Mobile OS - Features, Concepts and Challenges for Enterprise Environments
Total Page:16
File Type:pdf, Size:1020Kb
Mobile OS - Features, Concepts and Challenges for Enterprise Environments Thomas Renner SNET Project Technische Universitat¨ Berlin [email protected] Abstract—The impact of mobile devices in our life is increasing continuously. Especially the integration of mobile devices into an Challenges Policies enterprise environment is a hot topic these days. The following paper should give an overview about the state of the art of A lost or stolen mobile Implement a central management console features, concepts and challenges of mobile operating systems device for device remote control - i.e., loca- tion tracking, data wipe-out, password/PIN to integrate them into an enterprise environment. Therefore it is change or user strong authentication necessary to show what kind of policies are needed for using a Enforcing the enterprise Gain visibility of all devices connected to mobile device in an enterprise environment and to analyse how policy for standard de- the infrastructure currently available mobile operating systems and their specific vices policies and security mechanisms can fulfill these requirements. Providing support for var- Turn to cross-platform centrally managed ious devices mobile device managers I. INTRODUCTION Controlling data flow on Secure the systems that are accessed with multiple devices authorization, encryption and privileges The worldwide sales of mobile devices, especially for control smartphones, grew by an increasing rate over the last years. Preventing data from Monitor and restrict data transfers to hand Gartner says that 304 millions of mobile device units where being synchronized onto held or removable storage devices and me- sold in the year 2010, which is an increase of 72,1 percent in mobile devices in an dia from a single, centralized console unauthorized way comparison to the year 2009 [1]. The increasing popularity and capability of mobile devices and the confides of organisation TABLE I EXAMPLES OF POLICIES AND CHALLENGES to integrate them into their business processes represents an attractive target for criminals to attack [2]. As a consequence, organisations need to implement policies to manage the risk of using mobile devices in an enterprise environment, especially when the data that the mobile devices are handing is sensitive for example stores sensitive corporate data locally [5]. But the and confidential. The following paper should give an overview threat of losing a device is not the only risk of using a mobile about features, concepts and challenges to ensure specific device in an enterprise environment. Due to the fact that it is policies for a safe integration of mobile devices into an very portable and is used as a mobile interface to enterprise enterprise environment. communication backends, mobile devices communicate via wireless networks, which are less secure than wired networks II. ENTERPRISE POLICIES [6]. Because of that, it is necessary to develop convenient Campbell defines Policies as ”guidelines that regulate organ- policies to realize such a secure data exchange, which is not an isational action. They control the conduct of people and the ac- easy task, because many vendors develop products primarily tivities of systems” [3]. This regulation is necessary to specific for the consumer market [5]. how employees or applications have to operate in situations to An additional challenge is, to develop a way to enforce avoid the exposure of private or confidential information due convenient policies, so that owners of mobile devices can use to unintended handling of a device or software. them in both private and business environments. This means An overview about typical policies and challenges for manag- for organisations, that there is a mixed enterprise and private ing mobile devices in an enterprise environment is illustrated environment and no explicit enterprise environment [2]. The in table I, which is derived from the IT-Governances frame- problem of these mixed environment is, that an enterprise work COBIT [4]. environment needs very strict polices to ensure a high security To enforce policies for mobile devices in an enterprise standard for using a mobile device for business purposes. On environment, is a complex, but also a required task for the other hand, in a private environment the user does not want organisations. It can not be compared with the enforcement of to be restricted by using the device. For Example, he wants other usual items in the IT world, because of the property of to install 3rd party applications, which could be forbidden high portability of the mobile devices. The property portability because of the enterprise policies. To forbid the private use signifies, that the device is used anytime and -place and can of a mobile device completely is no good solution, because easily get lost or stolen, which describes a bad scenario, if it this could lead to the situation that the employee does not use the device and leaves it at home. The Advantages of using a operating systems, which also shows a challenge of developing mobile device in an enterprise would be unused, because of standard policies for organisations, because employees are able no acceptance of the employee. to choose their own mobile devices, so that the management General threats and risks of using a mobile device in an has to know the specific properties of each operating system. enterprise environment can be summarized as following: An approach to solve these problem could be a limitation of Mixed private and sensitive corporate data stored on the the number of allowed mobile devices or operating systems • device in an organisation, what on the other side means a lose of Sensitive data stored locally on the device can be stolen, freedom for the employee and can lead to a lower acceptance • i. e. though stealing the device for using a mobile device in an enterprise environment. Sensitive data exchange, i. e. e-mail, contacts and calen- Because of the high number and distribution of varying mobile • dar synchronization, can be read by 3rd persons through operating systems, it is not possible to analyse each system using insecure technology within this paper. In reason to that, it is necessary to limit their Installing 3rd party code for private usage by the em- number and analyse only the most important once, which are • ployee, i. e. due using no or insufficient policy settings. derived from the mobile operating market distribution of the To control the shown challenges and develop suitable policies, last four years shown in Fig. II. it is necessary to manage the mobile operating system, which provides security mechanism and the ability to set security BlackBerry other Year Symbian Android iOS Microsoft settings on the mobile device via policies [5]. Therefore the OS OS 2010 next chapters will give an overview of the different available 37.6% 22.7% 16.0% 15.7% 4.2% 3.8% mobile operating systems and their specific security policies. [1] 2009 46.9% 3.9% 19.9% 14.4% 8.7% 6.1% [10] OBILE PERATING YSTEMS III. M O S 2008 52.4% 0.5% 16.6% 8.2% 11.8% 10.5% An operating system is a system software, that is designed to [11] 2007 63.5% N/A 9.6% 2.7% 12.0% 12.1% operate and control the computer hardware [7]. The operating [11] system operates on a mobile device and is called mobile op- TABLE II erating system. An overview about different mobile operating MARKET SHARE OF MOBILE OPERATING SYSTEMS systems, that are currently available on the market is shown in Fig. 1 [8]. The collective notion Microsoft includes the mobile operating systems of the same-named company and is found in the fact, that the operating system Windows Mobile was replaced by Windows Phone in the year 2010. Furthermore Nokia announced, that they will use Windows Phone in the future for their new devices [9]. This announcement of Nokia, the developer of Symbian, can be interpreted as a stop for a further development of the mobile operating system and a lose of relevance for Symbian in the future, wherefore Symbian will not take into consideration in the paper. Despite the fact that the operating systems of Microsoft lost market share in the last years, it will be part of the analyse in this paper. The reason for that is the cooperation between Microsoft and Nokia [9], the largest manufacturer for mobile devices [1], which can be rated as a high potential for a market share growth in the future. Furthermore Gartner predicts that Windows Phone will be the mobile operating system with the second most market-share behind Android in the year 2015 Fig. 1. Mobile Operating Systems Overview [12]. A. Mobile OS: Android In total it shows up 16 different mobile operation systems, whereof twelve are actual on the market or will be released Android is an open source operating system for mobile in an expected time. An exception is the operation system devices developed by Google and the Open Handset Alliance MeeGoo of the companies Nokia and IBM, which future [13]. With 22,7% it is the second most used operating system is unknown after Nokia announced that they will use the for mobile devices worldwide behind Symbian [1]. The system operating system Windows Phone for their new devices [9]. architecture consists of [14]: The graphic also illustrates a high fragmentation of the mobile a modified • Linux Kernel open source coded in C and C++ system prompts the user for consent at this time, a mechanism • Libraries the , which considers core libraries for granting permission dynamically at runtime is not possible • Android Runtime that disposals the most core functions of Java. As virtual and would lead to an increase of security transparency [18]. machine it uses Dalvin, which enables to execute Java Currently there is a high fragmentation of the different avail- applications.