Identity, the New Security Perimeter

Identity, the New Security Perimeter

Mobile users have access to more information, better communication than ever before

Identity, the New Security PerimeterIn the past few years, we have witnessed a dramatic increase in employee mobility. Whether traveling, working from home, in flex offices or a conference room at a home office, we expect information access to be immediate and communication via voice, chat, text or email to be always available. This mobility started the “Consumerization of IT” that has led to the growing adoption of the Bring Your Own Device or BYOD trend for mobile phones and tablets. This has increased productivity as mobile users have access to more information and better communication using the devices they are most comfortable with. As users have added business apps to access secure data within the workplace, the need to link and manage the appropriate identity has led to the emergence of another growing trend—Bring Your Own Identity or BYOI.

One Device, Multiple Identities

On a modern mobile device, the user will have a mixture of personal and work activities, making it essential to associate each activity with the appropriate digital identity. An email client and a secure browser for accessing corporate portals are among the apps that a typical employee will need to complete their job. The corporate IT department needs to ensure that the digital identity that enables access to these resources is securely linked to the correct person, as well as be sure they can disable that access when appropriate. Organizations now realize that users also need a place on the mobile device for personal apps and data that can function concurrently with their work activities.

If an enterprise terminates an employee by eliminating access to their mobile phone, an IT organization must erase all of the work apps and data without touching the former employee’s personal files.

A New Perimeter

This increased mobility also has contributed to the shift away from perimeterbased security. If users are no longer behind a firewall, the security perimeter needs to be redefined. One view is that identity is the new perimeter. The set of applications used with a work identity and the associated credentials on a mobile device define a perimeter that an employer needs to manage and secure.

This perimeter needs to be visible to the user. It has to be clear if an employee is sending a personal or professional email; security is as much about making it easy for the user to do the correct thing as it is about technical hardening. Since email may contain enterprise confidential information, apps will be secured with some kind of lock, a PIN or possibly a biometric check if the phone has the capability. Fingerprint scanners are already built into or will be featured as an add-on for some smartphones. Other biometric options, such iris scan or voice recognition, are being developed.

Once unlocked, the user can interact with data and applications using their work identity as though they are on a workstation inside the company.

Stronger Authentication, Less Hassle

While the security perimeter is being redefined, it is becoming increasingly apparent that user name/password are no longer an acceptable level of authentication. Fortunately, the mobile device presents a robust platform for two, or even three, factor authentications. Virtually every mobile device has one or more secure elements, such as the Universal Integrated Circuit Card (UICC), that can be used to securely store keys and perform cryptographic operations. This can be used to enhance the security of digital identities. The credentials are stored in the secure element, and critical elements of cryptography are performed inside it without exposing the keys.

How to Implement BYOI

Implementing BYOI requires three steps:

  1. Ensure that the mobile devices are manageable, either by selecting devices with management capabilities or by using third-party products.
  2. Implement a mobile identity and credential management solution.
  3. Select applications that leverage the credentials.

Some mobile devices are designed for remote management. For example, BlackBerry products were among the earliest adopted in the enterprise due to their strong IT management features. BYOD created the need for mobile device management (MDM) solutions that manage all of the phones carried by a corporation’s employees. MDM products include a server-side management console and links to the mobile devices. If the mobile devices do not have features, like application containers, the MDM vendor may include client-side code. While early MDM solutions took over the entire device, providing the features desired by IT managers, they created conflicts with personal data on the device.

Newer offerings have a variety of ways to connect the MDM console with the enterprise apps and data, while keeping personal data separate. Mobile application management (MAM) products also are available to handle the downloading and updating of apps under enterprise control. Often, this takes the form of a private app store.

Provisioning and managing identity for BYOI requires a link into the phone for provisioning and lifecycle management, and at the same time a connection to the appropriate directory, identity and credential management software in the enterprise. A number of existing identity and credential management products have been extended to provide over-the-air (OTA) provisioning and lifecycle management. A mobile identity solution must implement and manage the specific policies of the organization.

Many government and commercial organizations in the United States are following the FIPS-201 standard from the National Institute of Standards and Technology (NIST) for identity credentials. Initially implemented using smart cards for public-key infrastructure (PKI) secure badges, the FIPS-201 standard is in the process of being updated to embrace mobile device support using the concept of derived credentials. Whether strictly following the NIST standards for full compliance, or simply using them as a guide for best practice, it is a good idea to use distinct, derived credentials for each mobile device. One needs to anticipate that there will be more than one mobile device per user, perhaps a smartphone and a tablet, and that the devices will be replaced as they are lost, stolen, broken or simply updated with a newer model.

Finding applications that are credential-aware for secure operations can be a challenge. Most mobile operating systems do not have standardized interfaces for cryptographic credentials, so each application has to be selected for the specific purpose. Several specialists offer products today, and more solutions will be offered as the pressure to move away from static passwords continues to grow.

Looking to the Future

Modern smartphone and tablet operating systems have support for device, application and identity management. Looking forward, the industry can see that the functionality operating systems provide will become richer, offering enhanced features and better security.

Enhanced security features in the hardware will increase the security of mobile device use significantly and will add to the isolation between personal and professional identities. Several handsets already support the ARM Trusted Execution Environment, which provides hardware protection to prevent malware on the phone stealing secrets or interfering with the security of apps.

Investments are being made in operating systems to provide higher levels of support for credential management to support BYOI and to strengthen the security platform. In 2013, the BlackBerry 10 is adding support for dual personas with the “Balance” application, and SE Android is the platform for solutions like the Samsung “Knox” that also offer separate containers for personal and work applications.

While the focus this year is on managing two identities securely on one device, as the market matures there will be a trend to support additional identities, each with its own perimeter. A person might have a second job or want to use a suite of healthcare apps that link securely to their healthcare provider. In each of these cases, the device holder will want to enable a set of apps to use a strongly authenticated identity that is separate from others.

As user mobility continues to increase, devices become more powerful and BYOD becomes the norm—a critical piece in increasing productivity and maximizing value.

This article originally appeared in the May 2013 issue of Security Today.

Featured

  • AI to Help Resolve Non-Emergency Calls Across Utah and Decrease 911 Caller Wait Times

    The Utah Communications Authority (UCA), which oversees the state’s next generation 911 technology services, recently announced that public safety answering points (PSAPs) throughout the state plan to implement Motorola Solutions’ Virtual Response technology to automate the receipt and resolution of 10-digit non-emergency line calls in Utah with the help of AI. Read Now

  • Report: 2025 Video Surveillance Market Set to Grow After Small Decline in 2024

    Novaira Insights has unveiled its latest report, “World Market for Video Surveillance Hardware and Software – 2025 Edition.” The research indicates that the global market for video surveillance hardware and software experienced a slight decline of 0.3% in 2024. This performance fell short of previous forecasts, primarily due to a significant decrease of 7.8% in the Chinese market. Conversely, the rest of the world saw a growth of 4.9%. The global market for video surveillance equipment was estimated to be worth $25.0 billion in 2024. Read Now

  • Report Reveals Local Governments Face Surge in Ransomware Attacks with Minimal Resources

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, recently released new research highlighting the critical cybersecurity challenges facing state, local, tribal, and territorial (SLTT) governments. The report details how government organizations have become prime targets for cybercriminals while simultaneously facing severe resource constraints. Read Now

  • Video Surveillance Trends to Watch

    With more organizations adding newer capabilities to their surveillance systems, it’s always important to remember the “basics” of system configuration and deployment, as well as the topline benefits of continually emerging technologies like AI and the cloud. Read Now

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities