by clicking on the page. A slider will appear, allowing you to adjust your zoom level. Return to the original size by clicking on the page again.
the page around when zoomed in by dragging it.
the zoom using the slider on the top right.
by clicking on the zoomed-in page.
by entering text in the search field and click on "In This Issue" or "All Issues" to search the current issue or the archive of back issues respectively.
by clicking on thumbnails to select pages, and then press the print button.
this publication and page.
displays a table of sections with thumbnails and descriptions.
displays thumbnails of every page in the issue. Click on a page to jump.
allows you to browse through every available issue.
GCN : December 2012
12 GCN DECEMBER 2012 • GCN.COM [BrieFing] NEWS ANALYSIS The adoption of mobile devices in the workplace has outstripped the ability of smart phones and tablets to support basic security features needed in trusted enterprise tools. As a result, government agencies are being forced to accept the security risks inherent in mobile devices because their workers expect to be able to use their own devices at work. Agencies also hope to improve productivity and save money, according to draft security guidelines from the National Institute of Standards and Technology. But these risks can be greater than those in tradi- tional desktop and laptop computers. "Current mobile devices lack the hardware-based roots of trust that are increasingly built into laptops and other types of hosts," the publication says. Smaller form factors and power require- ments have made the inclusion of secu- rity hardware components such as the Trusted Platform Module impractical. TPM is a set of speci cations from the Trusted Computing Group for imple- menting cryptography in silicon, which can be used to support data protection, communications security, strong authen- tication, identity management, network access control and nonrepudiation. NIST does not specify technologies such as TPM for mobile devices, but lays out minimum requirements for creat- ing trusted mobile platforms in Special Publication 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices. The guidelines are intended to acceler- ate industry's implementation of these foundational components and provide a baseline of security technologies across a wide range of devices. They are aimed at mobile operating system vendors, de- vice manufacturers and security software vendors, as well as carriers and applica- tion developers, with the ultimate aim of improving the security of devices issued to agency workers as well as employee- owned devices. Despite their popularity and potential bene ts, the public sector has been slow to fully embrace employees' use of mobile devices because of security concerns. A number of agencies have established pilot programs for bringing them into the workplace, and some have developed policies for use and man- agement of the devices. NIST has also produced a paper, Guidelines for Manag- ing and Securing Mobile Devices in the Enterprise, but the underlying problem of what NIST calls "fundamental security primitives" needed in the devices must be solved by industry, This requires implementing roots of trust --- functions that are secure by design and provide basic security functionality --- preferably in hardware, says NIST. • What does mobile device security look like? 3 CHALLENGES, 3 SOLUTIONS TO MOBILE DEVICE DEVELOPMENT Three basic challenges need to be addressed in future mobile device development, according to NIST. They are: 1. Device integrity: The ability of a tablet or phone to provide information about its configura- tion, health and operating status that can be verified by the organization whose information is being accessed. 2. Isolation: The ability to keep personal data and organization information and processes separate from each other. 3. Protected storage: The ability to keep data safe using cryptography and restricting access to information on the device. To provide these capabilities, the next generation of mobile devices will need a set "foundational security elements that can be leveraged by the device, OS and applications," NIST says in the guidelines The guidelines provide a sample architecture for implementing these fundamentals in the device. These components are: 1. Roots of trust. These are security primitives composed of hardware, firmware and/or soft- ware that provide a set of trusted, security-critical functions for storage of keying material for cryptography and authentication; a protected engine for verification of digital signatures; device integrity; interfacing with reporting tools; and measurements supporting integrity assertions. 2. An application programming interface to expose these roots of trust to the device and oper- ating system, to establish a chain of trust for user applications. 3. A policy enforcement engine to enable the processing, maintenance and management of polices on the mobile device for the control and protection of information. --- William Jackson