int0xicated journey

By Warwick Ashford Thursday 12 April 2012 13:58 

BlackBerry leads the pack when it comes to secure mobile platforms, according to a study by security firm Trend Micro, Bloor Research and Altimeter Group.

BlackBerry attained the highest average score, followed by Apple IOS, and Windows Phone, but Android was scored the lowest, the report said.

The platforms were compared on a combination of factors including built-in security, application security, authentication, device wipe, device firewall, and virtualisation.

The ranking was the same when the platforms were compared in terms of their overall ability to meet the demands of use in the enterprise.

“Security people I work with are scared witless by consumerisation and the rapid adoption of these devices. Aside from the technical challenges, organisations need to understand the importance of a decent mobile device security policy and supporting user education,” said Nigel Stanley, security practice leader, Bloor Research.

Raimund Genes, CTO at Trend Micro said that against the growing, unstoppable backdrop of consumerisation and BYOD, every mobile device is a risk to business.

“What is interesting in these results is that, whilst some mobile platforms have evolved very noticeably along enterprise lines, there is still a strong ‘consumer marketing’ legacy in some quarters and this is negating some of the progress made on the enterprise front. Indeed, some of the attributes we have examined in the report are still firmly ‘enterprise-unready,” he said.

BlackBerry

The researchers commented that corporate-grade security and manageability make BlackBerry the option of choice for the most stringent mobile roles.

However, many features and protections that are commonly enabled or enforceable through the BlackBerry Enterprise Server (BES) are not present on devices that are user-provisioned through BlackBerry Internet Services (BIS).

Some of the strongest features restricting high-risk activities that users may undertake, such as removal of password protection for the device, may be rendered inactive if a user’s device is not provisioned via the BES, the report said.

Apple

The iOS application architecture natively provides users much protection because all applications are “sand-boxed” in a common memory environment.  Security in iOS also extends to the physical attributes of the iPhone and iPad.

There are also no options for adding removable storage, which in effect provides another layer of protection for users.

But where the BlackBerry IT administrator has complete control over the device, in iOS, the IT department can configure items only once the user has supplied their permission, the report said.

Windows

Researchers said Microsoft has learnt the lessons of the past and created a reasonably robust and secure smartphone operating system in Windows Phone.

The OS uses privileges and isolation techniques to create sandbox processes. These “chambers” are based on a policy system that, in turn, defines which system features the processes operating in a chamber can access.

Android

Although Android is now available in more recent versions (4.x), version 2.x is still the most widely deployed on existing and new handsets. This is a security risk in itself, the report said, because there is no central means of providing Operating System updates, meaning that many users remain unprotected from critical vulnerabilities for a prolonged period.

On the positive side, Android is a privilege-separated operating system and applications cannot access the network without prior consent. Apps run in their individual sandboxed environment and permissions are granted by the user on a per app basis.

Unfortunately the end user often fails to inspect the permissions request dialogue closely in their haste to use the app, the report said. It is also often unclear, when permissions are given, what the application is actually capable of.

I saw yet another article this morning discussing claims that RIM gave up the keys to the kingdom in India. This is starting to drive me crazy!

This is a pet pieve of mine, but it’s very obvious that anybody who suggests that either RIM has a master key, or can somehow allow telco’s or governments to gain access to enterprise or government encrypted email simply does not understand how the RIM security model works. Encryption keys are generated on an individual, per device basis. Those encryption keys are stored on the device during initial provisioning, as well as securely inside the corporate firewall inside the users mailbox (or other database depending on the platform). Also, these keys automatically regenerated on each individual device by default every 30 days.

So to say again, it’s simply not possible for RIM to give up this kind of information. I’ll concede that yes, for Pin-to-Pin and BBM traffic, which is encrypted with a global key, it could be accessed by governments or telco’s which RIM has given that key to. However, and this is really important, organizations can override this RIM generated key that ships with devices and replace it with their own organization-specific key, which cannot be given away by RIM since they have no way of knowing it. So even with the concessions to these non-enterprise keys, there are still ways for enterprises to protect themselves.

I know RIM and BlackBerry’s have dropped massively in popularity, but let’s face it, they are still the most secure smartphones on the planet. If you don’t believe me, look at the known vulnerabilities which have been released for the popular platforms:

Apple - 167 known vulnerabilities

Android - 65 known vulnerabilities

BlackBerry - 53 known vulnerabilities

What’s the takeaway here? Two things. First, even after a decade of being in the open market, BlackBerry still has the least amount of vulnerabilities that have been found. Second, if you’re embracing the Apple or Android platform, especially in a BYOD setting, you really, really need to understand what your risks are and be sure that you implement appropriate Mobile Security and Risk Management solutions.