Recent compromised security on Android Bitcoin app transactions have highlighted the vulnerabilities of using 3rd party encryption technology on devices used for accessing corporate networks. The Bitcoin problem was related to using Android encryption which didn't generate truly random encryption keys but the problem could be repeated on other operating systems or other applications. We spoke to Mobile Helix about overcoming these vulnerabilities.
Having established good internal security procedures and secure network boundaries, many companies have struggled to maintain their secure posture as the network has become more nebulous and mobile devices have been introduced. The result has often been for corporations to have unwittingly surrendered control to third parties, whether these are cloud providers, mobile operating systems or app producers.
For securing network assets during remote access, two important technologies are authentication and encryption. Both data which is in motion and the data which remains at rest on the mobile device should be encrypted. All of this should be done whilst maintaining usability and productivity. Since such security technologies on the device or application can't be trusted, one way to achieve this is to partition corporate data and applications on the device and apply encryption to it in accordance with the company's technology and policy.
In this way, the integrity of corporate data and access is kept separate from all other data and applications which are on the device. As such, the company has no need to control what happens on a mobile endpoint other than what is used for corporate purposes. Software such as that provided by Mobile Helix creates a secure container on the device enabling the user to operate in a secure and isolated environment.
For trusted external apps or security features which are native to the phone, such as the new biometric fingerprint authentication module on iPhones, an interface to the secure environment can be created using an SDK.
The application is currently available for iOS and Android operating systems but will soon be rolled out to Windows Mobile environments as well.
By Jonathan Newell