in case it gets lost or stolen, enterprises also Push-Email And Mobile require easy administration, patching, enforcement of company policies, secure access Devices In The Enterprise to corporate resources etc. These requirements Siemens AG, Corporate Technology become more pressing the more capable mobile devices become with respect to storage space, CT IC CERT processing power and connectivity. Dr. Heiko Patzlaff [email protected] A vital feature for the use of smartphones in the enterprise is push-email. The required Sophos PLC infrastructure will be part of the considerations in Vanja Svajcer the following chapters that compare the security [email protected] of Symbian, WindowsMobile and BlackBerry devices. 1. Introduction 2. History of Symbian, Over the last couple of years smartphones have become an indispensible part of the IT BlackBerry and Windows infrastructure of enterprises worldwide. They are Mobile not only used for voice communications but Symbian is a multi-tasking capable microkernel people also use them to check their emails, operating system mainly used on ARM CPUs. It schedule appointments, have access to the has its root in the EPOC operating system of the corporate directory, to store data and even to edit Psion PDA and is maintained and developed presentations and office documents. since 1998 by a consortium of vendors including Nokia, Motorola and Sony/Ericsson. There is no universal agreement on what Symbian is the basis for several competing user constitutes a true smartphone but usually having interfaces, the two most significant being S60 a full feature set according to the above and UIQ. By far the most widespread UI is the description is seen as an indication that separates S60 interface used in Nokia phones. The UIQ a smartphone from the more common feature interface is used by Sony/Ericsson and Motorola. phones and basic phones. The current incarnation of the Symbian OS is The smartphone market, albeit still small version 9.5, released in 2007. Up to version 9.1 compared to the overall phone market, has released in early 2005 the operating system displayed strong growth over the last few years provided only limited security features. and is expected to continue to grow more With version 9.1 a radical break was made which dynamically then the rest of the industry. In 2007 abandoned backward binary compatibility and about 120 million smartphones were sold introduced a new platform security model. worldwide, representing a 10% share of the Although most new phones running on Symbian overall phone market. use the S60 R3 interface which is based on Symbian 9.x, many older models in use are still The security of smartphones is largely running the S60 R2 software. determined by the underlying operating system. The main contenders in this area are Symbian Research in Motion (RIM) introduced the first with a 65% market share, Windows Mobile BlackBerry (BB) device in 1998. BlackBerries based devices with 12%, Research in Motions support PDA and mobile phone features but are BlackBerry with 11% and Apples iPhone with most notable for their push-email functionality. 7% worldwide market share. The market share in The Push-Email feature of BlackBerry utilizes a individual countries such as the United States proprietary protocol and requires a separate differs substantially from these overall numbers. infrastructure component, the BlackBerry Enterprise Server (BES). Whereas BlackBerry The use of smartphones in enterprises puts some traditionally appealed to business users, the extra requirements on the security of these current 8xxx model lineup include the devices. While individuals demand a phone that BlackBerry Curve and the consumer oriented is resistant to hacking attacks, worms and misuse model BlackBerry Pearl that feature digital concern. Lastly, while an individual user might cameras and music players. rightfully demand full control over the device - how he is allowed to use it, what applications he RIM licenses its email client to 3rd parties can install, which configuration and setup he is including Nokia which gives users the option to to choose - this freedom no longer is seen as a use a range of non-BlackBerry devices in a positive feature if the device is to be operated in BlackBerry infrastructure. a corporate environment. Since the user no longer is the data owner he needs to be restricted Windows Mobile (WM) was originally in the actions he can perform. introduced as the Pocket PC 2000 operating system in 2000. It is based on the Windows CE Various risks impact all three components of a kernel and supports the Win32 API on mobile push-email architecture - the mobile device, the devices. The current version is Windows Mobile transit network and the corporate network. 6.1 based on Windows CE 5.0 but many smartphones in use still run on Windows Mobile The main risks affecting the device are 5.0. Microsoft introduced the DirectPush - loss or theft technology with its Messaging and Security - loss of sensitive data Feature Pack (MSFT) in 2005. DirectPush can be - malware deployed on an existing Exchange 2003 SP2 - unauthorized access (hacking) infrastructure and is supported by all new - unauthorized modifications of security Windows Mobile based devices. Microsoft settings by the user licenses DirectPush to 3rd parties and Nokia as - loss of availability (spam) well as Apple provide or will provide push-email - toll fraud (dialers) support based on DirectPush on their devices. While data is in transit it might potentially be Whereas Symbian and BlackBerry are tied to intercepted, read, blocked or altered. Even if the particular mobile device manufacturers actual content of the exchanged data is protected Microsoft chooses to be device agnostic and a third party might still be able to perform an license its operating system to a range of analysis of the communication patterns that manufacturers. In the past the Taiwanese could reveal vital clues. If for example board company HTC was the main provider of members and other employees start exchanging Windows Mobile based devices. Recently other email with a large outside investment firm this larger companies such as Samsung, could be an indication of a pending carve-out of Sony/Ericsson and Motorola have licensed the a troubled business unit. operating system and provide handsets based on This point is especially relevant if the third party WM. has a holistic view of the traffic as is the case with mobile phone operators or governmental 3. Push-Email Architectures agencies in countries where regulations allow them access to this data. and Risks Whereas a standalone mobile phone poses a Lastly, the mobile devices require access to the potential security problem only for the individual corporate network. Enabling this access might user the situation changes drastically when it is open up holes in the perimeter that can be being used for accessing corporate resources. attacked. The implementation of push-email requires the All mobile devices have in common that neither mobile device to become a network endpoint, the end user nor the company deploying them constantly connected to and exchanging data has the same kind of control as is the case with with the corporate network. The compromise of other computing devices in the enterprise such as a single device therefore impacts the security of routers, laptops or printers. Whereas in the latter the whole network. Moreover, with push-email, cases both hardware and software are provided the mobile device exchanges and stores by third party vendors at least some type of potentially sensitive data such as emails, control remains in the sense that the data that appointments and contact data. How to secure they exchange can be monitored. This is no this data on the device and in transit is another longer the case with smartphones. Here a large part of the hardware and software infrastructure in the network as well as in the device itself is Symbian controlled by the carrier. Symbian, especially in its S60 R2 release, has for a long time been the main focus of hacking and 4. Device Security malware attacks due to its widespread adoption Architectures and its comparatively weak security posture. This has fortunately changed with the radical Although the difference between mobile devices break that came about with the release S60 R3. and PCs becomes increasingly blurry, Due to the new binary format introduced in S60 smartphones are still used differently from PCs R3, Malware written for the earlier release does and pose at least partly different security risks. not run anymore on later models. Whereas on the PC platform different levels of trust are assigned to different users and this trust S60 R3 and the Symbian OS version 9.x that in turn extends to all applications a user is underlies it use a new Platform Security Model running, on the smartphone platform there is that consists of three main components. only one user. In order to still maintain a tired A trusted computing base (TCB) consisting of security model operating systems for mobile the core operating system kernel, drivers and devices usually shift the focus from a user- config files, data caging that prevents an centric model to a code-centric one. Identity is application from modifying the TCB as well as attached to code modules through code signing accessing code and data of other applications and and evaluated at install or run-time in order to capabilities which describe, on a per application determine the trust assigned to the code. basis, the operating system services an application is allowed to use. How this code-centric security model is implemented and how effective it is varies Data caging restricts access by an application between the different operating systems. and therefore the user to only certain areas of the Symbian and BlackBerry replace the multi-user file system.