Apple's Iphone and Ipad: Secure Enough for Business?
Total Page:16
File Type:pdf, Size:1020Kb
August 2, 2010 | Updated: August 4, 2010 Apple’s iPhone And iPad: Secure Enough For Business? by Andrew Jaquith for Security & Risk Professionals Making Leaders Successful Every Day For Security & Risk Professionals August 2, 2010 | Updated: August 4, 2010 Apple’s iPhone And iPad: Secure Enough For Business? Better Security Options Allow Enterprises To Finally Say “Yes” by Andrew Jaquith with Stephanie Balaouras, Ted Schadler, Benjamin Gray, and Lindsey Coit EXECUTIVE SUMMARY Apple’s iPhone and the iPad have become increasingly popular. In 2007, IT dismissed the iPhone as insecure and unsuitable for enterprises. !ree years later, the iPhone (and iPad) gives enterprises enough security options to enable them to say “yes” instead of “no.” In this report, Forrester de"nes seven security policies every enterprise should implement to keep its email and corporate information safe on Apple mobile devices, whether or not the enterprise owns them. We also de"ne additional security “high-water marks” — policies and processes you can implement — based on your risk pro"le and regulatory exposure. Finally, we acknowledge that while most enterprises can use Apple mobile devices securely, some require higher levels of authentication assurance, resistance to attack, manageability, and logging than the iPad or iPhone can provide. For these customers, Research In Motion’s BlackBerry still rules the roost. TABLE OF CONTENTS NOTES & RESOURCES 2 iPhone And iPad: “No” Is No Longer The Forrester reviewed interactions with 20 Automatic Answer enterprise customers, including seven Forrester 2 Define Your Security High-Water Mark Leadership Board members. We also reviewed documentation and tools from Apple, IBM, Seven Security Policies For Every Enterprise Microsoft, and Research In Motion. Higher-Assurance Security Options For Highly Regulated Enterprises Related Research Documents High-Security Policies For Company-Owned “Apple’s iPad Is A New Kind Of PC” Devices May 14, 2010 Red Herrings: What Not To Worry About Yet “Understanding Information Worker Smartphone 9 Limitations Of The iPhone And iPad Usage” What About Jailbreaking And Other Exploits? November 20, 2009 WHAT IT MEANS “Making iPhone Work In The Enterprise: Early 12 The iPhone And iPad Are Here: Get Used To It Lessons Learned” April 10, 2009 “Build Your Business’s Mobile Strategy Around Device Management And Security” July 22, 2008 © 2010, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. To purchase reprints of this document, please email [email protected]. For additional information, go to www.forrester.com. 2 Apple’s iPhone And iPad: Secure Enough For Business? For Security & Risk Professionals IPHONE AND IPAD: “NO” IS NO LONGER THE AUTOMATIC ANSWER Consumer-grade portable devices such as Apple’s iPhone, the iPad, and smartphones running the Android operating system have become increasingly feature-packed, powerful, and portable. !ey have also become wildly popular, and many employees are bringing them to work. !e decision to support the iPhone and iPad in your enterprise is an easy call: Your rank-and-"le employees want it, and your executives have likely already made many “special requests” to your IT team. With the introduction of the iPad, those calls are becoming louder and more plaintive. In this past quarter alone, for example, your analyst spoke with three mutual fund and wealth management "rms wanting to issue iPads to "eld sales and marketing personnel. Apple’s mobile security posture has improved signi"cantly. IT initially dismissed the iPhone as unserious, insecure, trendy, and suitable only for consumers. !at was valid criticism in 2007 because Apple’s iPhone o#ered few enterprise email or security features. But three years later, with iPhone OS 3.1, Apple’s mobile devices provide enough security features that most enterprises can use them safely and securely. Today, 29% of North American and European enterprises support the iPhone — and by extension, the iPad.1 To be clear, the iPhone and iPad are not in the same class as Research In Motion’s BlackBerry — the gold standard for secure mobile devices. But depending on the levels of risk and regulation your enterprise faces, the level of security provided by the iPhone and iPad might well be acceptable for use as primary or secondary mobile devices. !is report recommends where to set the high-water mark — minimum levels of security that your policies should meet or exceed — based on your requirements. It also identi"es situations when these devices are not appropriate. DEFINE YOUR SECURITY HIGHWATER MARK Secure management of the iPad and iPhone begins with technical policies that are applied to the devices. Both the iPhone and iPad run substantially similar versions of the Apple iOS operating system. As a result, IT and security professionals can manage both devices identically and can impose the same policy controls on them.2 Because every enterprise sets di#erent high-water marks for the level of assurance it is willing to accept, we have divided device security policies into two sections: basic policies that every enterprise should implement and optional policies for enterprises with higher security requirements (see Figure 1). August 2, 2010 | Updated: August 4, 2010 © 2010, Forrester Research, Inc. Reproduction Prohibited Apple’s iPhone And iPad: Secure Enough For Business? 3 For Security & Risk Professionals Figure 1 Setting The Enterprise Security High-Water Mark: Where Is Yours? wned owned e-o y- † 1 2 3 4 AA vel vel vel vel AR ompan Employe C HIP State data breach disclosure laws PCI IT SEC 17a-4* Le Le Le Le Owner Mandate NIST 800-63 High security policies Prohibit Apple App Store purchases For company-owned device; if employee- Block camera owned, use sparingly: No screen capture Block YouTube or browser Hide explicit content Higher assurance Seven-character alphanumeric options device password For regulated Autolock after 5 minutes industries or risk-averse firms, Hardware encryption add any of these: (iPhone 3GS or iPhone 4, iPad) Application encryption (iOS 4 with iPhone 3GS or iPhone 4, iPad) Device certificate authentication Policy asserting right of confiscation Policy requiring address book scrubbing Basic security policies Six-digit device PIN Add all of these: Autolock after 15 or 30 minutes Autowipe after four wrong PINs Remote wipe Email session encryption Signed, password-protected configuration profile Policy refresh Amendments to security policy *Not recommended for iPhone or iPad. Required Optional †Not possible with iPhone or iPad. 57240 Source: Forrester Research, Inc. © 2010, Forrester Research, Inc. Reproduction Prohibited August 2, 2010 | Updated: August 4, 2010 4 Apple’s iPhone And iPad: Secure Enough For Business? For Security & Risk Professionals Seven Security Policies For Every Enterprise Regardless of industry, size, or regulatory climate, every enterprise thinking about supporting the iPhone or iPad needs to implement seven key security features and policies to safeguard company emails and data stored on these devices: 1. Require email session encryption. You should always encrypt email to and from iOS devices. Apple devices can enforce email session encryption via ActiveSync, an email synchronization protocol licensed from Microso$. Unmanaged devices (those that do not use ActiveSync) can also use SSL-enabled IMAP and SMTP over TLS. 2. Wipe devices if they are lost or stolen. If the device is lost or stolen, you can turn it into a brick by remotely wiping the contents. !e current models of the iPhone (3GS, 4) and iPad use a technique called “crypto-shredding” that can wipe the device in less than a second.3 3. Protect devices with a passcode lock. You should protect devices with a PIN (numbers only) or password (numbers and other characters). To be compliant with the password-strength requirements of the National Institute of Standards and Technology’s (NIST) 800-63 Level 1 authentication assurance standard, a "ve-digit PIN is the bare minimum (see Figure 2).4 You should never allow simple PINs like 1111 or 1234, and you should ensure that these PINs are not the same as your employees’ normal network passwords.5 For Level 1 assurance, we do not recommend alphanumeric passwords; they increase user interface (UI) complexity signi"cantly without adding much entropy. 4. Autolock devices a!er periods of inactivity. To protect against the possibility that an unauthorized person could obtain access to information while the device is unattended, devices should automatically lock themselves a$er a short time-out. Many enterprises require 15-minute inactivity time-outs; others feel that 30 minutes is more reasonable and hampers productivity less. 5. Autowipe devices a!er failed unlock attempts. You should con"gure Apple mobile devices to automatically erase themselves a$er several failed unlock attempts. !e number of failed attempts should be related to passcode composition and strength. Shorter or simpler passcodes need lower autowipe thresholds. For example, to achieve NIST Level 1 authentication assurance, you can use a six-digit passcode that isn’t a simple PIN, combined with a policy that autowipes the phone a$er four wrong guesses.6 6. Protect the con"guration pro"le. IT managers de"ne the enterprise’s email, encryption, PINs, autolocking, and other security controls by creating a mobile con"guration pro"le. You can sign the con"guration pro"les to ensure that no one has tampered with them, a precaution Forrester recommends.7 You can also protect pro"les with a password. !is ensures that an employee cannot remove the con"guration pro"le unless he or she wipes the device clean to factory defaults. August 2, 2010 | Updated: August 4, 2010 © 2010, Forrester Research, Inc.