Slashdot Mirror
Ask Slashdot: Managing Encrypted Android Devices In State and Local Gov't?
An anonymous reader writes "I am a systems administrator for a mid size state agency. We currently offer Blackberries to our staff, but we are migrating to Android devices in the near future. Since phones have sensative data (email, documents, etc.), what is a good choice for encrypting that data? Options abound, like OS-level encryption from Motorola and Samsung, 3rd party apps from GoTrusted and even a LUKS port for Android. Does anyone have experience managing encrypted Android devices? What are the important features I should be looking at? Many thanks in advance." (And, for that matter, are there good options for doing the same with iPhones? Other options to consider?)
state agency will take the best deal not the best for IT.
If the state isn't doing anything wrong, it doesn't have anything to hide.
Considering that any meaningful encryption (I will assume you want some sort of volume group/full disk encryption) will require root access and probably a custom kernel module, you will need android. Personally I would download the source code and hack it myself, add in the encryption and other features I want, and then flash the modified ROM onto a device of choice. You can't do that on an iPhone. It worked for SELinux.
To offset political mods, replace Flamebait with Insightful.
No, the US government actually takes computer security pretty damn seriously.
To offset political mods, replace Flamebait with Insightful.
http://support.google.com/ics/nexus/bin/answer.py?hl=en&answer=2381815
Has anyone here tried blackberry mobile fusion? Is it good?
Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
Their phones don't offer any enterprise-level collaboration features whatsoever. No features, no security risk!
If you're using active sync, you can make it part of the sync policy to wipe the phone when it is marked lost. We do that quite a bit.
Try something like Good for Enterprise - allow your employees to bring their own devices (this is the trend, don't try to dodge it) if they wish, and just provide them with an activation key for the application. The days of "work device" and "personal device" are over - users will use one device for both, and issuing a crippled device which only performs one of these tasks is quite draconian. The sandboxed application ensures all critical information is secure, while giving your employees the segregation between life and work they desire.
It's not a federal agency. OP said it was a "mid-sized state agency".
And in fact its non-disableable. The remote wipe is, in fact, "kill key store".
Apple's propaganda, err, whitepaper on the subject
Test your net with Netalyzr
well take the security software that locks stuff down to much and is a pain to work with.
Not always. Some states do worry about technical merit.
---- Booth was a patriot ----
Id prefer to have 2 devices over the 'boss' having access to mine, in ANY manner. ( even active sync which gives them far too much control over MY device )
---- Booth was a patriot ----
Proper propaganda link, silly me, forgot the http
Test your net with Netalyzr
We use Google Apps builtin in encryption and mobile device management. http://support.google.com/a/bin/answer.py?hl=en&answer=1734200 Works great. Free too.
Blackberry was your best bet for security. All the others are spyable from the US government by their own admission. Blackberry was the one carried by all those in the know, outside of the us. They had stopped the production of the old style berries at the request of some-one not listed. But the house of saud wass involved about 5 years ago.
All of the current units, the programing can be hacked, reported by the security magazines, for the last three years. Dont trust a one of them. If your company-state-government has to have mobile e-mail make them carry a portable stick,a card that is encrypted with/for them. that card when added to their unit, will now display the encrypted communications they have recieved. Do their e-mail as a crypted illustration as a captia, you know looking like garbage, but readable by the stick. But a nice simple way is to get pgp. Set up a key on the stick for the person, and a reader for translation.
Assume that your carrier, cloud provider, and handset manufacturer all have access to everything on the phone.
With Blackberry, you could run your own server, and nothing in the public infrastructure had access to unencrypted data. With Android, Google has a direct tap into your data. Encryption won't help when the layer that reads the keys is under the control of the provider.
There is Open PGP for Android phones. http://www.thialfihar.org/projects/apg/
I had it the other day mixed with bananas, Strawberries, Herbal Nutrient Blend, Soy Protein, Turbinado and Honey. Best Smoothie ever!
"A 'person' is smart. 'People' are dumb, panicky animals and you know that."
NYC startup enterproid has a product call Divide that you should check out: http://www.divide.com/
No iphone solution, but I'm sure it is next on your list.
This requires certain models of phone with the hypervisor loaded by the manufacturer, but creates two partitions on your phone, one like the blackberry (encrypted, remote wipeable, secure, app streaming, no access to add user apps but system can administer global apps in the work partition), and the other a personal android phone. Even has separate work and personal phone number identities. Just swipe the screen back and forth, and you switch between personal and work spaces. http://www.vmware.com/products/mobile/overview.html
I would think that the fact the OP is taking to the time to ask the question and even went so far as to ask for help with things he realizes he might not even know enough to ask is pretty good evidence that they are taking security seriously. Granted, he probably has to get it approved if it a pad app, but the cost of that should be pretty small compared to the cost of the phones themselves.
That is exactly my suggestion, although I'd not bother with Good and just use Nitrodesk's Touchdown.
This allows IT to keep all their Exchange data separated from the data of the phone. This also benefits the user because a remote wipe only will destroy that app's data, and not erase the phone.
Touchdown is not perfect -- it has some user interface quirks, and only works with one Exchange account, but it does a decent job.
Another good Exchange program is RoadSync. I use this so I can get functionality that I don't get with the Android OS, such as flagging messages, setting tasks, etc.
There are plenty MDM solutions out there. I am quite happy with AirWatch (Gartner Magic Quadrant 2012), though I was impressed with Good Technologies. AirWatch was cheaper, but was not sandboxed. Most Android devices will also require the Touchdown client ($15-20 per license) for the deployment of email profiles unless you're only supporting devices with OEM MDM extensions. You'll find a lot of MDM solutions require Touchdown, which definitely has quirks end-users will notice. Biggest things: Make sure you find the product that fits your budget (naturally) Take your corporate culture into mind when looking at a solution. Are they going to be totally baffled when their email disappears because their PIN doesn't meet requirements? Do plenty of testing with actual devices. If you need device-level encryption, target 3.0 devices. Be wary of products that feel kludgy. Some vendors have tacked 3LM pieces onto their existing iOS management.
Here's the NSAs recommendations for securing iOS devices: http://www.nsa.gov/ia/_files/os/applemac/Apple_iOS_5_Guide.pdf
EOF
I'm a former Apple engineer, current independent consultant, so I'm not going to address the Android side. That's a lot more complicated -- I'll stick with talking about the iOS info that I know about.
That said, wow, there's a lot of snarky comments but not a lot of information posted.
iOS has full-device hardware encryption built-in on the iPhone 3GS and later, activated as soon as you set up a passcode. This top-level encryption layer is for quick device wipes, not for data protection. Each user data file is then encrypted on top of that using its own unique key, then set into a protection class by the app developer:
- Complete Protection - decrypted only when the device is unlocked; file key is removed from memory when the device is locked.
- Protected Unless Open - decrypted when the device is unlocked; if file is open when the device locks, the file stays open/decrypted.
- Protected Until First User Authentication - decrypted on first unlock, stays decrypted until reboot
- No Protection - file system encryption only; no per-file encryption key
Apple has really been on developers cases to tighten down the data protection classes for their apps on iOS.
In addition, iOS has a huge number of remote management options. Apple provides a basic management tool called Profile Manager in Lion Server, and there are third-party Mobile Device Managers (MDMs) that take the basics and go even further. You can force complex passcodes, pre-configure e-mail accounts, restrict usage of features, and so on. The enterpriseios.com site has a pretty complete listing.
One of the cool things about using iOS MDM is that all of the configuration profiles are tied to the management profile that gets installed when the device is first enrolled with the MDM. If you're in a BYOD situation and a user leaves on bad terms, the IT department can retract the management profile, which automatically retracts all of the other configuration profiles. This will delete corporate e-mail accounts, remove in-house apps (and their data!), take away VPN and 802.1X access, and so on, without erasing the person's device entirely. All of the pictures the person took are still there, not blown away as they would be after a complete device wipe.
Anyway, a few links that may help you out:
http://www.apple.com/iphone/business/integration/
http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf
http://www.enterpriseios.com/
http://consultants.apple.com/index.php - look for consultants with the Mobility specialization
https://help.apple.com/advancedserveradmin/mac/10.7/ - go into "Manage Users" --> "Profile Manager" on the right
Hope this helps.
--Paul
Oh wait, was this the article about spammers hiring better copyeditors so they could steal your data more better, or was it the other one?
coding is life
Settings -> Security:
- Encrypt device
- Encrypt SD Card
No, the US government actually takes computer security pretty damn seriously.
Well, they'd better hope the bad guys don't buy the same hardware that the MET police in Europe, and in the US, the Michigan State Police, are using to "slurp" all the data from smartphones, even when protected/encrypted.
http://grownupgeek.com/police-now-slurp-cell-phone-data-minutes
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
You can automatically remove all corporate data when the device is jailbroken. I prefer android devices, but the security on the IOS devices is still better than android.
Read the Government/Secure deployment guide, which Apple wrote for this exact purpose.
iPhones do hardware encrypted disk, passcoding, ActiveSync, and support MDM (mobile device management) servers to enforce policy.
Android's support for these things is much more... fragmented. I think iPhones would be the better option here.
Don't know what exactly your requirements are, but you can look into McAfee EMM, supports iOS, Android, Windows Phones and Blackberry
http://www.mcafee.com/us/products/enterprise-mobility-management.aspx
Disclaimer: I work for McAfee but a different division
http://us.blackberry.com/business/software/blackberry-mobile-fusion.html
- You propose a bunch of obtuse and/or manufacturer specific options, when Android has had full disk encryption available out of the box since 4.0
- Encryption is not your primary problem. Endpoint Management is. It doesn't matter a lick if your device is encrypted if it is swiped while it is unlocked, or if it gets malware inserted into it via an SD card or browser exploit. You need to be able to enforce what is installed on the phone so that you can force malware detection software. You also need to be able to remotely wipe and de-provision the phone on demand, including wiping the SD cards. There are solutions for this, like Tivoli Endpoint Manager.
Looks like Touchdown is Android only, while Good supports ios, android, and windows.
Cheap storage VM.