SearchNetworking: NCP Explains Mobile Device Management v. Enterprise Application Stores

*Editor’s Note: This column originally appeared in TechTarget’s SearchNetworking.com 

By Rainer Enders, CTO, Americas, NCP engineering

Both systems can enhance mobile device security at different levels. Typically, a mobile device management system provides for standard device management features such as configuration management, backup capabilities and remote wipe, along with logging and reporting. The enterprise application store provides for the capability to safely test and deploy chosen applications. As such, the company has greater control over the mobile device application environment. It can ensure the integrity and security of the applications as well as deliver a better user experience along with greater productivity. Meanwhile, enterprise application stores can be a particular advantage for heterogeneous device platforms.

 

Automated Mobile Security, Part 4

The following is the fourth, and final, post in a series of excerpts from NCP engineering‘s technical white paper, Automated Mobile Security: Leveraging Trusted Network Connect (TNC) IF-MAP to provide automated security for company networks and mobile devices. Part one of the series can be found here; part two of the series can be found here and part three of the series can be found here.

REAL TIME ENFORCEMENT USING IF-MAP

This example demo uses several of the ESUKOM developed IF-MAP compatible products. All open source products are available on www.esukom.de. The NCP VPN Server is still beta and not available on the web page, but can be made available for test environments by contacting tcg@ncp-e.com.

The following image shows a basic description of the network the demo uses:

The network is separated into an unsecure network that can be accessed via WiFi and an internal network, which requires a VPN connection to gain access. There is no direct access from the unsecure network to the internal network even though two components reside in both networks.

An Android device connects to the WiFi access point and receives a lease from an IF-MAP capable ISC DHCP Server. The IF-MAP Client will publish the lease information into the MAP database. The DHCP server has the information about which MAC address is connected to which IP address.

The IF-MAP graph will look like this after the information has been published:

Now, to gain access to the internal network, the device has to establish a VPN connection. The VPN Server will publish information about the username used for the VPN connection, the device that has authenticated the request and what internal IP address the connection received, and will then link that information to the already-available information published by the DHCP server.

The IF-MAP app on the android phone is then able to publish information about the device, for example, the IMEI or if bluetooth is enabled. Additionally, if a GPS signal is available, the client can publish information about its current location. Besides storing information, the VPN Server is able to react on events published into the IF-MAP server by an intrusion detection system like snort.

The VPN Server offers two possible reactions to an event published: Quarantine or Disconnect a device. The VPN Server can react to a specific kind of event or it can react on a magnitude value to each event it is assigned. The magnitude has a potential spectrum of 0 to 100, where 100 is the most severe event. A less severe event could restrict the access to an important file server for example, while a critical event could disconnect the client and maybe even lock the account for further investigation by an administrator.

For additional information about real time enforcement using IF-MAP, including additional graphics, see the whitepaper.

Automated Mobile Security, Part 3

The following is the third post in a series of excerpts from NCP engineering‘s technical white paper, Automated Mobile Security: Leveraging Trusted Network Connect (TNC) IF-MAP to provide automated security for company networks and mobile devices. Part one of the series can be found here; part two of the series can be found here.

WHAT IS ESUKOM ?

The ESUKOM research project aims at leveraging IF-MAP to provide security in mobile device environments. The project will bring IF-MAP support to several key open source products like Snort (intrusion detection), IPtables (firewall), Nagios, FreeRADIUS and ISC DHCP server, to the products of two commercial vendors: NCP engineering (VPN software) and Mikado Soft (NAC solution) and provide an IF-MAP Android client. With this diversity of IF-MAP enabled components, we try to provide example configurations for eight key features, which are the ultimate goal of this research project.

More information about this project can be found at http://www.esukom.de

Now that ESUKOM has been explained, stay tuned for the next post that will explain Realtime Enforcement Using IF-MAP. Also, for more information on the ESUKOM research project and NCP engineering’s role within it, see our three-part Q&A on the topic here.

Automated Mobile Security, Part 2

The following is the second post in a series of excerpts from NCP engineering‘s technical white paper, Automated Mobile Security: Leveraging Trusted Network Connect (TNC) IF-MAP to provide automated security for company networks and mobile devices. Part one of the series can be found here.

WHAT IS IF-MAP ?

IF-MAP stands for InterFace for Metadata Access Points. You can think of IF-MAP as a central database for your IT-systems where they can store information or retrieve information from to get a real-time representation of the status of your network.

There are three basic functionalities an IF-MAP enabled component can do:
► Publish: Clients can store information for other clients to see
► Search: Clients can search for published data using search patterns
► Subscribe: Clients can receive notification when other clients publish new data

To store information in the MAP there are two different data types available: Identifiers and Metadata. Identifiers act as “root hub” for information stored in the IF-MAP. There are only 5 identifiers available: Identity, IP address, MAC address, Access Request and Device.  The other type of data is metadata, which has to be linked to at least one identifier but can also connect two identifiers. Each client has to authenticate itself securely to the MAP Server either with username and password or certificate based authentication. All data is transmitted safely with SSL encryption.

Now that IF-MAP has been explained, stay tuned for the next post that dives into ESUKOM in more detail. Also, for more information on the ESUKOM research project and NCP engineering’s role within it, see our three-part Q&A on the topic here.