Zebra Mobile extensions (Mx) Bruce A Willins

Transcription

1 Zebra Mobile extensions (Mx) Bruce A Willins Sr Director Technology Solutions

2 Agenda The genesis of Mx - Why? What is Mx and Who Uses Mx How are Mx Features Being used by customers & Application Developers Tools That Enable Access To Mx

3 Mx OS Extensions Is An Enabler Advanced Management & Security Exactly with Mx alone end users get NOTHING!

4 MX Features Are Made Available Via Three Zebra Offerings (1) MDM Toolkit MDM Vendors Software Developer (3) EMDK (2) StageNow IT Administrator

5 Mx Designed To Meet COBO Demands > 1.5B Units (Smartphone & HH Devices) COBO COPE BYOD Personal - Only T&L Healthcare Retail Manufacturing Government CLD ILD Extended Life Cycles To Reduce TCO Hardened Security MDM/EMM To Reduce IT Overhead & Downtime Enterprise accessory ecosystem LoB Missing Critical High Differentiation / Ability To Customize High Customer Touch Short Life Cycles Ease of Use Over Security Consumer WIFI Limited IT Control Partial Wipe COPE/BYDO Focus / Context Limited App Extensibility Assumes Untrusted Apps User Controlled Updates Dual Persona Short Support Cycles Large Volume To Influence HTC/Others BYOD Bring Your Own Device COPE Corporately Owned Personally Enabled COBO Corporate Owned Business Only

6 Mx Need Driven By Mobile OS Inflection Point Driven By Smartphone Consumerization Smart Phones Application Rewrite and/or Re-Architect Microsoft Android HTML5/JS Apple WE8H / Win Enterprise Only OS s Other

7 The Genesis of Mx Value To Zebra Stakeholders Enabling App Developers Meeting IT Needs Leveraging Consumer Scale Zebra Utilities EMDK Enterprise Browser Rx Logger RhoMobile B+ Smartphones >20B App Downloads WinMobile Zebra MX - Enterprise Overlay Android

8 Change Drives Opportunity Enterprise Customers Are Taking This Opportunity To Re-architect Their Applications Improving The UX (keys to touch), Flattening UI s, Leveraging Gestures, Future Proofing (e.g. X-Platforms)

9 Device Admin API (DAAPI) - Necessary But Not Sufficient Policy Description Password enabled Minimum password length Alphanumeric password required Complex password required Minimum letters required in password Minimum lowercase letters required Minimum in non-letter password characters required Minimum in numerical password digits required Minimum in symbols password required in password Minimum uppercase letters required Password in expiration password timeout Password history restriction Maximum failed password attempts Maximum inactivity time lock Require storage encryption Disable camera Requires that devices ask for PIN or passwords. Other features Prompt user to set a new password. Lock device immediately. Wipe the device's data (that is, restore the device to its factory defaults). Set the required number of characters for the password. For example, Requires you that can passwords require have PIN or a combination passwords to of have letters at and least six numbers. Requires that They passwords may include must symbolic contain characters. at least a letter, a numerical The minimum digit, number and a special of letters symbol. required Introduced in the password in Android for all admins The minimum or a particular number of one. lowercase Introduced letters in Android required 3.0. in the password The minimum for all number admins of or non-letter a particular characters one. Introduced required in the password The minimum for all number admins of or numerical a particular digits one. required Introduced in the in password The minimum for all number admins of or symbols a particular required one. in Introduced the password in for all The admins minimum or a number particular of uppercase one. Introduced letters in required Android in 3.0. the password When the for password all admins will or expire, a particular expressed one. as Introduced a delta in in milliseconds This policy prevents from when users a device from reusing admin the sets last the n expiration unique passwords. Specifies how This many policy times is typically a user used can enter in conjunction the wrong password Sets the length before of the time device since wipes the user its data. last touched The Device the screen or Specifies pressed that a button the storage before area the device should locks be encrypted, the screen. if the When device Specifies supports that the it. camera Introduced should in Android be disabled Note that this doesn't have to be a permanent disabling. The camera can be

10 Android An Enterprise OS Beyond Android s Original Purpose - Consumer Mass Adoption (drive more search for Google) Android Continued Hardening Over 7 Deserts, 7 Years, 22 API Levels, and Billions of Deployments Froyo 2.2 (May 2010) - Device Admin API (DAAPI) ICS 4.0 (Oct 2011) - Turning Point For Enterprise Security Numerous Key Security Additions Strong Password Support EAS Policies VPN Support / Per-User VPNs Full Device Encryption Encrypted Key Store SE-Linux Additions ASLR (Address Space Layout Randomization).. (many more)

11 What Mx Is Not Directly extensible features available to end users via the UI Is not a proprietary version of Android Is not designed to replace Android functionality but to supplement Android functionality Does not cost you anything there are no licensing fees Does not take over you decide if and when to activate features Does not require installation it is pre-installed and ready to go Indiscriminant Access to privileged features/functions/apis

12 Mx Os Extension Basics How is the device configured? A device is configurable via XML constructs How is the XML generated? StageNow, EMDK, or MDM Toolkit, (manual but not recommended) What triggers the consumption of XML.An application binds to the MX framework and passes XML How do I know if the XML was consumed correctly? a response XML is generated

13 Mx Os Extensions Made Available via EMDK & StageNow 67+ Major Operations Some of Which Are Compound Operations Mx OS Extensions Foundation EMDK StageNow

14 Mx Is Available For AOSP & Google Mobile Services (GMS) Platforms GMS Challenges Privacy - relinquishment to Google of significant data rights, inconsistent with enterprise protection of data Google Account Logistics services require a Google account Forced Updates - Google Terms of Service (// When a Service requires or includes downloadable software, this software may update automatically on your device once a new version or feature is available. Malware Exposure - Google Play Riddled with Malware (NIST best practice no access to public app store Hardware Design Constraints all hardware designs must comply with Google CDD, which limits enterprise device choices Application & Customization Restrictions UI constraints Google Maps. Google+ Google Cloud Messaging Mobile Chrome Browser Potential Functional Limitations Must adhere to Compatibility Test Suite AOSP ~ 22.5% of All Smartphone Shipments (4Q 2014) ( GMS Features Google Cloud Platform Google Wallet Instant Buy Google Play Store Google Play Services Google Analytics Google Mail - GMAIL

15 Top 4 Mx FAQ Q: Would/Will you do something like Mx for OS s other than Android? A: We ve provided Mx like functionality for legacy operating systems through an SDK/EMDK. We cannot however extend such functionality in other closed operating systems such as WE8H and IOS. Q: What happens if later versions of Android include an Mx Feature? A: You have the option to use either and if a direct 1:1 mapping exists then the Mx operation will eventually be remapped. Q: Any consideration in making Mx an open standard? A: Yes. We are exploring 3 options to standarize Mx; industry consortium, standards organization, or directly into Android (preferred route). Q: Where do Mx features come from? A: Originally came from our domain knowledge but have now been driven by enterprise customer requests.

16 Privilege Access Functionality Through Mx Basic Android User Applications - Not Adequate For Many Enterprise Android Needs Unprivileged prevent adversely impacting; other applications, the operating system, accessing private data, accessing other application's files, performing network access, keeping the device awake End User Approved Permissions - Required permissions declared in the manifest are approved by end user Typically self-signed with a developer held certificate/private key (simply identifies author), Permission Levels Android apps list permissions in their manifest, Permissions are either (normal, dangerous, same signature, signatureorsystem (platform sign) Privileged Apps with Signature-or-System Protection Level Enterprise Functionality But Not Scalable System Apps - Critical Apps, Protected In read-only /System /app (cannot be uninstalled by user) User Apps that that are platform level signed (OEM Signed Applications) Mx Provides Gated, Controlled Access To Privilege Features, Platform Signing Is Not Necessary To Access Mx Features Some Consumer Offerings Do Not Adequately Protect Privilge APIS

17 Mx - Facilitating Rapid Response Feature Requests Working on Adoption Before Mx All Three Major Components Must Be Updated Under The Mx Paradigm Only A CSP Is Updated Code Changes Android Operating System MDM Agent 1). OS Update Zebra Rewrite, Test, & Release 2). MDM Agent Update MDM Rewrite, Test & Release Edit Zebra XML & DSD Documents CSP Update Sync MDM Management Console Software 3). MDM Console Software Update Rewrite, Test, & Release Console Software & UI MDM Compiles DSD For UI Update MDM Agent Use Existing MDM Sync To Bring To Device Existing MDM Agent Triggers XML Consumption

18 Mobile OS Mass Adoption Has Its Downside Worldwide Device Shipments (thousands of units, Gartner Oct 2013) Mobile Phones To Out-ship PC s By ~ 7:1 WW SMARTPHONE MARKET (UNITS) Mobile Phone Tablet/Ultramobile PC (Desk-based and Notebook)

19 REGULATORY COMPLIANCE IS FUNDAMENTAL TO ZEBRA CUSTOMERS DIRECTIVES/MANDATES/EDICTS Retail PCI DSS (Payment Card Industry Data Security Std) for mobile payment (MPoS) QSA (Qualified Security Assessor) Audits Critical Infrastructure Healthcare NERC CIP (North America Electric Reliability Corp Critical Infrastructure Protection) HIPAA, Health Insurance Portability & Accounting, HITECH, Omnibus Controlled Substances Financial Government DEA CSOS Controlled Substance Ordering System Sarbanes-Oxley, Gramm-Leach Bliley Act (GLBA), Basel II NIST FIPS Federal Information Processing Standards Gov t PED (portable electronic devices) Requirements STIGS (Security Technical Implementation Guide) DoD Directive (commercial wireless devices in DoD Gov t Info Grid (GIG) Federal Information Security Management Act (FISMA) / NIST Info Categorization Guidelines Legislation Requiring Breach Notification 46 States Have Enacted Breach Notification for Personal Information Federal Legislation In Discussion, But Pending

20 Mx-Osx Enables comprehensive Lockdown Principle of least privilege On/Off-Enable/Disable/Filter Interfaces ON /Off / Discovery Off Android Debug Bridge (ADB) Device File Access All USB Activity Cellular SD Access Proxy Sensors Recording Imager Camera GPS Speaker Display Brightness Software URL Filters Application White List Devices Settings & Capture User Settings Comprehensive Lockdown and Monitoring Enabling Only the Functionality Needed to Perform the Operation and No More

21 How Are Customers & Developers Using Mx I wonder what happens when I do this? UI Controls - My associates are invoking unnecessary settings which generates an IT service call and results in lost productivity.. Mx allows Black Listing of System Applications, black listing the settings apk limits the end user settings to; Sound, Display, & About. Limited Settings Enterprise Reset I want to programmatically reset the device but I also want to persist some applications, settings, and data Mx enables users to issue an enterprise reset, anything stored in the Zebra enterprise folder will persist over the reset. Certificate Management I need to install/revoke certs & enable staging on a secured network Silently Install/Remove A CA Root Cert Silently Install/Remove client certs / private key Auto-Clock Adjustment - device needs cert to get time update but cert cannot be installed due to invalid time set

22 How Are Customers & Developers Using Mx White Listing - My associates should only run approved applications.. Mx provides active (not just removal of icons) application white listing, limiting applications that can be loaded and/or executed to those explicitly approved Circle of Trust Submit To Mx White Listing Privilege Extensions My application wants to be able to submit XML and wants to designate other trusted applications to do the same... White Listed Approved applications can designate other trusted applications to enable Mx XML submissions Cannot Submit To Mx Mobile Application Management (MAM) I need to manage all applications on the device... Mx to install, remove, update, applications unattended. Launcher Control (Enterprise Home Screen) - I want an application specific device or I have part time workers that should not have full Android access... Mx allows you to control the launcher, with enterprise home screen the device can be locked to a limited set of capabilities

23 Sample Upcoming Mx Capabilities Mobile alerts are distracting our drivers, creating a safety hazard. Mx: Programmatic Control to Enable/Disable Mobile Alerts I have screens in my application that contain sensitive data which I do not want in a snapshot.or.the QSA for my MPOS application requires disabling screen shots. Mx: Programmatic control to prevent Screen snapshots I do not want sensitive information copied to the clipboard. Mx: Programmatic control to enable/disable the clipboard Notification Bar is allowing access to settings & applications Mx: Programmatic control to enable/disable pulling down of the notification bar

24 Mx New Real World Issues Escalated Lost/Stolen Devices Enterprise IDC 70% of enterprise data now resides on mobile devices ~4.3% of employee issued smartphones are lost or stolen (Ponemon Institute) 57% were unprotected 60% believed to have sensitive data Industries with the highest loss rate; healthcare & pharmaceuticals, education & research,public sector organizations Symantec Study Human Nature 50 lost Phones 43% Clicked Online Banking 53% Clicked HR Salaries 57% Opened saved passwords 72% Checked private photos

25 Mx - Dealing With Lost/Stolen Devices Autonomous Countermeasure Matrix For Android Mx Countermeasures Threats Wipe SD card Factory reset Wipe Secure Storage Keys Password Reset All Users Password Reset Specific User Lock Device Uninstall Specific Application Send Alert to Application via Intent Maximum password limit X MDM Client Removal Force through XML X X X Exchange ActiveSync (EAS) password limit x x x x x X X Device is Rooted X Exceeding a Configured Threshold Results in One or More Countermeasures Runs Autonomously on Device Negating Dependency on Network Connectivity Configured by Enterprise Administrator & Pushed to the Device

26 Mx => Numerous Features & Functions To Enhance Programmatic Device Control, Management & Security E.g. Profile Settings Zebra Technologies Confidential Restricted

27 MX Programmatic Configuration Extensible Configuration MX uses a standards based XML schema (OMA-CP PROV / MSPROV) New features can be developed and immediately plugged-in and used by all solutions (MDM, Staging, EMDK) Concurrent use by multiple applications with sync & async options on transient & persistent operations XML generated by Eclipse Pug-in (EMDK), StageNow workstation or MDM Console Developer EMDK Admin Staging / MDM XML File XML File MX Management System XML Object XML Object XML Object XML Object CSP CSP CSP CSP

28 THANK YOU