Security Updates plus 46 Security fixes – iPhone Is Enterprise Ready Now!?
iPhone Enterprise Security finally comes into its own
By jheary on Sat, 06/20/09 - 7:15pm.
The recent disclosure of 46 new security fixes in iPhone 3.0 is just part of the proof the iPhone is ready for Enterprise adoption.
For years Blackberry has set the standard for Enterprise class Smartphone security features. This has endeared it to businesses the world over and made Blackberry the undisputed leader in the Enterprise Smartphone sector. The release of the iPhone 3G did little to challenge Blackberry's Enterprise dominance. With its latest hardware and software iPhone upgrade Apple takes another shot across the bow of Blackberry. Will this shot be more than just a warning shot this time? Should Blackberry be wary of the new iPhone 3GS and 3.0 software? Will the new iPhone 3GS measure up to the high security standards that Enterprises have come to expect in their corporate Smart phones? Only time will tell for sure, but it looks promising for Apple.
First let's start by reviewing the considerable number of security fixes that Apple put into iPhone 3.0 software. A total of 46 security fixes were introduced in iPhone 3.0 code. Of the 46 security holes fixed, 12 are listed by Apple as "may lead to arbitrary code execution". Contrary to what your first reaction to this news might be, this is actually excellent news! No other Smartphone company has publicly demonstrated such a comprehensive dedication to secure coding practices and reviews. All code will inevitably be found to have vulnerabilities; after all it is humans who are programming it.
What truly makes one company stand out from another is their commitment to adopting a secure coding methodology and code review process. Given the shear breadth of Apple's iPhone 3.0 security fixes it is evident that the Apple iPhone coding team has adopted these best practices. This should be a big differentiator to any business evaluating the differences in security between different Smartphone manufacturers. Add to this the fact that the iPhone OS is largely based on the MAC OS X platform, the iPhone also inherits much of the respectable security track record that OS X has enjoyed over the years.
Now let's take a look at the baseline security features that the iPhone adopted with the 2.x code train. Apple added a Cisco IPSEC VPN client, WPA2 802.1x wireless support, two-factor authentication with token/OTP or PKI Certificate support, wirelessly push company email, calendar events, and contacts over a 128-bit encrypted SSL connection, and iPhone Security Configuration Profiles to set and enforce the above corporate security policies. One security feature almost nobody seems to know exists in 2.x, and miss reports as a limitation of the iPhone security all the time, is Alphanumeric pass codes of 4 or more characters with special character enforcement included. You must use an iPhone profile in order to enable it, look here for more info on creating a profile. Here is a screenshot of how it looks when enabled:
With the release of iPhone 3.0 software Apple has added a few important new security features to the iPhone. Tops on the list is hardware data encryption, available only on the new iPhone 3GS. Just like it says, this feature will encrypt all of your data on the device. Exactly how this works I don't know yet. But I am downloading the 3.0 SDK so should have an update soon.
The second most important is the remote wipe capability. This allows a user with a lost/stolen iPhone to send a command to their phone over the airwaves telling it to delete itself and restore factory default settings. The way the remote wipe functions differs based on the iPhone model you have. If you have the iPhone 3G then the 3.0 software performs a bit by bit secure delete of the drive and then restores the factory defaults. If you have a new iPhone 3GS then the remote wipe will just delete the hardware encryption key, thus rendering the data unreadable, and then restore factory default settings. The advantage of the iPhone 3GS method is that it allows for a user to restore their data later if they end up finding their iPhone. The 3.0 software will just restore the deleted hardware encryption key thus allowing you to read the data once more. The draw back of this method is that if the crypto key is stored locally on the device how securely is it stored. Could a hacker steal your phone, prevent a remote wipe by RF shielding the phone, and then be able to find and use the local key to get at the data? This is theoretical of course, nobody seems to know how this key is protected yet.
Another great new feature is the "Find my iPhone" feature. It allows a user with a mobileMe account to logon and see where their iPhone is currently located on the planet. In addition to being a convenience feature for the user it is also a security feature that could allow law enforcement to track and capture a thief that has stolen a highly sensitive iPhone(s).
So what is the iPhone still missing to be Enterprise ready? Some say it is ready to go now. However, not everyone agrees (as is usual). They point out that the iPhone needs a to offer Enterprises more control over the devices themselves for software upgrades, auditing, enforcement, tracking, remote wipe functions, monitoring, troubleshooting, etc. The leader in this space is Blackberry's Enterprise Server solution. Without a doubt this would be a venerable addition to the iPhone's feature list, but I'd argue that for all but the largest enterprises this is not a showstopper. Given the superiority of the iPhone interface vs. other Smartphone devices, if Apple does have this in development then we might see a enterprise Smartphone monopoly coming.
What features do you think the iPhone still needs for mass adoption in the Enterprise market? Do you think the latest release is enough?
The opinions and information presented here are my PERSONAL views and not those of my employer. I am in no way an official spokesperson for my employer.
More from Jamey Heary:
* Credit Card Skimming: How thieves can steal your card info without you knowing it
* Cisco enters the crowded AV and DLP client market
*Cisco's new ASA code allows you to securely take your Cisco IP Phone with you anywhere
* Cisco targets Symantec, McAfee with its new antivirus client
* Google's Chrome raises security concerns and tastes like chicken feet a>Go to Jamey’s Blog for more articles on security.
- About Cisco Security Expert
Jamey Heary, CCIE No. 7680, is the author of the Cisco NAC Appliance: Enforcing Host Security with Clean Access book by Cisco Press. Jamey is a seasoned security technologist with over 15 years in the IT field with 10 years focused on IT security. His areas of expertise include network and host security design and implementation, security regulatory compliance, and routing and switching. His other certifications include CISSP, CCSP, and Microsoft MCSE. He is also a Certified HIPAA Security Professional. Jamey is currently a Security Consulting Systems Engineer with Cisco, though the opinions expressed here are his own. Jamey is a member of Network World's Cisco Subnet blog community.
- Archives
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
Sponsored Links
- Securing Virtualized Data Centers - eBook - Trend Micro
- Efficiency goes up. Costs come down.- Microsoft
- SQL Server Experts: Virtually unstoppable- Microsoft
- Stay informed with custom newsletters from Tech Dispenser- Tech Dispenser
- Drive down operating expenses and mitigate risk with app centralization - Live May 12.- Juniper Networks
- The Next Generation of Content Security Has Arrived! Learn More!- Websense, Inc.
- Reduce costs by 49%, Increase capacity utilization by 33%. Make the HP LeftHand SAN work for you.- HP LeftHand SAN
- Connexion saves costs with Microsoft & Novell- Novell Microsoft
- Masters of Virtualization and Cloud Computing- Trend Micro
- Hitachi IT Operations Analyzer—30-day free trial- Hitachi Data Systems
-
Network World, Inc
The Leader in Network Knowledge
thanks
good article, don't despair if no one responds because there is so much info and distractions on the internet than people using it.
you won my "morning coffee" today. :)
Excellent!
thanks for reading and taking the time to comment.
-Jamey
ok
ok I submitted this article to mac news sites..
your welcome. :)
Much appreciated!
Glad you liked it.
-Jamey
Not so sure...
... The article seems biased to say the least. I'm not sure I'd say Apple's Mac OSX has enjoyed a respectable security track record over the years, they were just less of a target. I'm happy Apple found and fixed 46 security holes, that is responsible coding/updating. I'm also very interested in the HW encryption of the 3GS. The Activesync implementation still seems "light" compared to WM6 or BlackBerry. As a former BES admin, the capabilities in the BES were staggering, for a corporate managed device. In the days of consumerization in the Enterprise, I'm more interested in segregating the corporate data from the user space. My jailbroken G1 iPhone (OS 2.2.1) lets me get full unencrypted access to my mailbox via ssh. This is bad. The 3GS Hardware Encryption is great, but am I going to have to mandate all my users upgrade to the 3GS, and can I enforce it on the backend? (as well as host integrity check for things like jailbroken phones?).. Unfortunately, I think not... Yet.
That is the problem...
"Exactly how this works I don't know yet. But I am downloading the 3.0 SDK so should have an update soon."
Unfortunately, that is what I am seeing when people talk about the iPhone. The passion is so intense that people forget about the basics! How can you say something is good if you do not know how it works? :)
Is Apple deliberatly trying to miss the Enterprise boat
Are they deliberately leaving out a task manager? I've been waiting for that for years now. A simple task list that can sync to either my office outlook or to one of Apple's own products.
How can they get so close and yet miss just a few features.
I also disagree that the lack of enforcement on the iPhone is a showstopper only for larger Enterprises. There are many small and medium sized companies that have enforcement requirements, either by their own policies or by government policies.
I think the largest roadblock to the iPhone becoming an enterprise class device is the popularity of the iPhone itself. So many people already have an iPhone that they are going to want to attach their phone to their company's plan rather than get a new one or have to carry two.
Great article
This is a great article and on point, IMHO. Please let us know as soon as you delve the 3.1 SDK. I'm curious if the 3GS HW encryption can/will encrypt ALL data at rest on the iPhone, or only encryption of the Apple-deemed 'sensitive' data stored on the phone. Seems to be conflicting reports on this. I'm hoping it is something akin to Guardian Edge or Mobile Armor, etc., where there is pre-boot level encryption of the entire storage space. Anyone know if and when this type of encryption is possible?
Also, I haven't found a vendor that supports an iPhone CAC (Common Access Card) reader yet, have you? BIA and Apriva have it 'on the horizon', but I need to ask..what's the's hold up. If the crypto storage API's are there, and the BT stack is ready...wouldn't this just be a driver code project at worst? BB and Win Mobile already have BT readers, so what gives?
iPhone VPN client fix
Apple did not mention this but until 3.0 the iPhone VPN client would allow users to cache their password even if the ASA Group policy explicitly forbid the user store the password on the client system. Time to force users to 3.0.
When they create a blue
When they create a blue tooth CAC reader for the iPhone I will give Bill Gates my first-born child. Promise. Until then, I'll continue to treat my iPhone more like a toy as opposed to a business platform.
Post new comment