beyond mdm: the desktop/mobility convergence
TRANSCRIPT
BEYOND MDMTHE DESKTOP/MOBILITY CONVERGENCE
Mike Reed, Principal Strategist
IN THE BEGINNING… THERE WERE WORKGROUPS
• OS/2 - NETBIOS• WINDOWS FOR WORKGROUPS (REMEMBER NOVELL
NETWARE?)• WINDOWS NT (NT DOMAINS)• PRIMARILY PASSWORD-BASED SECURITY (NTLM,
NTLMV2)• * NOT COUNTING ALL THE VARIANTS OF CONFIG FILES
IN UNIX, LDAP/NFS, ETC.
DIRECTORY SERVICES BECOME THE NORM
• FOR MOST OF THE 2000’S, ACTIVE DIRECTORY BECAME THE DE FACTO DIRECTORY SERVICE
• AD HAD THE CONCEPT OF A DISTINCT MACHINE ACCOUNT AND A USER ACCOUNT WITH DIFFERENT APPLIED SECURITY FOR EACH
• AD ALLOWED FOR LOCAL MACHINE POLICY AS WELL AS DIRECTORY POLICY (GPO)
• MOST IMPORTANTLY, AD MOVED TO A BACKWARD—COMPATIBLE LDAP/X.500 AND KERBEROS (MIT) INFRASTRUCTURE
• MANAGEMENT IS TYPICALLY A COMBINATION OF DIRECTORY-BASED POLICY AND A LOCAL SECURITY AGENT
ALONG COMES APPLE (DESKTOP)
• STARTING WITH OS X, APPLE MOVES TO A PSEUDO-BSD (LINUX) OS ARCHITECTURE
• THIS ALLOWS FOR CONNECTIVITY WITH MANY WINDOWS/AD SERVICES, INCLUDING DIRECTORY SERVICES (LDAP) AND FILE SHARING (SMB, MOSTLY)
• MACS ENJOY THE ABILITY TO SHARE “EQUAL CITIZEN” STATUS ON THE NETWORK WITH WINDOWS MACHINES…
• ...EXCEPT FOR THAT PESKY GROUP POLICY/SECURITY THING. OS X USES SEVERAL TYPES OF LOCAL/NETWORK POLICY, TYPICALLY REQUIRING EITHER A SEPARATE MANAGEMENT INFRASTRUCTURE OR A LOCAL AGENT TO BRIDGE WINDOWS POLICY TO OS X
IN 2007, EVERYTHING CHANGES• APPLE LAUNCHES THE IPHONE IN 2007 USING IOS, AN
OS BASED ON OS X, WHICH IS A VARIANT OF BSD• IOS HAS NO CONCEPT OF “USER” IN THE OS – NO
BINDING TO A DIRECTORY OR PROVIDING LOGIN CREDENTIALS TO THE DEVICE
• OVER THE NEXT SEVERAL ITERATIONS OF IOS, APPLE ADDS IN MANAGEMENT API’S, SOME OF WHICH INCLUDE MOBILE DEVICE MANAGEMENT
• MDM PROVIDERS PRIMARILY USE A METHOD OF MAPPING USERS TO DEVICES USING AN AGENT AND CERTIFICATES (X.509)
• IN RECENT ITERATIONS OF IOS, APPLE INCLUDES THE ABILITY TO USE KERBEROS FOR USER AUTHENTICATION AT THE APPLICATION LEVEL (ALONG WITH OTHER METHODS OF SECURE ACCESS TO NETWORKS), BUT STILL NOT CONCEPT OF “USER”
ANDROID FOLLOWS SUIT
• ANDROID, OWNED BY GOOGLE, FOLLOWS SUIT.• WANT TO COMPARE VERSIONS (FOR ENTERPRISE
FEATURES?) – CURRENT ANDROID USUALLY SUPPORTS IOS -1, MEANING ANDROID IS TYPICALLY A VERSION BEHIND, ENTERPRISE FEATURE-WISE
• SOME VARIANTS OF ANDROID ARE BEGINNING TO FURTHER EXPLORE MULTI-USER AND ADVANCE THE CONCEPT OF USER, BUT MANAGEMENT FEATURES VARY (WILDLY) BY PLATFORM/PROVIDER
OS X 10.8+ AND WINDOWS 10
• BOTH APPLE AND MICROSOFT RECOGNIZED THAT PROFILE-BASED MANAGEMENT WAS SIMPLER TO CONFIGURE AND EASIER TO MANAGE AT SCALE AND STARTED BUILDING PROFILE-BASED MANAGEMENT INTO THEIR OS’ES
• OS X: SYSTEM PREFERENCES > PROFILES (ONLY VISIBLE WHEN A PROFILE IS APPLIED), MANAGED BY OS X SERVER AND PROFILE MANAGER OR VIA EMM
• WINDOWS 10: STILL SUPPORTS GPO AND WMI, BUT ALSO SUPPORTS “WORKPLACE” CONFIGURATION, E.G. EMM-BASED POLICIES AND CONFIGURATIONS
• WHAT ABOUT SURFACE PRO TABLETS? MOBILE OR DESKTOP?
WHERE DOES THIS LEAVE US?
• DESKTOP IS NOTHING MORE THAN A FORM FACTOR• EMM/PROFILE-BASED MANAGEMENT IS THE NEXT-
GENERATION MANAGEMENT APPROACH FOR DEVICE/LOCAL APP SECURITY
• CLOUD SERVICES ARE BROKERING THEIR OWN SECURITY (E.G. OFFICE365). CASB’S AND EMM PROVIDERS ARE GOING TO FIGHT FOR THE CLOUD ACCESS SECURITY MARKET
• APPLICATION-LEVEL SECURITY BECOMES KEY, WHICH MEANS IDENTITY IS A STRONG REQUIREMENT. NO MORE “BINDING TO ACTIVE DIRECTORY.”
WHAT SHOULD I DO NOW?
• EVALUATE YOUR IDENTITY MANAGEMENT SERVICE - THIS MAY BE LOCAL ACTIVE DIRECTORY TODAY. IT MOST LIKELY WILL NOT BE LOCAL ACTIVE DIRECTORY IN TWO YEARS.
• EVERY MAJOR CLOUD SERVICES PROVIDER IS FIGHTING TO BE YOUR IDENTITY PROVIDER. GOOGLE. MICROSOFT (AAD/O365). APPLE. AMAZON. SALESFORCE. OKTA. PING. THE LIST IS ENDLESS.
• SUPPORT FOR “SINGLE SIGN-ON” IS AN ABSOLUTE MUST FOR ANY NEW LOCAL OR CLOUD SOFTWARE/SERVICE YOU DEPLOY. ANYTHING USING LOCAL USER ACCOUNTS AS THE ONLY ACCESS MECHANISM IS ALREADY OBSOLETE.
WHAT SHOULD I DO NOW (CONT.)?• EMM PLAYERS HAVE AN ADVANTAGE OVER
TRADITIONAL DESKTOP MANAGEMENT PROVIDERS… TODAY. EACH ONE, BASED ON ITS HISTORY, OFFERS DIFFERENT APPROACHES.
• TALK TO YOUR EMM PROVIDER ABOUT THEIR SUPPORT FOR NEXT-GENERATION DESKTOP OS’ES
• TALK TO YOUR CURRENT DESKTOP MANAGEMENT PROVIDER ABOUT THEIR SUPPORT FOR PROFILE-BASED MANAGEMENT. HINT: THIS MAY BE MICROSOFT SCCM (AND LIKELY IS).
• IF YOU DON’T UNDERSTAND PKI & KERBEROS AND DON’T HAVE THEM DEPLOYED, START LEARNING NOW.
• IF YOU DON’T UNDERSTAND PROFILE-BASED MANAGEMENT AND DON’T HAVE EMM DEPLOYED, START EVALUATING NOW.
BRINGING IT ALL TOGETHER
• THE TECHNOLOGY IS MOVING TO PROFILE-BASED MANAGEMENT USING SINGLE SIGN-ON CREDENTIALS AS AN IDENTIFIER FOR DEVICE AND APPLICATION-LEVEL SECURITY
• THIS CHANGE, ESPECIALLY AS IT RELATES TO SSO, OFFERS UP SOME INTERESTING NEW METHODS TO BE MORE SECURE, ESPECIALLY FOR INTER-DEPARTMENTAL AND INTER-AGENCY INTERACTIONS
• THIS METHOD OF SECURE AUTHENTICATION AND AUTHORIZATION OFFERS A CHANCE FOR MORE SECURITY, NOT LESS, ESPECIALLY AS SERVICES MOVE TO CLOUD PROVIDERS
• MOVING FORWARD, “DESKTOP” IS A FORM FACTOR, NOT A DISTINCT PLATFORM OR OS
