The Device Has Left the Building

Size: px

Start display at page:

Download "The Device Has Left the Building"

Margaret Johns
5 years ago
Views:

1 The Device Has Left the Building Mobile Security Made Easy With Managed PKI Christian Brindley Principal Systems Engineer, Symantec Identity and Information Protection

2 Agenda Mobile Trends and Use Cases Certificate Provisioning Process The Symantec Difference 2

3 Mobile Device Explosion Paves Way for Bring Your Own Device (BYOD) 39% 69% 340% 2,170% M corp PCs M corp PCs M personal PCs M personal PCs M smartphones M smartphones M tablets M tablets 3

The Impact of Mobile Devices on Information Security: A Survey of IT Professionals, Check Point, January 2012 3.

4 Changes In Working Style 80% 1 65% 2 52% 3 New apps deployed in the cloud Enterprises allow mobile access to their network Workers use three or more devices Sources: 1.IDC Predictions 2012: Competing for 2020, Frank Gens, IDC, December The Impact of Mobile Devices on Information Security: A Survey of IT Professionals, Check Point, January Info Workers Using Mobile And Personal Devices For Work Will Transform Personal Tech Markets, Frank E. Gillett, Forrester Research, February 22,

The Desires of the User Versus IT Staff User IT Staff Freedom, Privacy & Productivity Easy access to files, apps, email Use the latest technology & apps Personal stuff is

5 The Desires of the User Versus IT Staff User IT Staff Freedom, Privacy & Productivity Easy access to files, apps, Use the latest technology & apps Personal stuff is untouched Do it themselves (i.e. Self-Service) Simple, Secure & Reliable Protect company information Only let authorized users in Easy to work with and reliable Reporting, audit & monitor 5

6 Devices in the New Enterprise A Spectrum of Possibilities and New Trust Equation Enterprise Owned Enterprise Managed User Owned Enterprise Managed User Owned Unmanaged Trust the File System Trust the App Trust the Device Trust the User 6

User Authentication - Enabling Trust Securing User and

Symantec Validation and ID Protection Service (VIP) Trust the

Authentication (OTP or Risk-based) Single Sign-on for cloud

Stored on disk or hardware Token-less or token-based On-premises

7 User Authentication - Enabling Trust Securing User and Application Access Trust the Device Symantec Managed PKI Service Symantec Validation and ID Protection Service (VIP) Trust the User Symantec O 3 Device and User Certificates 2 Factor Authentication (OTP or Risk-based) Single Sign-on for cloud applications Identity-based authorization and access control Stored on disk or hardware Token-less or token-based On-premises or SaaS Symantec Web-based Management Symantec Cloud-based Authentication Infrastructure 7

8 Mobile Use Cases The Role of PKI: Trust the Device Mobile Device Management or Bring Your Own Device Microsoft Exchange ActiveSync WiFi Secure Document Signing VPN (e.g. Juniper, Cisco, etc.) Web Site Authentication 8

) Strength comes from Public-key Crypto Keys commonly 1024 bit Increasingly 2048 bit Stored on user device

9 What Exactly Is A User Or Device Certificate? A Digital Identity File conforming to a standard (X.509, PEM, etc.) Strength comes from Public-key Crypto Keys commonly 1024 bit Increasingly 2048 bit Stored on user device (or a smart card) Contains some required information User or device name Public key Hash of itself Signature of issuing authority Customizable through meta-data Extension fields Customer specific information 9

Digital Certificate Use Cases Uniquely Satisfy Requirements For All These Applications Secure Remote Access Strong authentication to networks via VPN Secure Email Authenticate to ActivSync and

10 Digital Certificate Use Cases Uniquely Satisfy Requirements For All These Applications Secure Remote Access Strong authentication to networks via VPN Secure Authenticate to ActivSync and encrypt or sign messages WIFI Authentication Transparent WIFI authentication using certificates on ios devices Web and Cloud Authentication Mobile use of enterprise hosted web apps or enterprise SaaS Mobile Device Management Authenticate to specialized management application 10

11 Secure Remote Access Objectives Require strong authentication method Open network to remote employees and contractors but save token expense and hassle Consolidate on single technology for authentication, encryption and digital signatures Industry compliance mandates (certain verticals like public sector, SAFE etc) The Symantec Difference Cloud based service lowers the TCO Automation and application enablement greatly simplifies the end user experience 11

Strong Web Authentication Objectives Require a Strong Authentication method Open network to remote employees and contractors but save token expense and hassle Save token expense and distribution

12 Strong Web Authentication Objectives Require a Strong Authentication method Open network to remote employees and contractors but save token expense and hassle Save token expense and distribution hassle Industry compliance mandates (certain verticals like public sector, SAFE etc) The Symantec Difference Cloud based service lowers the TCO PKI Client delivers a consistent, browser-agnostic experience 12

Infrastructure Authentication Customer Objectives Secure yet convenient access to

11x security mechanisms MAC address filtering too cumbersome to manage on any scale and

access and roaming between access points The Symantec Difference Cloud based service

13 Infrastructure Authentication Customer Objectives Secure yet convenient access to corporate WiFi or wired access switch Desire to get stronger protection than basic x security mechanisms MAC address filtering too cumbersome to manage on any scale and leaves the door open for MAC address spoofing Minimal human intervention in gaining access and roaming between access points The Symantec Difference Cloud based service lowers the TCO Automation and application enablement greatly simplifies the end user experience 13

Secure Email Signature/Encryption Customer Objectives Internal information security mandates on proper classification and handling of data at rest and in transit which requires signing and encrypting

14 Secure Signature/Encryption Customer Objectives Internal information security mandates on proper classification and handling of data at rest and in transit which requires signing and encrypting sensitive s Industry compliance mandates (certain verticals like public sector, PCI, SAFE etc) Special Issues Requires public trust Microsoft CA unlikely Some situations are more suited for a whole PGP encryption solution The Symantec Difference Cloud based service lowers the TCO Automation and application enablement greatly simplifies the end user experience 14

Secure Email - ActiveSync Customer Objectives Secure access to Exchange email No reliance on Windows password Special Issues Requires certificate

15 Secure - ActiveSync Customer Objectives Secure access to Exchange No reliance on Windows password Special Issues Requires certificate mapping The Symantec Difference Cloud based service lowers the TCO Automation and application enablement greatly simplifies the end user experience 15

Mobile Device Management Customer Objectives Information Protection Secure Access to enterprise resources Policy Enforcement The Symantec Difference

16 Mobile Device Management Customer Objectives Information Protection Secure Access to enterprise resources Policy Enforcement The Symantec Difference Cloud based service lowers the TCO Automation and application enablement greatly simplifies the end user experience Well integrated with leading MDM vendors 16

17 Agenda Mobile Trends and Use Cases Certificate Provisioning Process The Symantec Difference 17

Enabling And Supporting Certificates The Use

Management Process 1 Configure certificate

Report, revoke, recover, renew ENROLL 2 3

user/device Configure apps to use certificate

18 Enabling And Supporting Certificates The Use Of Certificates Involves A Lifecycle Management Process 1 Configure certificate policy and provision for enrollment MANAGE Report, revoke, recover, renew ENROLL 2 3 DELIVER MANAGE 4 USE Request certificate via specified method Symantec Managed PKI confirms authorization Issue certificate to user/device Configure apps to use certificate Authenticate to apps Encrypt docs/ s Sign docs/ s/transactions 18

Digital Certificates Well Supported By ios Devices Foundation For Enablement, Security And Management ios 4 has robust enterprise management Continuous online monitoring (query for information)

19 Digital Certificates Well Supported By ios Devices Foundation For Enablement, Security And Management ios 4 has robust enterprise management Continuous online monitoring (query for information) Device Management Services (update, wipe, etc.) Simple Certificate Enrollment Protocol (SCEP) Service Applications Supported WiFi Device authentication VPN access Web Applications S/Mime ActiveSync 19

20 Digital Certificates for Android Devices Foundation For Enablement, Security And Management Android support via agent Requirement for end point software Applications Supported WiFi Device authentication VPN access ActiveSync 20

21 Options For Deploying Mobile Certificates Enrollment Is A Critical User-facing Process Manual Import and Configuration Enrollment using and Mobile Device Management Server Direct Enrollment using supported interface (e.g. SCEP, Http, etc.) One certificate can potentially be used for multiple cases depending on platform, situation and management goals 21

22 Configure Certificates Manually 1. Certificate is enrolled on a desktop PC. 2. Certificate is exported (unsecure), ed to the mobile device and manually imported 3. Client side VPN application and trust configuration done manually using ios Settings 22

23 Direct enrolment using SCEP Direct Enrollment requires no MDM server and uses built in features of Apple ios providing certificate related features 23

24 Enrolment via MDM MDM Enrollment acts as a proxy and provides a superset of features available through the MDM provider 24

Agenda 1 2 3 Mobile Trends and Use Cases

25 Agenda Mobile Trends and Use Cases Certificate Provisioning Process The Symantec Difference

Symantec Managed PKI Infrastructure Build

vs. PKI Software Trust &Train IT Personnel

Cost and complexity of in-house solution

Ease of use Leverage operational excellence

26 Symantec Managed PKI Infrastructure Build Your Own (In-house) PKI Managed PKI Service vs. PKI Software Trust &Train IT Personnel Servers Your PKI Administrator Databases Trust & Train Operational Personnel Accreditations Secure Facility Firewalls Cost and complexity of in-house solution mitigates benefits Much Faster to deploy Lower total cost of ownership No infrastructure investment No maintenance Ease of use Leverage operational excellence Secure, audited operations High Availability (HA) and high capacity 24/7 support and binding SLAs Certifications and accredited policy for DoD, SAFE Biopharma, Adobe CDS, etc. 26

service Built-in certificate management capabilities Automated certificate lifecycle

27 Symantec Managed PKI Service Turn Key System Just Add Administrator Cloud-based Two-Factor Authentication Service Using Digital Certificates Comprehensive, Automated service Built-in certificate management capabilities Automated certificate lifecycle management Broad application support and enterprise integrations Device and User Certificates 27

Devices Unmanaged Devices Works with top

managed and unmanaged Bring Your Own Device

Apple Mac, Microsoft Windows, Apple ios,

28 Enabling Trust for Devices in All Cases Symantec Managed PKI Service Managed Devices Unmanaged Devices Works with top Mobile Device Management solutions But doesn t require it.. A comprehensive, end-to-end solution for managed and unmanaged Bring Your Own Device Support for all devices on all platforms: Apple Mac, Microsoft Windows, Apple ios, and Google Android Fully cloud-based solution for quick deployment and easy management 28

Certificates for Managed Devices Mobile Device Management-Managed Devices Employee Receives

issues certificates, and provides validation services MDM Requests certificates and pushes

certificates PKI Administrator Configures MDM and sets up account in PKI Manager Firewall

29 Certificates for Managed Devices Mobile Device Management-Managed Devices Employee Receives profiles and certificate via Mobile Device Management Cell Networks PKI Platform Hosts CAs, issues certificates, and provides validation services MDM Requests certificates and pushes profile to ios devices PKI Manager Creates certificate profiles, adds users, and manages certificates PKI Administrator Configures MDM and sets up account in PKI Manager Firewall (Optional) Internet Web Services Listens for web service calls and provisions certificates 29

30 Certificates for Unmanaged Devices Unmanaged Device Employee Enrolls for certificate from PKI Certificate Service, downloads profile over-the-air (OTA), and installs certificate Cell Networks PKI Platform Hosts CAs, issues certificates, and provides validation services PKI Manager Creates certificate profiles, adds users, and manages certificates PKI Certificate Services Enroll and pick up certificates Administrator Sets up account in PKI Manager Firewall (Optional) Internet SCEP Responder Listens for SCEP requests and provisions certificates 30

31 Symantec s Pedigree: A Proven Enterprise Approach 5.7m PKI seats loaded to accounts at Symantec last year Millions more PKI seats loaded to Processing Centers and CLPs >200m device certificates issued to date 3 Billion secure online transactions enabled every day Simplified Transparent Automated Flexible Cross-platform Applications Browsers Devices Robust and Scalable Reliable Efficient Extensible 31

32 Walkthrough 32

33 Configuring a certificate profile for ios delivery 33

34 Configuring a certificate profile for ios delivery 34

35 Configuring a certificate profile for ios delivery 35

36 Configuring a certificate profile for ios delivery 36

37 Configuring a certificate profile for ios delivery 37

38 Configuring a certificate profile for ios delivery 38

39 Configuring a certificate profile for ios delivery 39

40 Configuring a certificate profile for ios delivery 40

41 Configuring a certificate profile for ios delivery 41

42 Configuring a certificate profile for ios delivery 42

43 Configuring a certificate profile for ios delivery 43

44 Configuring a certificate profile for ios delivery 44

45 Configuring a certificate profile for ios delivery 45

46 Configuring a certificate profile for ios delivery 46

47 Configuring a certificate profile for ios delivery 47

48 Configuring a certificate profile for ios delivery 48

49 Why Symantec Managed PKI Service Proven Infrastructure 15 year record of reliability 2 3 User Experience Built-in automation and self-service options Broad Device Support Managed and unmanaged devices - ios, Android, Mac, and Windows 49

50 Thank you! Christian Brindley Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. 50

PKI is Alive and Well: The Symantec Managed PKI Service

PKI is Alive and Well: The Symantec Managed PKI Service Marty Jost Product Marketing, User Authentication Lance Handorf Technical Enablement, PKI Solutions 1 Agenda 1 2 3 PKI Background: Problems and Solutions