Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Android Businesses Cellphones Communications Encryption Handhelds Privacy Security IT

Ask Slashdot: Equipping a Company With Secure Android Phones? 229

Posted by timothy from the try-this-new-hal-9000-model dept.
An anonymous reader writes "I'm in charge of getting some phones for my company to give to our mobile reps. Security is a major consideration for us, so I'm looking for the most secure off-the-shelf solution for this. I'd like to encrypt all data on the phone and use encryption for texting and phone calls. There are a number of apps in the android market that claim to do this, but how can I trust them? For example, I tested one, but it requires a lot of permissions such as internet access; how do I know it is not actually some kind of backdoor? I know that Boeing is producing a secure phone, which is no doubt good — but probably too expensive for us. I was thinking of maybe installing Cyanogenmod onto something, using a permissions management app to try and lock down some backdoors and searching out a trustworthy text and phone encryption app. Any good ideas out there?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Equipping a Company With Secure Android Phones? More

Ask Slashdot: Equipping a Company With Secure Android Phones?

Comments Filter:
  • its the only way you can get some one you "trust", if the price is too high, then your security is degraded.

  • Dear slashdot (Score:5, Insightful)

    by Anonymous Coward on Thursday May 31, 2012 @02:29PM (#40170185)

    I'd like to know how to configure a kludge of shit (using all FOSS, of course) for my enterprise environment. I want everything under the sun plus the kitchen sink.

    Also, I'm going to be paranoid and reject anything you propose. After all, I can't be sure that anything I buy doesn't have a backdoor that the government or extra terrestrials could use to snoop on the uber secrets at my company.

  • we have one (Score:1)

    by Anonymous Coward

    We have one in works. Email to me df.inbox at gmail.com for details.

  • Make it yourself (Score:1, Interesting)

    by Anonymous Coward

    I would recommend developing your own system. If you are dealing with highly sensitive information, you want to make sure that it is fully secure. There are plenty of independent security contractors out there to develop something for you if you do not have the skill set to make it yourself within your company. Custom ROM, kernel, and various modifications to it should do it for you.

  • Apple (Score:4, Insightful)

    by wood_dude ( 1548377 ) on Thursday May 31, 2012 @02:29PM (#40170197)
    Yes, use an iPhone ! Let the flames begin...

    • Re:Apple (Score:5, Informative)

      by Anonymous Coward on Thursday May 31, 2012 @02:38PM (#40170355)
      As much as I absolutely HATE to say this, you're absolutely right.

      Blackberries suck, Android's security is left to the manufacturer (so it usually doesn't get done right), Windows Phone 7(.5) is still not ready for the Enterprise, Symbian is dead, so are Meego and Maemo...

      iPhones are locked down, have enterprise support tools, come encrypted by default. Unless you're willing to inflict Blackberries on your users, AND pay for the BES, AND pay the per-handset CAL, iPhones are your best bet.
      • iPhone is the overwhelmingly common [ibtimes.com] device in enterprise right now, largely because of BYOD. Ironically, some claim [computingunleashed.com] that Blackberry is slightly more secure than iOS because it is more obscure (less popular)! It is pretty universally acknowledged that Android currently comes in last when it comes to enterprise security.

  • Blackberry? (Score:5, Informative)

    by twnth ( 575721 ) on Thursday May 31, 2012 @02:29PM (#40170199)

    Why android? is there an app you need or something? or is it a latest bling thing?

    Because Blackberry does the encrypted thing, and if you buy BES you can also set device policies and centrally administer the devices (remote wipe for example).

    • Re:Blackberry? (Score:5, Insightful)

      by BagOBones ( 574735 ) on Thursday May 31, 2012 @02:33PM (#40170283)

      Because starting from scratch on RIMs BB right now could be suicide...

      - New OS devices coming in the fall with a new untested management platform
      - Over stock of current gen devices they can't sell ( way under powered compared to WP, Android, iOS)
      - Bleeding management
      - Laying off huge amounts of staff.

    • There isn't much real security provided by closed source encryption products. If they've no intentional backdoors, you still face the company concealing their mistakes to save face, which costs you security.

  • Good for Enterprise (Score:2, Informative)

    by jmarka ( 2359522 )
    Timothy, You should take a look at Good for Enterprise www.good.com Best, jmarka

    • I agree, looking around Good, would be the closest off the shelf solution, it would also work with iOS devices giving you access to BOTH the most popular platforms right now..

    • Re:Good for Enterprise (Score:5, Informative)

      by Bogtha ( 906264 ) on Thursday May 31, 2012 @02:50PM (#40170553)

      One of my clients attempted to use Good for secure email on iOS last year. They were entirely unresponsive to even the slightest technical queries and their stuff was incompatible with other apps. Also, parent comment sounds like spam.

    • Re: (Score:3)

      by narcc ( 412956 )

      Good can't do half of what RIM's management software can do. Their new Fusion software can also manage other platforms in addition to BlackBerries -- including iOS and Android. Good is okay, but it doesn't compare to RIM's best-in-class tools.

  • While trolling around my Galaxy Nexus I found the ability to encrypt it (not using it though). At the least that should protect data on the phone, surely you can find more details about that feature on the intertubes.

    Calls are already "secure" to a point but if you need even more security then perhaps Skype?

    text ... I'll leave that to others

  • good luck (Score:1)

    by Anonymous Coward

    my brief foray with android showed me that pretty much every app wants access to everything on the phone, including phone-home capability.

    • Re:good luck (Score:5, Insightful)

      by X0563511 ( 793323 ) on Thursday May 31, 2012 @03:21PM (#40171043) Homepage Journal

      Blame the security "roles" not the app developers.

      Want your app to detect if you're on a call, so it doesn't blow your eardrum out with an alert tone?

      Well, then you need "Access to Phone State / Identity" ... just for an example.

  • RIM/Blackberry (Score:5, Insightful)

    by alphax45 ( 675119 ) <kyle.alfred@nOSPAM.gmail.com> on Thursday May 31, 2012 @02:32PM (#40170235)
    You basically described the RIM/Blackberry use case; why not use them? The Bold 9900 is actually a nice phone.

    • I guess mostly this [google.com]

      days numbered...

      • Stock price or price-per-share does not indicate nor does it necessarily correlate with the health of a company.

        Investing 101, man. Come on.

    • 100% agree.
      The security of a BES/BB [blackberry.com] combination cannot be equaled by any current handset/OS (Unless the NSA/CIA/etc. have a secret one nobody knows about). If you must use Android then RIM has a solution [blackberry.com] for that as well.

  • Android isn't the platform for this (Score:1)

    by Anonymous Coward

    Unfortunately I am of the opinion that Android is NOT the platform for this (I use Android for my personal phone). It doesn't support it and as you see you need to use third-party applications to even make it work. Even if you could trust those third-parties, now how do you push updates to your reps? The answer is you don't. There are just too many hoops to jump through for a business where security is a "major consideration." I'd recommend Blackberry but it seems RIM could be going under any day. iOS is pr

    • Re:Android isn't the platform for this (Score:4, Insightful)

      by narcc ( 412956 ) on Thursday May 31, 2012 @03:38PM (#40171337) Journal

      I'm not worried about RIM going under. They've been supposedly dying for years, but they just now posted their first quarterly loss. (Even with non-competitive handsets, they were still profitable. The 9900 is amazing, but you get my meaning.) Their customer base is growing and they've got plenty of cash on hand. They've got a fantastic suite of new development tools, best-in-class new remote management software, business friendly features like Balance, and a new operating system that is, by any metric, a cut above the rest Their app library is also growing like crazy and they're doing a fantastic job of recruiting new developers with a fantastic and varied suite of development tools. The handsets out this fall running their new OS look to be exceptionally high-end, with a brilliant UI.

      RIM is hardly dying. They're a popular whipping-boy, but there are other companies doing far worse than RIM that don't get the same media bashing. When is the last time you heard that Sony is dying? They're worse off than RIM, and don't appear to have a strategy moving forward.

      RIM is in no danger of "going under any day". That's been the line everyone's been chanting for the past year or so, sure, but that whole time their customer base was growing at an alarming rate and they were posting profits every quarter.

  • Sounds like a job for... (Score:5, Informative)

    by a90Tj2P7 ( 1533853 ) on Thursday May 31, 2012 @02:34PM (#40170289)
    ... Blackberry. Aside from encrypting phone calls themselves, everything you're asking to do is something even a basic Curve will do out of the box - encrypting the phone storage and SD card, requiring a password to install apps. And that's without using any enterprise tools to manage the devices and security policies across the board, remotely.

  • Rock, meet hard place. (Score:3, Insightful)

    by Anonymous Coward on Thursday May 31, 2012 @02:36PM (#40170325)

    Pretty much sounds like you need a blackberry. Only they offer what you describe.
    Trouble is, blackberry phones are crap, BES is crap, the blackberry network is crap, and the blackberry company (RIM) is circling the drain.

    Turns out the infrastructure you need for your idea of a "secure" phone is more trouble than it's worth. Most companies have come to the realization that security is in fact a social and policy issue and much less a technological one. Just get good quality bog standard smart phones and create a policy that minimizes risk.

    That said, iphones are officially supported activesync devices and will respect activesync security policies set by an exchange server. You can remote wipe them. (Funny thing - Winphone7's activesync support is provisional and not recommended for an enterprise environment - Microsoft's words!)

  • Unless you're a phone manufacturer... (Score:3)

    by idontgno ( 624372 ) on Thursday May 31, 2012 @02:36PM (#40170329) Journal

    there's nothing you can do to a phone that a savvy user can't also do (or undo).

    And if you are a phone manufacturer, (A) it's easy to more-or-less do what you're saying, and (B) there will still be people to can find work-arounds to break out of the lockdown.

    The only reason I mention this is that Android has an energetic modding community, in spite of platform security built into some of these. (Locked bootloaders, S-ON partitions, etc.)

    Just using your "for example" as an example... if you can put flash Cyanogenmod onto the phone, your users can flash a completely different ROM and defeat a lot of the things you want to do. The tools you would use are available to anyone, and if you try to deny your users root (for instance), there are plenty of root exploits available to break that jail.

    In general, I think smartphones are too much general-purpose computers to really secure in the static way you're thinking about.

    As to the (perhaps more weighty) matters like all-storage encryption, I have never seen a good answer. Anything you could install as an app would probably be too shallow (i.e., not effective before booting). In fact, I don't know if the standard Android Linux kernels are amenable to that; you'd need a custom bootloader or 2nd stage, and I haven't seen those specifically tailored for storage decryption.

    I dunno. Sounds like you have a challenge ahead of you.

  • Too expensive? (Score:5, Insightful)

    by hawguy ( 1600213 ) on Thursday May 31, 2012 @02:37PM (#40170333)

    I know that Boeing is producing a secure phone, which is no doubt good — but probably too expensive for us

    If a secure, off the shelf phone is too expensive for you, you probably don't have the resources to build a secure phone yourself. Even the experts have trouble getting security right, an amateur will unknowingly leave big gaping holes.

    That said, Android ICS will do full filesystem encryption, make sure you use a secure passphrase and not a 4 digit PIN. Use SSL to talk to your email server to keep that traffic from being snooped. Don't use SMS's.

    Do you really need to encrypt your phone calls? Stick with a CDMA provider (supposedly it's trivial to hack GSM, but I believe CDMA is still relatively safe) and your calls are safe from all but the most determined (and well funded) eavesdropper. Unless you're worried about the US Government doing the eavesdropping, they'll just tap the call on the Telco side, so you need end-to-end encryption to protect against that.

    Skype reportedly encrypts skype-to-skype calls.

    But really, unless you're doing top-secret government work, your phone is the least of your worries. If the information is valuable, it's much easier to pay an employee to leak it than to steal your phone and hope to find the data stored on the phone. And if you are doing top-secret government work, a home-brew solution isn't going to meet the federal standards you'll be required to meet.

    • Re: (Score:2)

      by wkk2 ( 808881 )

      I suspect that no off the shelf product is secure from the network side. The hardware needs to have two independent blocks: a communications module and a application module. The two need to be linked with a well defined API so that the communications module can't change the application code and there is a good point for an audit. There are probably regulatory issues like GPS to emergency services, not being able to hang up an emergency call, etc. You need to be able to load the application code from a s

    • Even the experts have trouble getting security right, an amateur will unknowingly leave big gaping holes...But really, unless you're doing top-secret government work, your phone is the least of your worries.

      Something about the OP's question bothered me, and this helped me put my finger on it. I think one of the big rules of security should be: don't trust your security. There's something about the question that sniffs of "How do I make my phones so full-proof secure that I don't need to worry about them anymore?" The first part of the answer has to be, if it were that easy, then we'd all have perfectly secure phones and you wouldn't be asking the question.

      Encrypting calls and network traffic are probably n

  • Why Android? (Score:3)

    by scream at the sky ( 989144 ) on Thursday May 31, 2012 @02:39PM (#40170379) Homepage

    Just a question, but why Android?

    If you indeed NEED the security (I do for work, which is why I have a BlackBerry) why not just go the tried and true route of BlackBerry? Security is built in, everything except SMS (to my knowledge) can be encrypted, and you don't have to worry about updates from a 3rd party firmware (CM) breaking your apps or security model.

    Other things I LOVE about my BlackBerry...

    • Every key is a speed dial, I have about 20 of them mapped to the people I call the most. Very intuitive.
    • The keyboard is wonderful of hammering out mid to long emails. Swype helps, but I still find the keyboard faster.
    • Kick Ass Speaker Phone.
    • Full day battery life. Don't underestimate this.
    • It's easier to decipher who an email comes from, as it uses the same display info as my phone book does. On anything that uses active sync, my email is addressed in the same format as the Exchange server, which means every shows in my list as come from "Lastname, Firstname (EMPLOYEE#)" On my Berry, is shows as "Dad" or "Jeff (Regional)" instead. This is invaluable, as I can name people in my phone book in regards to my relationship with them, and I don't have to go digging through the exchange directory to find out what a persons job title is if I only correspond with them twice a year, and have forgotten who they are."
    • You can encrypt the device, as well as any memory cards.

    This is a sincere question. I carry two devices (BB 9900 for work, and a CM9 rom'd SGS2 for my personal phone) and I personally cannot stand the exchange email client on Android, it just seems slow and clunky, and CM9 helped a little bit, but not much. Use the right tool for the job, instead of trying to shoehorn a tool into the job you want it to do.

    • Pre-QNX BB was pretty secure... but with the whole rewrite, there is absolutely no possible way a device with that much code changed and that little use so far can be secure. I justify it above.

  • I would also say Blackberry, others have covered that angle well though...

    But why are you not considering an iPhone? Storage on the device is hardware encrypted, and can be wiped remotely. You cannot have people using un-secured SD cards with it.

    There's nothing you can do to secure SMS since that's a carrier level thing, but you can use any number of secured messaging applications.

    But really the biggest red flag I see is - you claim to be worried about security but then are trying to base a solution on th

  • Weak spec: Secure from what while doing what? (Score:5, Informative)

    by Fubari ( 196373 ) on Thursday May 31, 2012 @02:45PM (#40170489)
    You spec could honestly be stronger.
    What threats do you want to secure against? What scenarios do you want to avoid? Do you want to ensure against virus protection? Lost devices? (e.g. oh noes! our client list is on wikileaks!) Locking down data?
    For bonus points, what are the top three things your "reps" need to do?
    Just make calls? Or do texting? Or access web mail? Or...?
    And how many "reps" are there today? How many will there be next year?
    And what is your logistics model? Everybody at the same physical workplace? Distributed "virtual" office? Different countries? Different languages?
    Does your phone need to integrate with any of your workflow software?

    Try writing up five or six hundred words on the above to enhance your question - I'm sure you'll get some useful advice if you do that.

    • key is - are you going to allow non-default apps. If you allow appstore, what policies will you have in place? Can they install Girls Around Me for example? porn? etc

    • No, because then we'll say he's incompetent for asking slashdot to do his job for him, rather than our telling him he's incompetent because his spec is incomplete.

  • MobileIron (Score:3)

    by gregthebunny ( 1502041 ) on Thursday May 31, 2012 @02:47PM (#40170519) Journal

    I'm surprised I'm the only one suggesting this: Android Management [mobileiron.com]

    Phone calls are already encrypted. Text messages stored on the phone will be encrypted if the phone's system storage is also encrypted. Data traffic can be encrypted by forcing the use of VPN back to the company's local network (and as such, web filtering, etc. also applied).

  • This is the first question you need to answer, most likely the answer is the latter.

  • BB (Score:5, Informative)

    by Corson ( 746347 ) on Thursday May 31, 2012 @02:57PM (#40170675)
    There is a... um, little known company, don't know if you ever heard of it, called Research in Motion, that has been making security on their smartphones their main priority SINCE 1999.

  • I was thinking of maybe installing Cyanogenmod onto something, using a permissions management app to try and lock down some backdoors and searching out a trustworthy text and phone encryption app. Any good ideas out there?

    Custom-rolled solutions like this are a bad idea, and from a practical standpoint will likely result in less security going forward. Do you just have too much free time on your hands?

    This is a problem that's largely been solved.

  • use encryption for texting and phone calls.

    I can't recommend or not recommend but http://www.koolspan.com/ [koolspan.com] offers a product to do this. Otherwise Nokia has been doing it for 8 years though with Symbian not Android.

  • How do you know anything?

    And just a heads up, your company and it's information isn't nearly as important as you think it is and probably doesn't necessitate the need for any of this.

  • Blackberry is the right choice (Score:3, Informative)

    by juniorkindergarten ( 662101 ) on Thursday May 31, 2012 @03:51PM (#40171543)
    The combination of Blackberry and BES is the correct choice if you want a secure enterprise solution. With a BES server you have complete control over the phones. Policies allow logging of everything that the phone does, including if you want all incoming and outgoing text messages, push and pull apps and calling restrictions.
    The difference between consumer and enterprise blackberry is that the BES server has a secure key that you create and is unknown to blackberry, bis is controlled by blackberry and is snoopable by governments.
    I've found that the battery life is better on a blackberry, but the browser isnt the greatest, but has improved in the newest models. Another thing to keep in mind is the battery is field swappable, so if the battery wears out, YOU can switch it out, or carry a spare.
    Blackberry made the mistake of getting into consumer phones, but for enterprise situations, blackberry is the best way to go.

  • Android + BlackBerry Universal Device Service? (Score:2, Informative)

    by Anonymous Coward

    Your use case and focus on security really suggests that BlackBerry would be the best bet, but if you are focused on finding a way to securely deploy Android devices, but still maintain some security, take a look at the BlackBerry Universal Device Service product as an MDM solution:

    Feature Checklist: http://ca.blackberry.com/content/dam/blackBerry/pdf/brochure/northAmerica/english/BlackBerryMobileFusion,UniversalDeviceServiceFeatureChecklist-1.pdf

    Details: http://us.blackberry.com/business/software/mobilef

  • Don't Root it (Score:2, Insightful)

    by CapitalOrange ( 1552105 )
    Virtually all the malware (and there is some drive by stuff happening) attacks people with rooted phones, so installing even a secure "ROM" is probably the worst thing you can do for security. By looking for software that has gone through the common criteria (assuming that still exists or another similar certification process) you will have some reassurances that it was designed in a secure manner. I would also look for something using other government standards, like FIPS 140-2.

    • The way the "common criteria" are defined, you need to be an accountant or a logician to figure out just what feature set they claim a high security on. I usually wasl "would it meet B2?" If they can't answer, it won't (;-))

      --dave (and yes, on good days I am a logician) c-b
      B2, from the Orange Book, is an old military standard, approximately what SELinux meets. C means crappy, and there were a very few people who got an A

  • Without full disclosure on the OS, the source, and hardware you can't guarantee its secure.

    I am guessing here, but it seems to me cell phones are designed from the ground up to be insecure.

  • Buying into the "Walled garden == Security" philosophy doesn't cut it because you have no way to VERIFY things haven't been tampered with. You just "believe" they haven't been. Unless you jail break/root you can't be sure because you have no access. That makes it just as un-trustworthy as a trac-fone you found in the gutter. You might as well just use cyanogen, root it, get an sha1sum of everything on the device and have a way to track changes. Feeding Apple all your $$ while drinking all their "walled gar

  • Enterproid http://www.divide.com/ [divide.com] mobile device management is a service that costs $60/device/year that creates a secured remotely wipe-able sandbox on Android. They also submitted their app to the Apple store so it should be appearing soon for iPhone's.

    FYI, they are working with Fixmo to be Common Access Card compliant for NSA standards...

  • http://www.whispersys.com/ [whispersys.com]

    This may or may not be what you're looking for... not all of their offerings appear to be open source.

  • I am a system level developer who has implemented encryption technologies used in top-secret environments. Also I have worked on mobile device development at a system level for many years. I can't detail my credentials, but for as much as anyone else on Slashdot can be considered reliable, ... well you take it from there.

    1) So far as I know, the only "smart phone" OS which has been "properly audited" was the specific versions of BlackBerry OS which is used by Obama. This does not include all versions of Bla

Slashdot Top Deals

I tell them to turn to the study of mathematics, for it is only there that they might escape the lusts of the flesh. -- Thomas Mann, "The Magic Mountain"

Close