Slashdot Mirror
Ask Slashdot: Managing Encrypted Android Devices In State and Local Gov't?
An anonymous reader writes "I am a systems administrator for a mid size state agency. We currently offer Blackberries to our staff, but we are migrating to Android devices in the near future. Since phones have sensative data (email, documents, etc.), what is a good choice for encrypting that data? Options abound, like OS-level encryption from Motorola and Samsung, 3rd party apps from GoTrusted and even a LUKS port for Android. Does anyone have experience managing encrypted Android devices? What are the important features I should be looking at? Many thanks in advance." (And, for that matter, are there good options for doing the same with iPhones? Other options to consider?)
state agency will take the best deal not the best for IT.
If the state isn't doing anything wrong, it doesn't have anything to hide.
Considering that any meaningful encryption (I will assume you want some sort of volume group/full disk encryption) will require root access and probably a custom kernel module, you will need android. Personally I would download the source code and hack it myself, add in the encryption and other features I want, and then flash the modified ROM onto a device of choice. You can't do that on an iPhone. It worked for SELinux.
To offset political mods, replace Flamebait with Insightful.
I'd stick with BlackBerry if you want security...
No, the US government actually takes computer security pretty damn seriously.
To offset political mods, replace Flamebait with Insightful.
http://support.google.com/ics/nexus/bin/answer.py?hl=en&answer=2381815
Their phones don't offer any enterprise-level collaboration features whatsoever. No features, no security risk!
pagers and pay phones are the way to go for state communications.
Android 4.0 and later devices all have options for full-disk 128-bit AES encryption built into the OS.
I can't speak to android, but iPhones have whole device encryption enabled as standard. For security you would just need to enforce use of passcodes.
Apple has a pretty great resource on ios security at: http://www.apple.com/iphone/business/integration/ Specifically the PDF under the heading "works with your work".
If you're using active sync, you can make it part of the sync policy to wipe the phone when it is marked lost. We do that quite a bit.
Try something like Good for Enterprise - allow your employees to bring their own devices (this is the trend, don't try to dodge it) if they wish, and just provide them with an activation key for the application. The days of "work device" and "personal device" are over - users will use one device for both, and issuing a crippled device which only performs one of these tasks is quite draconian. The sandboxed application ensures all critical information is secure, while giving your employees the segregation between life and work they desire.
Use Good from Good Technology (www.good.com). If you are familiar with Blackberry Enterprise Server, its a very similar system but works for Android, iPhone and Windows mobile devices. Once you set up the server infrastructure and licenses (its a pay product like BES) you or your end users just install the free app from the Play Store/App Store/etc and then provide their email address and the activation code (very similar to BES) and boom. It creates an encrypted partition where all the contacts, and company email are stored. User must input password to access the app. It keeps their personal and company data separate. The phone can get stolen and they will only lose their personal data not company/government, unless of course they use a password like 1234.
It's not a federal agency. OP said it was a "mid-sized state agency".
anyone doing an android phone with this on board that can be used to reduce overhead with things like file / volume encryption and network / vpn
And in fact its non-disableable. The remote wipe is, in fact, "kill key store".
Apple's propaganda, err, whitepaper on the subject
Test your net with Netalyzr
well take the security software that locks stuff down to much and is a pain to work with.
Not always. Some states do worry about technical merit.
---- Booth was a patriot ----
Meraki provides a nice mobile device management system, has recently added android support, is cloud based, and best of all is free (a loss leader). Remote wipe and other features are there too.
Id prefer to have 2 devices over the 'boss' having access to mine, in ANY manner. ( even active sync which gives them far too much control over MY device )
---- Booth was a patriot ----
Proper propaganda link, silly me, forgot the http
Test your net with Netalyzr
We use Google Apps builtin in encryption and mobile device management. http://support.google.com/a/bin/answer.py?hl=en&answer=1734200 Works great. Free too.
Those are the best options--you have to pay for them, but provide the best Exchange compatible option.
Blackberry was your best bet for security. All the others are spyable from the US government by their own admission. Blackberry was the one carried by all those in the know, outside of the us. They had stopped the production of the old style berries at the request of some-one not listed. But the house of saud wass involved about 5 years ago.
All of the current units, the programing can be hacked, reported by the security magazines, for the last three years. Dont trust a one of them. If your company-state-government has to have mobile e-mail make them carry a portable stick,a card that is encrypted with/for them. that card when added to their unit, will now display the encrypted communications they have recieved. Do their e-mail as a crypted illustration as a captia, you know looking like garbage, but readable by the stick. But a nice simple way is to get pgp. Set up a key on the stick for the person, and a reader for translation.
If you are looking for secure wireless communication and storage that can be used on off the shelf mobile devices, I would suggest looking into Apriva. They have a communication suite that was designed for that purpose. This might be a reasonable option for a agency to utilize (not really for an individual consumer though). Hope this helps.
Assume that your carrier, cloud provider, and handset manufacturer all have access to everything on the phone.
With Blackberry, you could run your own server, and nothing in the public infrastructure had access to unencrypted data. With Android, Google has a direct tap into your data. Encryption won't help when the layer that reads the keys is under the control of the provider.
There is Open PGP for Android phones. http://www.thialfihar.org/projects/apg/
We use Maas360 at DOI ans so far, so good.. http://www.maas360.com/
You may give TrustChip a shot (www.koolspan.com).
https://aerstone.com/government-mobile-device-integration/ Basically has every suggestion that may help you
NYC startup enterproid has a product call Divide that you should check out: http://www.divide.com/
No iphone solution, but I'm sure it is next on your list.
This requires certain models of phone with the hypervisor loaded by the manufacturer, but creates two partitions on your phone, one like the blackberry (encrypted, remote wipeable, secure, app streaming, no access to add user apps but system can administer global apps in the work partition), and the other a personal android phone. Even has separate work and personal phone number identities. Just swipe the screen back and forth, and you switch between personal and work spaces. http://www.vmware.com/products/mobile/overview.html
I would think that the fact the OP is taking to the time to ask the question and even went so far as to ask for help with things he realizes he might not even know enough to ask is pretty good evidence that they are taking security seriously. Granted, he probably has to get it approved if it a pad app, but the cost of that should be pretty small compared to the cost of the phones themselves.
It really seems like your choices are Activesync, Blackberry server, or Good Mobile for Enterprise. We recently migrated from BB, and needed to setup a different secure mobile management solution that could handle Iphone and Android devices. Good was pretty much the only logical alternative. Works well for Exchange integration, syncing, app management, and security. Lost devices can be wiped, updates can be approved, and setup of new devices is painless. All major carriers support the system, and users are provided with a whatever choice in OS.
Server sits inside the network, communicates with only the Good NOC, and doesn't require any additional firewall rules. Similar to BB servers.
Good luck!
There are plenty MDM solutions out there. I am quite happy with AirWatch (Gartner Magic Quadrant 2012), though I was impressed with Good Technologies. AirWatch was cheaper, but was not sandboxed. Most Android devices will also require the Touchdown client ($15-20 per license) for the deployment of email profiles unless you're only supporting devices with OEM MDM extensions. You'll find a lot of MDM solutions require Touchdown, which definitely has quirks end-users will notice. Biggest things: Make sure you find the product that fits your budget (naturally) Take your corporate culture into mind when looking at a solution. Are they going to be totally baffled when their email disappears because their PIN doesn't meet requirements? Do plenty of testing with actual devices. If you need device-level encryption, target 3.0 devices. Be wary of products that feel kludgy. Some vendors have tacked 3LM pieces onto their existing iOS management.
We use a combination of BoxTone and BES to manage our Android, Blackberry and IOS devices. I would recommend it as a solution.
Here's the NSAs recommendations for securing iOS devices: http://www.nsa.gov/ia/_files/os/applemac/Apple_iOS_5_Guide.pdf
EOF
I'm a former Apple engineer, current independent consultant, so I'm not going to address the Android side. That's a lot more complicated -- I'll stick with talking about the iOS info that I know about.
That said, wow, there's a lot of snarky comments but not a lot of information posted.
iOS has full-device hardware encryption built-in on the iPhone 3GS and later, activated as soon as you set up a passcode. This top-level encryption layer is for quick device wipes, not for data protection. Each user data file is then encrypted on top of that using its own unique key, then set into a protection class by the app developer:
- Complete Protection - decrypted only when the device is unlocked; file key is removed from memory when the device is locked.
- Protected Unless Open - decrypted when the device is unlocked; if file is open when the device locks, the file stays open/decrypted.
- Protected Until First User Authentication - decrypted on first unlock, stays decrypted until reboot
- No Protection - file system encryption only; no per-file encryption key
Apple has really been on developers cases to tighten down the data protection classes for their apps on iOS.
In addition, iOS has a huge number of remote management options. Apple provides a basic management tool called Profile Manager in Lion Server, and there are third-party Mobile Device Managers (MDMs) that take the basics and go even further. You can force complex passcodes, pre-configure e-mail accounts, restrict usage of features, and so on. The enterpriseios.com site has a pretty complete listing.
One of the cool things about using iOS MDM is that all of the configuration profiles are tied to the management profile that gets installed when the device is first enrolled with the MDM. If you're in a BYOD situation and a user leaves on bad terms, the IT department can retract the management profile, which automatically retracts all of the other configuration profiles. This will delete corporate e-mail accounts, remove in-house apps (and their data!), take away VPN and 802.1X access, and so on, without erasing the person's device entirely. All of the pictures the person took are still there, not blown away as they would be after a complete device wipe.
Anyway, a few links that may help you out:
http://www.apple.com/iphone/business/integration/
http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf
http://www.enterpriseios.com/
http://consultants.apple.com/index.php - look for consultants with the Mobility specialization
https://help.apple.com/advancedserveradmin/mac/10.7/ - go into "Manage Users" --> "Profile Manager" on the right
Hope this helps.
--Paul
You can use TEOPAD
Simple efficient but not free
http://www.thalesgroup.com/Teopad/
Oh wait, was this the article about spammers hiring better copyeditors so they could steal your data more better, or was it the other one?
coding is life
MAS-360 for both iPhones and Android Devices. Primarily for Email and contact management. Android Devices end up using Touchdown for Exchange with a policy that encrypts the data and forces secure use (passcodes etc). iOS devices use stock mail client with the service.
Remote wipe doesn't wipe the whole phone just the data involved. Location services etc...
Works pretty good.
The much maligned BlackBerry is the only game in town.
No, the US government actually takes computer security pretty damn seriously.
Well, they'd better hope the bad guys don't buy the same hardware that the MET police in Europe, and in the US, the Michigan State Police, are using to "slurp" all the data from smartphones, even when protected/encrypted.
http://grownupgeek.com/police-now-slurp-cell-phone-data-minutes
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
You can automatically remove all corporate data when the device is jailbroken. I prefer android devices, but the security on the IOS devices is still better than android.
Why not just Settings > Security > Encrypt Phone?
Read the Government/Secure deployment guide, which Apple wrote for this exact purpose.
iPhones do hardware encrypted disk, passcoding, ActiveSync, and support MDM (mobile device management) servers to enforce policy.
Android's support for these things is much more... fragmented. I think iPhones would be the better option here.
Don't know what exactly your requirements are, but you can look into McAfee EMM, supports iOS, Android, Windows Phones and Blackberry
http://www.mcafee.com/us/products/enterprise-mobility-management.aspx
Disclaimer: I work for McAfee but a different division
http://us.blackberry.com/business/software/blackberry-mobile-fusion.html
VMKnoppix is a good example of excellent encryption setup with the exception that the virtual TMP is not trusted to the hardware because TPM does not support doing this. I would recommend that HP (I think there the ones who bought and probably will squash VMKnoppix) implement vTPM extensions on their hardware. Virtualization with TPM/vTPM in my honest opinion is an effective combination and could be extended to be trusted to a central site on a central server. This type of sandboxing could be the ultimate sandbox.
If only there was enough processing power to keep it encrypted in memory(Google mathematicians determined this was possible but not on existing computers at their relatively small processing power).
Keeping it encrypted over links and on the hard drive and right up to the point its been PROCESSED and set as output to the screen (or hmm or even better right into the trusted party brain) would give us an uncompromisable solution (with the exception of brute force.)
Here's the NSAs recommendations for securing Android devices.
FTFY. The NSA has a full blueprint for a government trusted secure android device. Given that the US also built a secure linux distro, I'm thinking that this is the product you want.
- You propose a bunch of obtuse and/or manufacturer specific options, when Android has had full disk encryption available out of the box since 4.0
- Encryption is not your primary problem. Endpoint Management is. It doesn't matter a lick if your device is encrypted if it is swiped while it is unlocked, or if it gets malware inserted into it via an SD card or browser exploit. You need to be able to enforce what is installed on the phone so that you can force malware detection software. You also need to be able to remotely wipe and de-provision the phone on demand, including wiping the SD cards. There are solutions for this, like Tivoli Endpoint Manager.
While not on the exact topic of encrypting devices, you may want to look into remote management of the device. My company asked me to put a program called Afaria by Sybase on my personal device (I don't have a business one). I decided not to because of the insane control it gives my company over my personal device. But looking at it, it would be great to have for people with company/government devices.
http://www.sybase.com/products/mobileenterprise/afaria
Use the Android Device Policy app to enforce encryption
http://support.google.com/a/bin/answer.py?hl=en&answer=1408902
(see "device settings" section)
Available since Honeycomb:
http://source.android.com/tech/encryption/android_crypto_implementation.html