Recently, I've engaged in multiple conversations inside IBM with our research and product teams about the role that cloud plays in enabling and securing enterprises. While most of us would acknowledge that an enterprise cloud strategy complements and enables a mobile workforce, most security professionals view the use of cloud functions across mobile devices as increasing, rather than decreasing, security risk. This is certainly true when we apply common file-system-based cloud applications that allow broad, unmanaged file synchronization across mobile devices. Now, I am going to think out loud here about this issue. So let me take you through a cloud approach that would actually increase the enterprise's control over its data and decrease risk.
Let’s start by envisioning a cloud with CVS (concurrent versioning system) capability to provide the enterprise with policy control over what, how, and when data is synchronized between devices and the cloud. Then, add some DRM (digital rights management) capability to control file access, transfer, and modification at the file level.
OK, here’s how such a cloud might work… Employees park their files in the cloud as usual (probably using a local application) except that during the initial parking, the file is associated with a digital key pair that allows the file to be validated across any device where it might become synchronized. The CVS attributes of the cloud could be set to enable the enterprise to control which devices are allowed to hold a version of a given file. These attributes might vary with the data classification of the specific cloud, if desired, but essentially, it would work in much the same way that a source code CVS works today. A file is checked out and locked so that another device cannot access or change it. In this way, the enterprise directly controls the spread of its data, which is often identified as a common concern with mobile clouds and synchronization. A typical cloud without such controls eventually ends up with data files spread across multiple devices with no ability to expire or manage them. The enterprise might further allow access to a given checked-out file if the access occurs within an acceptable time window, such as 24 or 48 hours, to accommodate the use-case of the mobile warrior who needs to access or modify a file without the network connectivity required to validate the file keys.
Using this approach, the enterprise could expire access to synchronized remote files at any time for any device where the files were synchronized. This approach could be used to address various use cases, such as lost or stolen devices containing enterprise data and the off-boarding of exiting employees holding enterprise data.
Now, imagine adding digital rights functionality together with a device-based application that can encrypt files at rest. This would enable encryption of individual files, or groups of application-related files, on a device and allow the enterprise to sidestep the whole issue of full device encryption of personally owned devices.
In the ideal circumstance, the cloud would also tie into the enterprise’s device management infrastructure to enforce device configuration policy across any accessing device. (See my previous blog postings on converged device management.)
OK, so I realize that I have been thinking out loud. This approach has its own challenges on the road to becoming a real solution that an enterprise could construct or purchase as a service. But if we could achieve a solution like this, it would improve both mobile enablement and security, allowing both employees and enterprises to win.
What do you think? I invite you to submit your thoughts here.
Stay up to date with the latest news from the Institute for Advanced Security by joining the community, following us on Twitter, and subscribing to the Institute expert blog. We love to share content from our members so please click the pencil icon to submit your content ideas!