With the convergence of information technology (IT) and communications and the emergence of innovative technologies, end-user devices and applications, the pace of change in enterprises is accelerating. This acceleration, combined with increasing end-user mobility and more demanding regulatory requirements, makes managing enterprise security risks a considerable challenge.

 

This article focuses on the increase in enterprise mobility and securing mobile users’ communications.

 

The wide adoption of mobility has benefits for both end users and enterprises. It enables unique productivity gains with richer communications capabilities, more openness to the applications world and even new business models. However, with these benefits comes increased exposure and risk, including:

 

·         Risk related to the protection of sensitive data stored on mobile end-user devices, such as laptops and smartphones

·         Risk related to the multiplicity of network interfaces, including Wi-Fi, 3G and WiMAX (News - Alert), that mobile end users access

 

The user-aware network security edge mechanisms cover remote VPN connections but are no longer sufficient outside the corporate perimeter. For example, when a mobile laptop leaves the enterprise, it creates a mobile blind spot. The IT department loses visibility of the device and, as a result, loses its ability to protect either the device or its sensitive data. In this blind spot, corporate resources cannot be protected by a simple perimeter security approach because mobile devices can connect to the public Internet using network interfaces that are no longer subject to the security controls of the IT organization.

 

Uncontrolled connection to any untrusted network, such as the Internet, can compromise the mobile device. For example, malicious software may run undisturbed for several hours or even days before the IT administrator detects it and applies the necessary safety measures. Most critically, an infected device can “leak” sensitive information onto the public Internet, creating a nightmare scenario for the enterprise. Furthermore, proprietary sensitive information may be at risk in case of loss or theft with the potential for major financial liabilities to the enterprise. Regular software updates and data backups provide a first level of defense against some of these threats but are insufficient.

 

IT organizations need a way to address these challenges while continuing to capitalize on the benefits provided by mobility. A complete protection solution should include:

 

·         Always-on protection of device interfaces

·         Always-on protection of sensitive data, including a remote kill capability

·         Always-on IT protection mechanisms, such as patch management, antivirus updates and backups

 

Putting control back in the hands of IT organizations can be achieved y embedding in each device an always-available, secure, service delivery platform for enterprise remote access and device management. The platform can have different form factors — Personal Computer Memory Card Industry Association (PCMCIA) data card or Universal Serial Bus (USB), for example — depending on the interfaces available on the mobile device.

 

Because this type of platform is powered by battery, it can provide always-on services that, when combined with a 3G interface, greatly reduce the mobile blind spot. By implementing a root of trust for the mobile device, the platform can store encryption keys for maximum protection and remote kill capabilities, patch downloads and antivirus updates. It also ensures a continuous VPN connection to the enterprise, so the device is protected by corporate security measures at all times.

 

Finally, this type of service delivery platform solution can improve the end-user experience by automatically creating VPN connections, selecting the appropriate and most efficient network interface, pre-fetching patch and antivirus updates and creating backups (even when device is powered off) in order to avoid frustrating, abrupt degradations of computing or network capacity. The implementation of a secure, always-on service platform in mobile devices puts the control back in the hands of the IT organization and helps enable 100 percent IT security policy compliance for mobile users anytime, anywhere, even when the device is powered off.

 

Management is a key component of any user-centric approach — from identity to audit to incountry-specific policies and regulations. There are two key objectives that enterprises need to keep in mind at all times:

 

·         Simplicity – is security’s best friend. Although this fact has been stated often, it remains a challenge.

·         Reuse – offers a clear path to protect capital expenditures and contain operating expenditures.

 

Deployment of a security layer should maximize the existing architecture and ensure seamless integration with existing operational tasks and procedures. The latter will also increase simplicity by reducing training time and leveraging existing skill sets. One approach to achieve simplicity and maximize reuse of the existing environment is to centralize functions and converge security management and network management under a single framework whenever possible. The following describes three areas where this type of centralized approach can be applied.

 

It is good practice to use existing Authentication, Authorization and Accounting (AAA) standards and extend their use for all devices in a unique repository (desktops, laptops, IP phones, mobile handsets, for example). With this approach, Remote Authentication Dial-In User Service (RADIUS) can be used for all new devices. This allows for easy overlay deployment within the existing, secure architecture. It also helps ensure seamless deployment of Layer 2 authentication methods, such as IEEE (News - Alert) 802.1X for IP phones.

 

All user policies must be integrated and federated with the directories and systems already being used to manage user identities in the enterprise. A user-based profiles approach allows for security management and network management under a common framework and enables a set of attributes and user roles to be mapped with optimal abstraction. Users are defined in reference to roles (employee/engineering, contractor/finance, visitor/briefing center, for example) as well as network criteria (subnets, MAC range, VLAN, for example). This approach, combined with definition of resources, allows for powerful, logical association between users and network resources, such as bandwidth and Quality of Service (QoS) provisioning, and access controls, such as allow or deny. The centralized point of configuration is then propagated to the whole network.

 

Enterprises also need to custom-define their quarantine rules and remain fully functional in a multivendor environment. The advantage goes beyond provisioning and includes operational procedures, such as central isolation and remediation of policy violators down to port, device and user, anywhere on the network — wired, wireless or remote. Interaction of network devices with a centralized policy management system facilitates deployment of quarantine mechanisms against the faulty user and contains attacks at the edge, and everywhere in the network.

 

Full visibility is fundamental to detect suspicious traffic or activities and provide actionable information for better control. To avoid managing an overwhelming volume of raw data, monitoring and logging systems should support a per-user/role traffic classification with both real-time and historical data, including applications usage. In addition, for efficiency in operational procedures, the solutions should provide a dashboard that summarizes all collected security statuses and provides the ability to view and audit key user data and drill down to low-level events if necessary. Finally, two properties will protect the evolution of the monitoring and logging platform:

 

·         Open interfaces for event collection and correlation with support for a complex ecosystem (third parties) as audit and compliance requirements evolve

·         Hierarchical implementation for scaling to support growth of the network and its user base The benefits will be fully realized with a user-friendly interface that allows IT staff to understand the overall security status at a glance and that makes it easy to generate customizable reports for auditing purposes.

 

The user-centric security approach described in this paper allows Dynamic Enterprises to support the evolution of everyday end-user realities and quickly adapt to the changing competitive landscape by implementing:

 

·         Reinforced security at the edges of the extended corporate network where mobile end users are likely to connect

·         Enhanced mobile user security with dedicated security functions embedded in the communications devices they rely on

·         Simplified and user-centric management of security with centralized functions, converged

·         security management and network management under a unique framework whenever possible

 

There are several advantages to this structured and straightforward approach to user-centric security:

 

·         Improved productivity as a result of automated security functions and reduced end-user involvement

·         Regulatory compliance facilitated by bringing key security functions closer to end users and the devices they carry

·         Lower total cost of ownership by unifying security functions and operational procedures

 

Alcatel-Lucent (News - Alert) is committed to user-centric security and offers a full portfolio of solutions and multivendor professional services to support Dynamic Enterprises as they evolve their risk management strategies. By leveraging innovative technologies from Bell Labs and services teams with a global presence, Alcatel-Lucent delivers always-on security solutions that meet the needs of enterprises, small and large, in any industry.

 

For more information about the Alcatel-Lucent user-centric approach to security, please go to http://www1.alcatel-lucent.com/enterprise/en/solutions/security/index.html

 

To find out more about the Alcatel-Lucent user-centric security product portfolio, please go to http://www1.alcatel-lucent.com/enterprise/en/solutions/security/security_portfolio.htm