices. Keep in mind that the WiFi infrastructure needs to connect to the core and disritution network so it's important to determine the capacity of this environment too.

Estimate for every user to have 3 devices, a phone, tablet, and laptop. Some users may have multiples of each still. A great way to find out for sure is to send out a survey to all employees describing the program and ask them what they would likely do. This will give you a good indication of the level of participation. These modern devices are definitely noisy with their synchronizations and constant app updates. The amount will clearly depend on the user however I would estimate at least 500MB per day per device.

A better approach is to monitor your WiFi connections to your core/distribution network for regular usage of in your environment. If you know approximately how many of these devices are currently leveraging your network and how many you anticipate would participate in a program you will be able estimate more accurately the new load on the environment. One of my favorite tools for network monitoring is http://cactiez.cactiusers.org/.

Access Control

Access Control is the area where we take the Network Access Control policy and make it a reality in the network.

Network Access Control is a technology that may already be in your network today. It can't often be found in WiFi access points, Network Intrusion Prevention Systems, or as a dedicated server appliance. My recommendation is to always investigate what you already have. Every new technology is just another thing that needs to be maintained. And every new cost added to the BYOT program reduces the Total Cost of Ownership.

The challenge is, to do it right you need to enforce NAC on the wired network too. Therefore a separate NAC appliance is typically going to be the most robust way to enforce the policy throughout the environment.

The first step is to define your VLANs. There is probably already one in the environment for general use. PC's can talk to each other, they can get to internal servers, they hopefully have restricted access to the DMZ, and they can get to the Internet. This would be considered a privileged network. A new VLAN needs to be created for BYOT with the restrictions discussed earlier. It may be a network that only has access to the Internet, DNS, and VDI.

Typically the way NAC works is through a protocol called 802.1x. When a user connects to the WiFi or wired network the WiFi access point or switch is going to look for 802.1x protocol coming from the client. If the client device does not have this enabled you would automatically place them in the BYOT network defined above. So everyone will be placed into this restricted network as a first step. On your corporate deployed PC's you will need to enable 802.1x. When those users authenticate their VLAN will be set to the privileged VLAN.

The most confusing thing about NAC is that you are really restricting access to all users as they connect, where today they probably connect freely. When you find out that they are authenticated or are on one of your corporate deployed devices you would elevate their privileges. This concept can be tricky so it is recommended to keep the NAC policies simple to start. The moment someone is put into the restricted VLAN when they should be in privileged their could be serious backlash. Clearly, NAC is a necessary component though if you want to permit unmanaged (and probably unsecured) devices to use the corporate network. This is also a technology that many organizations use with or without BYOT. It's a great way to enable users to bring their own technology, but if you don't want anyone to bring their own technology this is the only way to stop them.

There is more information in this post.

Device & Application Management

Finally we get to the devices themselves and as close to the data as possible.

As described earlier Mobile Device Management today is exactly that, device management. In most environments policies will be created to push and enforce a pin, email, calendar, contacts, and a WiFi profile. This is a great way to know that any device that is connecting to the environment has some basic security on it and that you can at least wipe it if necessary. It also helps to secure the WiFi because you don't ever have to give a key to users, and could even push certificates for an extra layer of authentication. With the number of devices it is not worth the time of the help desk team to be walking users through configuring these settings. Some newer functionality includes the ability to block or encrypt apps. If you wanted to block a cloud storage app on mobile devices because you don't want users storing your data outside of your environment, you can now do that. If you want to take it a step further and enable them to use someone elses storage network but keep the data safer you can now encrypt and even wipe that data.

One of the best ways to enable users and keep data safe is with application or desktop virtualization. In this model the user sees the application or an entire desktop on their device that is being published from the datacenter. The best part about it is that if configured correctly all of the data stays in the datacenter. It doesn't matter what type of device the user is using because the data doesn't actually get saved onto their client device. Some of the downsides may be screen real estate and usability, along with the fact that the user must be online in order to get at their data.

URL or traditional content filtering can also help keep data safe. If users can't get to file sharing websites like Dropbox or Box the data can never get there. Now you only have to worry about YOUR network getting hacked and not theirs too. One of the challenges here is that it can be tricky (not impossible) to keep these policies enforced when the user brings their device home.

Data Loss Prevention is also recommended particularly at the email gateway. DLP can look at specific content and make decisions on how it can be used. If you do not want client contact information, or your employee Social Security/Insurance Numbers, or credit card numbers to get onto any type of mobile device in this setting, one way would be to prevent users from sending it via email. This is probably best practice anyway.

Bring Your Own Technology can be a great way to increase employee satisfaction, reduce the costs of client devices, and reduce help desk costs. There are many permutations on how to implement a program like this. It is important to look at your program holistically to make sure everyone is comfortable with the results.

As always I'm more than happy to discuss any of the strategies presented here specific to your environment.

Considering Cloud Security

2013-02-21T10:10:00.000-08:00

What are our options when it comes to cloud security?

Cloud is largely a catch all phrase for things that we've already been doing for years like SaaS, IaaS, and virtualization. As a result there are some pretty good techniques and technologies for securing your organizations data. Let's take a closer look at what we can do to secure data in any facility used as a service, particularly one that you don't own.

For the sake of brevity we will sum the challenge up with services operated by organizations that are not yours where your users are storing data. A few examples are;

IaaS - Infrastructure as a Service where you would assign compute and storage resource and deploy custom applications including Operating Systems, like Microsoft Azure.
PaaS - Platform as a Service where you would load your own applications onto someone else's cloud infrastructure and the provider manages everything all the way to the Operating System, like Amazon's EC2.
SaaS - Software as a Service where it is an application you may have in someone elses facility, like Box.com, or your web hosting provider.

SaaS becomes the biggest challenge because of the flexibility. You may have your website hosted in someone elses network where they manage the actual server software and Operating System. What most people don't realize is that is where the service stops. There are no Intrusion Detection or Web Application Firewall type systems, largely because they don't know how you need the site to be secured.

SaaS based storage solutions are the ones that are making the biggest impact on data security today. Box, Dropbox, Google Drive, Amazon, Microsoft Skydrive. They all give you ubiquitous data. All of your stuff appears on your laptop, tablet, and phone. I am a huge fan of these services.

The point is you spend thousands of dollars (in many cases millions) on securing your corporate data center and with one save of a critical file to a cloud storage provider all of that security is circumvented. Who actually runs many of these services? Rather than hacking into millions of computers and stealing data, why don't I just setup a cloud storage service? Make it pretty, easy to us, and free! Rather than me stealing your data why not just give it to me? This is what your CIO is hopefully at least pondering.

The same goes for infrastructure services and things like hosted email and web applications. Who are these people and what are they doing to secure my data? They typically will publish a document outlining what their security posture is like. How do you know it's actually like that? And how do you know if their system gets popped and your data is compromised? Is this risk that you are willing to take? I'm just saying.

Authentication and authorization is a great first step. Using your existing authentication services Like Active Directory is ideal. This way if you want a user to no longer have access to several applications, including internal ones, it is one place to go disable the account. Services like Amazon and Google get huge bonus points for integrating a two-factor authentic action system for you. Centralized authorization is also key. You may be OK with marketing teams to collaborate with cloud services and probably would prefer that anyone in finance or human resources does not. There are cloud brokerages services that do this and also on-premise solutions if you prefer more control.

Application Control can be very helpful. If there are pieces of client software for laptops and other mobile devices and you don't allow the applications to start on the clients in the first place this may prevent the users from getting data there even with an account. However there are some caveats before it is effective. You will need to be managing the laptops, tablets, and phones. You will also need a Mobile Device Management solution capable of this. All of the leaders in this space today are capable. On its own this solution is cumbersome and difficult to manage.

Web Filtering is effective because all of these applications access a URL they can easily be blocked. A typical web filter will have categorization for these services, so if you only know about a couple of them but the users find new ones, the web filtering company is responsible for keeping that category updated with all of the sites. This also gives you decent control to allow or deny certain sites depending on what group the user is in. The challenge is to find a solution that will work from the network, their laptop, phone, and tablet.

Data Loss Prevention offers the most granular controls. Where the other solutions are good at identifying where the user is going, DLP is more concerned with what is going. If you don't want files with account numbers, credit card numbers, social insurance/security, or anything else that can be identified from leaving, this is a good fit. Furthermore DLP can often be integrated with encryption so you may allow confidential data from leaving and encrypt it before it does so that it stays private. Yet again we run into the situation where we can easily do DLP in our network and on our laptops. Other mobile devices suffer from a lack of available solutions today.

While it looks pretty gloomy, we can paint a pretty picture of what to do. It is best practice to use these solutions together. Figure out who you want to be able to get to these sites and plug that into your directory server. Then use either Application Control or a Web Filter to allow the specific applications you want those users to use. Then figure out which data you definitely don't want leaving the environment and stop it from leaving with DLP. If DLP is configured well users will not be able to get confidential data onto their phones because you can stop it in email. Even though from their phones and tablets they may be able to use any service they want they won't have local access to corporate data to put it there.

As always please feel free to reach out if you would like to discuss this further.

Five Reasons BES10 WIll Be A Game Changer

2013-01-30T08:12:00.000-08:00

Considering BlackBerry out of the game is like saying you won't drink water out of your tap now knowing that Coke exists. If you are interested in securely managing data on your smartphones and tablets you will at least look at BES10 and BlackBerry10. While the competition is definitely popular there is no question that the original is still best for business.

No question Android and Apple devices have come out with new sexy hardware, Operating systems, apps, and ecosystems of services. BlackBerry has had basically the same hardware, OS, and apps (actually even less apps than before) for several years now. One thing that has remained constant is that businesses love the management infrastructure and security of BlackBerry.

We have been taking approximately 1000 calls per year about how to manage Android and Apple devices like you can manage BlackBerry's. While there are definitely some slick solutions out there none of them really measure up quite the same. What's worse is that while all of these businesses are looking at MDM they have been doing a lot more looking than buying. And every time RIM makes an announcement about the new BES10 or BB10 devices the calls slow down in anticipation of launch. Most of said launches either fell short or never happened at all.

I've had the pleasure of getting out to the RIM campus in sunny Waterloo Ontario over the last few weeks for a deep dive into BlackBerry 10 and BlackBerry Enterprise Server 10 (BES10). We have a separate post ready about the things we like about BB10 but are not allowed by NDA to talk about them yet. Here are the things that make BlackBerry and BES10 a potential game changer.

No public API's for BB10 - without an application programming interface into the BB10 Operating System, other MDM solutions like Airwatch and Mobileiron will not be able to manage BB10 devices. Because so many organizations have sacrificed much of their systems management and security in BYOD scenarios and settled on ActiveSync alone, BB10 will be manageable through ActiveSync and BES10 exclusively.
Gatekeeper - prior to December 2012 BES10 did not have the ability to ensure that any device connecting to ActiveSync was enrolled on BES10. Gatekeeper is a small piece of software that connects to ActiveSync to make sure that every device connecting to your network is enrolled in your BES10 MDM.
Android and Apple support - since RIM acquired Ubitexx in 2011 they are now able to manage the other most popular mobile Operating Systems. The integration is now complete in BES10, meaning through a single management station and single pane of glass you can manage all BB10, Android, and Apple devices. Until this month the integration was piecemeal.
Current install base - This is the big one. Most organizations already have a BES. This means they still have BES licenses. Upgrading to BES10 is a relatively simple procedure and the licenses are transferrable. This will give administrators and procurement teams a certain extra level of comfort. It's much easier to upgrade a solution than to deploy a completely new one from a manufacturer you've never worked with before. The support cals will be transferrable.
Balance - One of the things businesses are struggling with is how to wipe corporate data and leave personal data. Because on most devices the user can easily save email attachments to the device or a cloud service it is impossible to know where that work data has gone. At the root of the BlackBerry10 operating system, the kernel, is BlackBerry Balance. With a single swipe the user can switch between a personal version of the phone and a work one. Within the work area there is no mixing of the data and the administrators can prevent cloud apps from getting installed in the first place. When the work area is wiped you have a much higher level of assurance that the data will no longer be available to the user. The residual risk is still that the user may forward data to a personal email address however this can be prevented through policy or with a solution on the email server like Data Loss Prevention.

There has been a lot of investigation by businesses around how to manage all of the new smartphone operating systems available today. RIM had this market on lock many years ago. And now with a compelling new smartphone of their own and a management infrastructure people are used to there is a great chance that they will regain the seat on their proverbial MDM throne.

If you would like to discuss BlackBerry10, BES10, MDM, or BYOD strategy please reach out!

BlackBerry 10: First Impressions and Deep Dive

2013-01-30T08:09:00.000-08:00

The new BlackBerry 10 has arrived. Because Softchoice is part of the BlackBerry Technical Preview program, we had exclusive access to the technology (handset and server software) before it's official release, and I was able to spend a couple of weeks using the device. During that time, I had a chance to form some pretty strong impressions about the smartphone. Read on for my thoughts, as well as a bit of a technical deep-dive into the latest offering from Research In Motion.

< read more >

This image is from blackberry.com. The device is very similar. http://global.blackberry.com/blackberry-10.html?iid=ca:bb:desktop:homepage:Oct2012:footer:bb10

First Impressions

Right away, I was impressed with the unit I used (Model number STL100-3, OS version 10.0.9.1673). The hardware is stylish and sturdy, and the OS is smooth. Unfortunately, I was the only one who could really appreciate it.

Outside of the internal pilot group (we were all under strict NDA) we were not permitted to physically show the device to anyone in the office - which as you can imagine is quite difficult when you're trying to use a smartphone to do work.

The SIM wouldn't work either on the initial build, (so no phone or SMS) likely to make sure that we aren't walking around the street with it. This was resolved with an update a week ago.

Hardware

Like most Blackberry devices, this one is slick and feels luxurious. The back panel that removes to cover the battery and SIM is covered in a thin high quality rubber with small divits, allowing for great grip but not too much that it gets stuck in your pocket. The sides of the device are made of a dense high quality plastic. The face of the device looks great. Approximately a 1 inch strip of high quality plastic across the top and bottom of the face that also houses the speaker at the top and microphone at the bottom. The rest of the face is all glass from side to side making it appear very modern and giving the impression that it was engineered to maximize it's physical dimensions. The face of the device appears similar to the back of the iPhone 5, with the feel of the Galaxy Nexus (since we love to compare). You'll understand when you hold one.

The team at RIM recently got me back on to a Blackberry 9900 when my Samsung Galaxy S broke. I was skeptical because of all the Android apps I became accustomed to. The BB10 phone didn't freeze unlocking. And the phone didn't freeze when I needed it to work fast. Then the battery lasted two days. After the first day it seems like the battery is going to perform like most other modern super phones. On a full charge, only the wifi antenna on, and synchronizing and Exchange, gmail, twitter, and LinkedIn I'm getting around 15 hours on a charge. Obviously there is some heavy fiddling around navigating all of the new settings and features. This is something most people are getting used to.

Operating System

The application tray is again similar to IOS and Android in the sense that you get screens full of icons and you can switch through screens by swiping right and left. When you start an application you can push up from the bottom of the screen which creates a live widget of the application on a dedicated home screen reserved just for these types of widgets. This is also the way you would stop a program from running. What is unique about this is that you don't need a dedicated widget from the application maker. Many applications can turn into a widget simply by swiping up from the bottom while in the app.

Unlocking the screen adds to the feeling of quality. A new feature in the OS called Peek is present in the lock screen. The iPhone is basic and functional with a slide to the right. Android is more robust with multi-direction swiping that can take you directly to the app of your choice. Unlocking the BB10 screen starts with a fading of the lock screen as you slide your finger. The fading is actually being pushed by your finger so as you slide there is more unlocked screen displayed where your finger is. And as you are unlocking you get to Peek at the last screen you were on. Pretty cool. While you are within an application you can push up from the bottom of the screen and over to the right to Peek into your Hub (covered below) to see if you have any new messages of any kind.

The phone is super fast. I lit it up on Telus and connect at 4GLTE. Here is a pic of the speed test I ran. Enough said.

Applications

The screen all the way to the left is the Hub. Many platforms have a similar application. You can aggregate messages from supported accounts in a single screen. There are two main differentiators with Hub. The first is that getting to hub doesn't mean finding an application. It is integrated into the OS. So you can get to it by pushing up from the bottom and over to the right. There is also a little symbol at the bottom of the screen beside the screen number indicator you can tap to get in there. The second is that it does research for you. When you go into a meeting invite it will look at who is invited and provide you recent emails, social media interactions, and even articles regarding them or their company. This is great when going from one meeting to another and you need to reframe yourself for the person you're about to meet. Great for business users.

They keyboard is quite interesting. Most keyboards provide predictive text. So far this one has been quite accurate. Rather than having a row of potential words at the top of the keyboard as you type them out, this one allows you to swipe in the direction of the word you want. It takes a bit of getting used to of course. But it does feel smoother to swipe up in a direction than to stop typing on the keyboard entirely and pick a word from the top, then move back down to the keyboard.

The camera app is pretty unique. While focussing on someone to take a picture it actually seems to film them for a few seconds. Once you are in the photo you can actually move around in time to make sure you've got them with their eyes open and that they are smiling. When there are multiple people in the shot it will even make sure to line up both individuals at a time when they both have the right expression. From there you can easily create slide shows and add music to them all with a couple of swipes.

During the setup process it asks for Evernote credentials because it will be heavily integrated into the device. Evernote is integrated directly into to native notes taking app called Reminder. Similar integrations like this are available for cloud based storage solutions like Box that are viewable through the native file manager.

Outside of that the apps are still currently lacking. At the time of launch it is anticipated that approximately 70,000 applications will be available, without having 50 different versions of solitaire or fart sound boards. This ecosystem and the way they integrate with other ecosystems will be key to the adoption of these devices. With the social media functionality of Hub and the camera this phone and OS could definitely be seen as attractive to younger users and business users.

Security

Balance is a feature that allows administrators to segregate work and personal apps and data. This functionality is not a bolt on, and is embedded into the operating system at the kernel level. This could be the home run solution for so many of the organizations I've spoken with about BYOD. Administrators can create a Work profile on the devices from the management station. From there they can push down all of the typical configurations we've come to love about BES like email, calendar, contacts, passwords, wifi profiles, certificates, intranet browser, etc. The administrator can even push and delete data files on the devices. From there the user can easily switch between their Work profile and Personal profile by swiping down from the middle of any home screen. The two options appear and they select where they want to be. The theme seems to change so it is clear that you are in a different environment. Then the applications you have available to you also change depending on what is installed and what the administrator allows in the Work profile. We anticipate doing a dedicated post just to this topic.

Provisioning

New to BB10 is ActiveSync support. This allows BYOD users in particular to connect to their corporate email server. Provided by ActiveSync is very basic provisioning of password enforcement, email, calendar, and contacts, and full device wipe.

Most organizations are looking for more than this on all platforms. We deployed BES10 too which can manage BlackBerry10, Android, and Apple devices. This allows for much greater control over the device and many more configurations that the administrator can push to the device so that they don't have to walk users through configuring them. More details can be found in another post.

Final Thoughts

BlackBerry10 is definitely going to make waves both in the consumer and enterprise markets. Consumers will like the usability and built in apps. Enterprises will like the manageability and security. The third party apps will definitely contribute to the level of success that BlackBerry10 has. Please feel free to reach out to me directly if you are interested in discussing the features of the device.

Here is a video review.

http://vimeo.com/58512594

Eliminate Office Software From Your Laptop

2013-01-28T08:31:00.000-08:00

Where I work we have a BYOC (Bring Your Own Computer) program. Basically they provide a stipend every three years and we are expected to go buy a laptop that we manage. The company also provides a Virtual Desktop Image with all of our business applications and all of the other enterprise software you can imagine.

The idea is that your BYOC laptop is yours to do whatever you want. For business purposes you would use the VDI and therefore all of the data should theoretically stay on this Virtual Desktop Image. This is can be great from a security perspective because you are allowing the company to secure the data however they want and it should stay within the network.

I do not have Microsoft Office on my MacBook and don't want it there. One of the challenges I've had is that I'm mobile a lot of the time and need to present data. For things like presentations it is very handy to have it locally because the local application shows up better on the screen than the VDI.

This weekend I stumbled on a very cool solution.

Within outlook.com you can now use what appears to be full web application versions of Microsoft Office products. Basically you have full versions of Powerpoint, Word, and Excel all through a web browser. All of which can be put into full screen mode. Combine this with the local wifi wherever you are or turning your phone into a hotspot and you've got a nice little solution.

The next logical step is how to I get my data there? Because it's work data you may not feel comfortable putting it there. It's Microsoft so their network is likely pretty secure. They don't have features like two-factor authentication though. Emailing files all over the place is messy. You end up with different versions and duplication all over the place.

If you have the SkyDrive application installed on your work VDI, you will have the option to turn on visibilities into all of those files within SkyDrive. So the process is to install the SkyDrive application on your work VDI. Then before a needing the presentation remotely, login to the SkyDrive web interface. On the left hand side you will see a heading named PC's. Under that you will find the name of your work computer. When you select that computer you will be given the option to temporarily view all files on the PC running the SkyDrive application. From there you can open it in the web application version of Powerpoint and put it in full screen mode.

You can keep all of your files on your work VDI keeping them within the confines of your corporate network. Then temporarily view them in SkyDrive and have them everywhere.

Business Trip - laptop - cell phone = success

2012-10-31T05:58:00.000-07:00

This week I was in Las Vegas on business. The screen on my Samsung Galaxy S stopped lighting up the night before, making it quite useless. I also decided that my laptop was too heavy to drag all the way there for the limited amount of use it was going to get. As a result they were both left at home.

Instead I decided to take my Motorola Xoom, the first Google Experience Device tablet. The entire night before my mind was flooded with what if's. I was so nervous that something was going to come up where I would need to turn into a power user or get at some data either on my laptop or in my corporate network (which for the record are synchronized so really one and the same). Being in Las Vegas we would obviously need to text each other to coordinate where to meet. Here are the apps that allowed me to get by, largely due to the great quality free wifi.

Google Voice - This was a big one. Not only was I able to send text messages to people but was also able to make phone calls from my tablet using GrooVe IP. Text messages were instant and the voice quality was as good as a desk VoIP phone.
Evernote - I use this to take notes during conferences. There isn't anything sensitive so I'm not to worried about what goes on behind the doors of this public service.
VMware View - we have virtual desktops back in the office. To run internal applications this is a great way to do it. It would have been nicer with an external keyboard and mouse but to get in and run a few commands, totally acceptable.
Native email and calendar - I usually don't use this tablet for work. The native email and calendar apps in Jelly Bean are amazing compared to what was on my phone. Creating and responding to emails was just as good as using Outlook. As you type someones name in a new message it automatically does a GAL lookup and finds their email address. The only issue I had with the calendar app was someone cancelled a meeting they had scheduled and there didn't seem to be a way to remove from calendar like in Outlook. Very much a minor, acceptable inconvenience since you could go into the calendar and manually delete it.
Cloudon - We had a Powerpoint deck that needed to be viewed properly and there was a chance in making a few edits. This app runs full Powerpoint virtualized. Again this would have been beautiful with an external keyboard an mouse had we needed to edit. Turns out we didn't though so just had full Powerpoint on the tablet.

It really was a great experience. A 4 pound laptop doesn't sound like much. When compared to a 1.5 pound device that pretty much gets the same thing done it makes a big difference.

On top of the convenience there was another unexpected benefit. I'm not quite dorky enough to bring my tablet to Tao to party. Going out at night without a cell phone was totally liberating. It felt more like living in the moment. Not being able to peek down at my phone every few minutes like everyone else kept me un-distracted with what was going on around me.

Virtual Desktop for BYOC first impressions

2012-10-22T09:33:00.000-07:00

A virtual desktop is being provided as part of our Bring Your Own Computer to work program. The thought process is that our users definitely require the popular Microsoft Office applications every day (Outlook, Power Point, Excel, Word). We also require Adobe and have several in house custom applications. All of them will require support from our internal I.T. team. Rather than having to deal with malware ridden personal computers it is much easier to provide a virtual desktop for each user so that the image and whatever gets installed is very closely managed by I.T. It is also more cost effective to get corporate pricing than to provide users with a stipend to get the software or allow them to expense it. This week I was given the opportunity to give it a whirl.

My first impressions were very good.

First test case, connected from within our local area network from my corporate laptop. Chrome, Internet Explorer, and Outlook were started at the same time and all popped up within a couple of seconds. Visiting a couple of websites in Chrome was super peppy. I ran a report in our Business Intelligence system in Internet Explorer and the results were generated almost instantly. Sending and receiving emails was instant. And unlike my laptop Outlook didn't go into Not Responding with every other click. The full screen mode really felt like working directly on the computer my hands were on.

Second test case, from home. My Internet connection was maxed out at the time from something else. Usually you can't even get to websites under these circumstances because of too many dropped DNS packets. The VMware application connected without hesitation and I honestly felt no lag. This was impressive. I ran the same applications with the same experiences. This time I monitored system activity. CPU for the VMware software stayed at 0% utilization. RAM maintained around 70MB, climbed up to 300MB for a short period of time, then stabilised at 70MB for the duration of the testing. There was virtually no disk IO. This is definitely impressive.

Third test case, from my Android tablet. It is a Motolorla XOOM which is very similarly spec'd to tablets that have been released recently but this one is almost two years old. With a 1Ghz dual-core processor and 1GB of RAM the VMware application launched and connected very quickly. There was a little bit more lag when navigating through applications. It could have been the way I was using gestures to do this rather than an external keyboard and mouse. If you had external display, keyboard, and mouse this could be a great day to day solution. There doesn't seem to be an option for offline desktop option for the tablets. This would allow you to keep a copy of the desktop locally so that if you are not online and want to plow through some email you could. So using a tablet exclusively for this application may get frustrating if you travel and find yourself without network connectivity from time to time.

The next step will be to test offline desktop mode performance from a laptop. The feature isn't enabled yet in our environment. This will undoubtedly chew up more CPU, RAM, and most importantly disk IO on a laptop. On the server that hosts the desktop CPU and RAM seems to be powerful and cost effective enough to throw lots of resources at. Disk IO though is what concerns me most. On this laptop disk IO is the weak link. When things slow down it's because some application is chewing on the disk. My hope is that someone will be monitoring this closely as we add users to the server to make sure that the appropriate number of users are added to each.

Why most NAC deployments fail

2012-09-18T05:43:00.000-07:00

Network Access Control. Another somewhat ambiguous yet ubiquitous security term floating around for a decade. The principle of NAC is legit. The goal is to make sure only authorized users and devices connect to the network. This should be a pretty good start at preventing someone from walking into your office and getting their own computer to start stealing stuff. Or perhaps to prevent corporate users from connecting their personal laptops riddled with malware to the corporate network. Sounds great on the proverbial paper.

With Bring Your Own Device smartphones and tablets and Bring Your Own Computer becoming very popular client computing models, NAC is starting to become popular again. Because users are administrating their devices we want these users to have limited access to corporate resources.

The reason many NAC deployments fail is because rather than permitting everyone and everything into the network by default, everyone is blocked by default and privileges are elevated after some interrogation.

Classic example. We create a policy that denies users to the network for something like they do not successfully authenticate or their anti-malware software is not present. The C level staffer connects to the network after their password has expired or they decide to bring in their Macbook Air that doesn't have anti-malware because they are too secure </sarcasm> that day and the project is over.

What we have found to be successful is to implement a somewhat more permissive approach. There needs to be at least two networks configured.

Full Access - This is the VLAN you probably already have configured in the network today. When a user gets an IP address in this network they can get to the Internet, any internal servers, and also communicate with other client computers (right or wrong).
Restricted Access - This network will be used to provide limited access to those users, identified through NAC, to not be up to standard. The recommendation is to provide Internet access for TCP 80 and 443. If a user attempts to connect to any other web services internally they should be redirected to a portal letting them know that they failed the NAC test and that they are being treated like a remote user until they remediate the issue (enable anti-malware, firewall, etc).

To get started with NAC it is recommended to give it a whirl first. Most environments have the equipment it takes already in their environments to do this. In this example we will configure 802.1x supplicants on our corporate provisioned laptops and authenticate them to RADIUS running on our Microsoft AD server via the switches.

Testing a deployment like this with switch ports in a meeting room is usually acceptable.

Decide who the groups of users are (FTE, Contractors, Manufacturing, Stores, Guests). Each group may have a different level of access which will need to be defined by a new network/VLAN. This is more of a policy conversation.
Decide the levels of access. For example if a user is authenticated they will be granted access to all services into the internal server network except for RDP and SSH, and HTTP/HTTPS and DNS out to the Internet. Non authenticated users will only be granted the Internet access.
Configure the VLANs and access control firewall rules associated with them on the firewalls. Where this gets done in the network may vary from network to network. Best practice would be to route all of these networks to the firewall. This allows us to centrally control access from one network to another internally and externally.
Create the VLANs on a test switch. From here you can assign the VLAN to a specific port and make sure that the proper access controls are effective, then move on. For example assign the full access VLAN to the port and make sure you can connect and access the specified resources. Then apply the restricted access VLAN and make sure you can't access any internal resources.
Configure 802.1x on a test switch port. 802.1x is the protocol that allows you to authenticate users to the switch before allowing them to connect. It is a seamless process once everything is configured and the user does not need to interact to supply their username or password. For example if a domain user connects to the switch successfully they will be granted full access. If a contractor or someone using their personal computer to connect they will be granted restricted access. http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_9_ea1/configuration/guide/Sw8021x.html, http://h17007.www1.hp.com/docs/interoperability/Microsoft/4AA2-1531EEE.pd
Enable 802.1x on the client device. In order for your computers to connect seamlessly through 802.1x they will need to configure a supplicant on their computers or you can push this out as a GPO. With NAC appliances this can be achieved by dropping a java or ActiveX applet on the client computer. http://windows.microsoft.com/en-GB/windows-vista/Enable-802-1X-authentication, http://support.apple.com/kb/HT4772.
Test authenticating with users. With 802.1x enabled on the client device connect the computer to the network and check the switch to see that the full access VLAN is assigned to the switch port and that they can access resources normally. Then disable 802.1x on the client so that it does not have authentication and make sure that the default restrictive VLAN is applied. From here you can go more in depth and create users in different groups and change their access levels if required.

If you don't get too many complaints after running meeting rooms and perhaps wireless networks like this your organization may be able to accept NAC. From here you may want to investigate a commercial solution that will allow you to do more interrogation of the user and device they are using. Perhaps you want to make sure that they have anti-malware running and up to date. You may want to check that they are running a recent operating system that has less vulnerabilities than it's legacy counterparts. Most commercial NAC solutions allow you to check almost anything that is happening on a client computer and make decisions of how much access to give depending on what it finds.

Choosing to BYOC

2012-09-17T15:41:00.000-07:00

When given the choice to BYOC I was instantly excited and images of Ubuntu or OS X flashed through my mind.

Bring Your Own Computer is actually starting to take off. Many of the customers I meet with are considering ways to do this. There are some cost savings to it if done properly which is fuelling some of the push. Users whining about bringing whatever they want into the office is also helping. We seem to have won with smartphones and tablets when you look at the BYOD craze that's also going on. Many of my customers say that it's actually more to do with younger people coming on board who are more familiar with MAC's and their internal I.T. teams inability to support them. I'm not sure why they don't feel like they can support them but perhaps that is for another post. Regardless, BYOC seems to be here. The company I work with is starting a pilot and wants me on board. There have been many ups and downs and so I thought to share them here for others considering this.

The proposal looked something like this;

You will be allowed to bring whatever PC OS you would like into the office.
The company will provide a stipend every 3 years. Unfortunately it gets applied to your paycheck as income and therefore gets taxed before you can spend it leaving you with approximately 1/3 to 1/4 of what it will take to buy a laptop.
You must purchase a laptop.
You must run anti-virus.
Any other software is up to you to purchase.
You will be provided with a full desktop via VMware View.

The company will not provide any technical support for your laptop or applications other than VMware View.

After mulling this over for a few seconds I was a lot less excited.

I love routers, switches, and server OS's. I hate doing technical support on PC's. To the point where I chose to DYOC (Ditch Your Own Computer). Approximately five years ago I decided that the companies I worked with provided more powerful computers than I had at home on a more consistent basis. They also provided enough access to install whatever necessary. So I ditched all of my personal computers in favour of using the corporate computer for everything. It has been a great experience. With all of the web applications to store my documents, music, videos, photos etc my personal data was never really relying on the work computer and I can get it from anywhere. When something went wrong with the computer I traded it for a loaner with a technician and said message me when it works. Delightful.

I haven't purchased my own computer in probably ten years. To use OS's other than the one provided desktop virtualization with virtualbox has worked very well, with the exception of my current laptop where the performance makes it unusable. It is really all about the data that actually lives in web applications and other external memory so that I can get it from my laptop, tablet, and phone.

This program started to sound more like Buy Your Own Computer. What's next, Rent Your Own Office? Bring Your Own Chair?

Still, like an incompatible but really hot girlfriend, I'm uncontrollably attracted. And after much questioning of our I.T. management I've decided to participate. There are two ideas of the program that have me hooked. Getting a lightweight ultrabook instead of a standard corporate laptop, and different OS.

This laptop is with me everywhere and those extra couple of pounds actually mean a lot.

Having always run some flavour of unix on my personal computers in the past and given the option to switch, it's finally time for Windows and I to part ways. There are many things about Windows that I have come to like. Unfortunately I feel that the amount of time that an installation lasts is not long enough. After a fresh installation things are great for a few months, then the system starts to crawl.

At this point I'm considering a MAC. I am not an Apple fanatic and feel like a vegan going our for dinner at a steak house. Not really part of the club but I gotta eat. I have been advocating them to customers for a few years now when it comes to BYOC. If something goes wrong they can walk into pretty much any mall in a big city and get support and even repairs within a week or two. Purchasing a corporate use laptop from Best Buy is a little bit scary because if the screen goes black or the hard drive fails they are going to ship it out which is typically a two month (or longer) process. It's also nice that they are unix based. I find it comforting that they only have to build their OS for a handful of pieces of hardware.

*sigh* Let's see how this goes.

Choosing a SIEM Solution

2012-08-16T08:19:00.000-07:00

So many names. It always reminds me of the line from The Devils Advocate when Al says "Oh, I have so many names". Security Information Management, Security Information and Event Management, SIM, SIEM, Log Management, Log Aggregation. If you really like to use buzz words you could call this Big Data for Security.

This technology can be great. If implemented correctly you can find security and fault management issues in your environment as they are happening rather than trying to figure out if something has happened hours or months later, which is usually what happens IF they are noticed at all. If you are not familiar with the technology the basic concept is to configure all networked elements to forward events to the SIM. This allows you to;

Centralize events - if everything is in one place it's much easier to search for something.
Normalize events - if the format of the events is the same we can actually search for things.
Search events - perhaps everything for a period of time or for an IP address or username.
Report on events - provide executive summaries on security and fault issues on a regular basis.
Correlate events - configure some logic so that if certain events happen within a specified period of time an alert of some sort can be generated.

If the system is efficient enough to be able to search for events you may as well look for the opportunity to be able to correlate events. A security example could be you have disabled the Windows account named administrator on all systems in favour of using your administrators user ID's in order to ensure accountability over administrative tasks. You may want to monitor for the use of that user account proactively so that If someone uses the account the SIM will send the relevant information to the entire team right away to take action. A fault management example could be to monitor for critical switch port interfaces or web services and if they go down immediately alert the appropriate people.

There are a few things you will want to discuss with the vendors to ensure you get the solution that's right for you.

Crucial information to figure out which one will be best for your environment are the types of event sources you want to centralize and approximately how many of each. SIM manufacturers are trying to determine the EPS ratio or Events Per Second. This is required for capacity planning. The other thing you will figure out is whether or not the solution will support all of your devices and applications.

The following factors will make sure your SIM project is a success;

Events Per Second (EPS) - This is the rate at which your networked devices will be sending events to the SIM. If this number is not calculated correctly the first thing that will happen is that the SIM will start to drop events before they are stored in the database. Think about a back catcher trying to catch 10 balls at the same time. If you are dropping events before they are able to get used by the SIM your searches, reporting, and correlation will all be incorrect and misleading. Again most SIM manufacturers will be able to help determine this number by the number of and types of networked devices you have, and the number of users.
Storage - If the SIM is not sized correctly you won't be able to keep the anticipated number of events for the desired amount of time. It's like filling a gas tank. If the tank is already full you need to burn off (or delete) the gas before you put more in. The issue is that if you want to be able to look back three months for forensic or compliance requirements you may no longer be able to. Know how long you want to be able to go back on the fly during the sizing phase. Three months is pretty standard.
Parsing - A key feature of log management is to normalize events to put all data in the right fields so that it can be queried. For example a Cisco firewall may have the time in a different format than a network intrusion prevention system. In order to search all events for that specific time they must all look the same, otherwise referred to as normalized or parsed. If the SIM doesn't support all of your critical systems and applications out of the box it's not the end of the world. What it does mean is that you are going to have to write some parsing rules. It is not extremely difficult but can be challenging and is definitely time consuming. Compare the list of device types you plan on getting events from to the list of event sources supported by the manufacturer.
Filtering - Because EPS ratios and storage are somewhat precious resources in SIMs there may be certain events from an event source that you don't want to store in the database. The issue is that some network elements can send either all events or no events to a SIM. For example your Network IPS may have an informational signature for detecting DNS traffic. The only thing you may be using it for is monitoring for volume changes in DNS so storing these billions of events in the SIM may not be desired. Ask the SIM manufacturer about the possibility of filtering events before they get into the database. In some cases the databases are so efficient that it will not matter. Keep in mind the more you send to SIM the more useful it is, and the more costly it is.
Management - SIM architecture is very similar to other servers. You have the hardware, an operating system, a database, and the application. To manage each of these components separately is very cumbersome. It sounds like a normal day at the office but when you consider that some of the best SIMs come as an appliance, why would you waste your time with having to manage each component separately? There is enough to do with a SIM that you don't want to spend months preparing for an upgrade. Look for SIMs that you can easily download and run a file to upgrade the system like you would a router or switch.
Accountability - who is responsible for managing the system to keep it alive and all the hardware and software up to date? Falling behind with security updates is more like eating stale dairy than stale bread. Making it easy to manage is key and assigning a single team to be in charge of updating the system and it's content is important. The other responsibility is managing events. I prefer open systems within the organization. The security team may oversee the system and help develop content like correlation rules and filters, but the network, Linux windows, database, and application administers should have access too. They know their systems better than anyone and if they are willing to contribute correlation rule use cases the SIM will only get better. They may even want to be the ones to monitor their custom correlation rules. This will help reduce mean time to resolution of incidents, which is the entire point of the solution.

!@#$ Your Own Device

2012-08-10T05:54:00.000-07:00

The real cost of BYOD (smartphones & tablets)

In the last year this term has rung out more than Lady Gaga (love you Gaga).

Each one of our Security Solution Architects meets with between 35 & 50 customers per month, and 90% of our meetings are on BYOD. Each of these customers are different in many ways. From size to industry the common denominator is that they are all interested in allowing their users to use new mobility platforms and use them securely.

Smaller, faster, and lighter client devices are nothing new. This is how client computing evolves so that more of our employees can do work from wherever they are. And who are we to stop users from being more productive?

Think about all the laptops you're friends and family own that are completely soaked in malware. System and network administrators go to great lengths (much of the time) to harden and secure corporate laptops from external threats and deliberate and non-deliberate threats from the user. This approach needs to be applied to our mobile fleets so these devices don’t end up like your mom’s laptop. Without turning this into an article on why to use MDM let's just highlight a few of the reasons;

Users should be able to en-roll their own devices without the assistance of I.T.
All of our personal computing devices require a password with some level of complexity.
Operating System compliance. Just like we don't want Windows XP systems connected to our networks (seriously if you still have this pull the plug) we probably don't want IOS 4.1 or Android cupcake connecting to our networks.
Strong authentication. Directory services are used to authenticate and authorize users based on their username and password. Many environments we work in today are using digital certificates to authenticate the device.
Profile management. Having a help desk administrator walk users through setting up email, calendar, contacts, wifi, VPN, etc is a total waste of time and likely a painstaking task for all involved. All of these configurations should be configured centrally and pushed to each device once the user has en-rolled (see point 1).
Application blocking. A more recent feature where administrators may prevent an app from running if they find it to cause lots of grief due to in-app purchases or perhaps an app identified as malware.
Encryption. Another new feature where perhaps you will allow the box.net app to run but you want to encrypt all of the corporate data that goes into it before allowing it to go to someone else's network (sounds a little nuts when you say it like this).
Visibility. When something is still as new as this we often don't know what other types of polices to implement before we see what is out there. Once en-rolled there is an incredible amount of information about each device sent back to the MDM server.
Remote wipe. Funny most environments don't have this capability with their laptop fleet but it is a requirement for smartphones/tablets.

There are many options and architectures out there today in order to allow users to Bring Your Own Device and Choose Your Own Device. While they may all be attractive on the surface we would like to outline what is required for each scenario to make it worth your while and to do it securely. There are lots of options and technologies, but putting all of them in the network is going to be prohibitive and even more cumbersome to manage.

In most cases of Bring and Choose Your Own Device there is a simple agreement that the user needs to sign and take accountability for before participating in the program.

Having managed and been privy to telecommunications management over the last ten years I can tell you this. Corporate users are consumers. This does not change just because a phone, tablet, or laptop is given to the user.

When a user sees that the latest and greatest is available they will do everything in their power to get it sooner than later. Incredibly every time the latest Blackberry is released < 30% of handsets are lost, stolen, or damaged. The same level of dissonance is applied to the cellular and data plans. If you provide your employees with cell phones take a look around the office and notice how many people are walking through the halls or sitting at their desks talking on their cells instead of landlines. Over the year phone usage above the subscribed plan typically amounts to 20% in overages.

Let’s take a look at a typical example. We will base this on 250 devices, which will hopefully be a nice number that can be multiplied and divided as needed. There will be a mix of Android, iPhone, and Blackberry. For the Android and Apple phones and tablets we will require Mobile Device Management at a minimum to control them. Blackberrys can be serviced with BES Express. To lessen the blow we will assume their is a hypervisor of some sort so that we can virtualize the management consoles required.

Bring Your Own Device

For BYOD we will assume that allowance will be provided to the user for the monthly plan only. Hardware will be the responsibility of the user. And a MDM solution will be required to manage and secure the devices.

Total for year 1: $48,250

Mobile Device Management solution: $45/device on average for a 3 year term is $27,000

BES Express: Free for 50
Cellular and data plans: $85/month for each device, $21,250 annually.

Total for year 2: $21,250

Plans: $85/month for each device, $21,250 annually.

Total for year 3: $21,250

Plans: $85/month for each device, $21,250 annually.

Choose Your Own Device

For CYOD we will assume that the monthly plan will be covered by the company and the user will never have to see the bill. Hardware will also be managed by the organization. And a MDM solution will be required to manage and secure the devices.

Total for year 1: $70,000

Mobile Device Management solution: $45/device on average for a 3 year term is $27,000
BES Express: Free
Handsets: $70/device on average for the first year is $17,500
Plans: $85/month for each user multiplied by an estimated overage of 20% is $102, $25,500 annually.

Total for year 2: $40,500

Handsets: New hardware comes out. 20% of users drop their phones in the toilet. The carrier discounts replacements to $300 since they’ve been on contract for 1 year. $15,000

Plans: $85/month for each user multiplied by an estimated overage of 20% is $102, $25,500 annually.

Total for year 3: $35,500

Handsets: New hardware comes out. 20% of users drop their phones in the toilet. The carrier discounts replacements to $200 since they've been on contract for 1 year. $10,000

Plans: $85/month for each user multiplied by an estimated overage of 20% is $102, $25,500 annually.

BYOD will cost a total of $90,750 after 3 years in this environment. CYOD is very similar with sticking with a corporate standard for mobile devices and will cost this organization $146,000 over 3 years.

Destroy your laptop without ramifications!

2012-05-02T10:25:00.000-07:00

Don't let the introduction scare you. This post is actually more appropriate for less technical readers who have had a computer failure and lost data.

While on a recent business trip the hard drive light on my laptop remained solid at all times. As time went on Windows slowed to a crawl and became unusable. I looked at the resource monitor to see what was causing the disk to spin so much so that I could kill it, but there weren't even any IO hits. When I reboot the computer I get a message Detection Error on HDD and Windows won't start at all any more.

It was basically over. While we were able to mount it with Ubuntu and recover some of the data left there I was very glad to have committed to synchronizing data consistently enough to not lose anything.

Everyone seems to be very well aware of all the cloud solutions available. Google Drive, Microsoft SkyDrive, EverNote, Amazon Cloud Drive, Dropbox, Box.net, the list goes on. While these services are great they may not be the most appropriate place for your work related data. Unfortunately most corporate environment do not have the solutions (DLP) to prevent us users from allowing sensitive corporate data from leaving the work network. All of your work devices like laptops, phones, and tablets should be considered an extension of the corporate network. A couple of issues with these services are; a) privacy - what happens if they get compromised. And b) availability - does anyone read the end user license agreement? Who ~owns~ the data once you put it there and what are they allowed to do with it. There are probably lots more. For non-confidential information they can definitely be great.

A potential solution to the problem could be right under your nose. Most corporate environments provide you with a file share sitting on a server in your corporate environment. If you open up My Computer in Windows it will likely show up on the left side of the window under Computer.

What you can do is make this file share folder your new home folder where you store everything. If you browse to that network share and right click on it you will have the option to make the folder available offline. That will synchronize all of the files from that network share to your PC. Say you create a new folder on the network share called Documents, you could then right click on the Documents folder on your PC as opposed to the network share, right click on it and select properties. Then you will have the option to Include a folder...

Choose the network share version of your documents folder. Now when you go to Documents on your PC and make changes those changes will be automatically synchronized to your corporate network share whenever you connect to the network. You now have instant and consistent and working backups of all your data. Everyone want to take their laptop by the monitor and swing the rest at a nice hard surface once in a while. Now you can annihilate that hardware and keep all the data! ;)

Choosing An MDM Solution

2012-04-02T15:51:00.003-07:00

Right now there are several types of Mobile Device Management solutions. They all have their place when you consider security and total cost of ownership. Some of them are going to be much more secure giving more piece of mind. Others are going to integrate into or leverage existing systems giving you piece of mind that you are not standing up an entirely new environment that also needs to be managed and secured.

We will be focused on MDM solutions that manage Android, Apple iOS, and Windows Mobile. Blackberry is very well known for having one of the most secure solutions already. Until a few years ago they were pretty much the only game in town when it came to phones carrying sensitive data so I'm sure they have been under heavy attack. Very few issues have been published about the Blackberry solution and it's not because it wasn't a target.

Generally every solution out there is going to allow you to push email, calendar, contacts. You will also be able to configure other features on the device such as wifi and VPN profiles. From a security perspective you are able to force passwords on and enforce complexity. Finally you can wipe out the work email, calendar, and contacts that you push along with any other settings like VPN and wifi. Or you could decide to simply wipe the entire device. These are the main benefits of having an MDM. Without these abilities I.T. is going to be tasked with managing and supporting all of these devices which would be extremely time consuming.

Regardless of which solution you choose there is still some inherent risk today unless you use this solution in conjunction with something else.

Containers

This is the first type of MDM solution that made it's way into corporate environments. In a container system an application typically found on either iTunes or Google Play is installed on the device by the user. When they sign into the app with their corporate email address and password the app finds the MDM server and synchronizes policies. Once synchronized email, calendar, and contacts are synchronized to the device. The stand out feature here is that these services are synchronized to the app that they downloaded.

The upside is that you can now password protect that app, you can encrypt all of the data in that app, and you can remotely wipe out that app and everything in it. Another neat feature is that within the app you may have a web browser where you can route all of the traffic for that web browser through your network. This means that the users have intranet access from the outside. If you were to wipe out that app and everything in it you would also have the benefit of leaving behind all of the users personal data. So you are (somewhat) effectively isolating their work life from their personal life.

The downside is that people don't always like the app. When they pay $700 for a device because they love the email, calendar, contacts, and web browser app it can be a tough sell to make them use something else. You may say well too bad. That's the cost of running whatever device you want on the network. In many cases we are seeing that argument does not hold. Similarly to the way the argument to not allow these devices into the network in the first place worked out. Also, similarly to the way that the Blackberry network works, many of the container systems also route all of the app traffic through the manufacturers network first then to your corporate network. So if they're down, you're down.

Proxy

This one is definitely the most popular type of solution today. Again typically an application is found on either iTunes or Google Play and is installed by the user. When they sign into the app with their corporate email address and password the app finds the MDM server and synchronizes policies. Once synchronized email, calendar and contacts are synchronized to the device. The other main difference is that the users are using native clients.

The upside is that their is a proxy server that sits in front of ActiveSync (or Lotus Traveler) which means that they only way into the network is through the MDM. With only one way in the user must use the app to onboard themselves and download their policies before they get their data pushed to them. is that the user gets to use their native email, calendar, contacts, and web browser apps. So the user gets themselves on to the network which also means I.T. doesn't have to be involved! Finally users get to use their native apps. You can still wipe out their work email, calendar, and contacts and leave everything else.

The downside is that there is a moderately higher risk in losing data. If the user can save files straight from their work email to their SD card they probably will.

Out Of Band

This type of solution is typically found when an MDM manufacturer is getting into the game. This architecture is similar to the rest in the sense that the user will probably sign in to an app and have policies pushed down to them. The difference is that there is no proxy sitting in front of the email server.

The upside is that this solution will likely be a bolt on to another solution you already have. Potentially an anti-virus console or other management console.

The downside is that without that proxy server users can easily bypass the MDM by telling their device to connect to the email server directly. The workaround is a downside too. What we have seen is that I.T. will block everyone from connecting and manually provision each device. This is very cumbersome and defeats much of the point.

Virtualization

This solution involves leveraging desktop and/or application virtualization for users to access data. Rather than managing the actual mobile device, or any device for that matter, the desktop or applications that users use to access data are published from the datacenter.

The upside is that the device and Operating System they use is irrelevant. The client device is used to display the application or Operating System in the datacenter, which is really accessing the data. This means that all of the data stays in the data center, making this the most secure.

The downside is usability. Displaying a virtualized web browser may work ok on a tablet, not likely on a phone. Displaying a desktop OS like Windows or OS X, while possible, is terrible.

The residual risk of just using one of these solutions is data loss. No matter what you do there is nothing stopping the user from emailing themselves a sensitive file. Whether they are just trying to get some work done or are being malicious, if they email themselves the file to their Hotmail account that is also being synchronized on the device there is nothing to stop the sending or receiving. Once received the data can be saved to the SD card. It can also be synchronized to iCloud. It could also get synchronized to their personal computer that is hacked every which way from Sunday. Finally if there is malware on the mobile device (or personal computer) looking for what is in that file (Social Insurance, Social Security, Credit Card, Health Card, customer lists whatever) it will easily get sifted off.