An identity-based model for dealing with BYOD

1. BYOD- it's an Identity Thing
BYOD
Paul Madsen (@pmadsen)
Senior Technical Architect
It's anPing Identity thing
'identity'

2. A little bit about me

3. BYOD
WHAT'S THE BIG DEAL?

5. B Y O D
R B Y W D
R
I O N E
O
N U U V
GG R I
H C
T E
S

6. Context
COIT BYOD
Social
will.i.am
keynoting
Cloudforce
App
stores Personal
Cloud

7. [reputable analyst
firm] says [X%] of
Fortune 500 will
confront BYOD by
[201Y]

8. So why
allow it?

9. SHadow IT
HAPPENS

10. Employee productivity as a function of time
mobile
productivity
Traditional
9-5
Sun Mon Tue Wed Thur Fri Sat

11. Fundamental challenge
A single
device
must
support
two
'masters'

12. Err no….

13. Choices
• Mobile Device Management (MDM) applies
enterprise policy to the device as a whole
– PIN, wipe, VPN etc
• Mobile Application Management (MAM)
focuses on the business apps ON the device
– App store, security added onto binaries
either through SDK or 'wrapping'

14. Granularity

15. BYOD Balancing Act
Standards
Security
Enablement
Privacy

16. Balancing Act
Productivity

18. Productivity vs time
ideal reality
'Now what was my
password again??'
productivity
'Whoa, I can still
login!'
'Well I guess I can
play Angry Birds until
IT sets me up'
hired fired
time

19. GTD Requirements
1. Initial GTD - Quickly get new
employees up and running with the
applications their role demands
2. Ongoing GTD - Provide employees
single sign on experience in day to
day work
3. Stop GTD - Reduce/remove
permissions when necessary

20. Balancing Act
Privacy

21. Privacy
the right to be
let alone—
the most
comprehen
sive of
rights and
the right
Louis Dembitz Brandeis most

22. Privacy
Granularity of IT control

23. Partioning for privacy
1. Divide the phone in
'half' – one side for
business applications &
data, another for
personal
2. IT's mandate is to
manage & secure the
apps & data on the
business side
3. IT has no mandate
(nor, hopefully, desire)

24. Balancing Act
Security

25. IT'S NOT ABOUT THE DEVICE

26. It's the data

27. Protecting the data
1. Ensure that user/app can access only appropriate
data
– Authorization based on role
2. Protect data in transit
– SSL IDM
3. Protect data on device
– PIN, Encryption
4. Remove access to data when appropriate MAM
– Wipe stored data (or keys)
– Revoke access to fresh data
MDM

28. MIM?

29. MDM – No screen capture
MAM – No screen capture
when in email app
MIM – No screen capture
for this document

30. Balancing Act
Standards

31. Why standards?
• Framework implies interplay between
– Enterprise IdM
– MAM architecture
• MAM servers
• MAM agent
– Applications
• On-prem
• SaaS

32. Enterprise
Components
SaaS SaaS
1 2
MAM
Device
MAM
Browser SaaS1 SaaS2

33. Standards
• SCIM (System for Cross-Domain Identity
Management) to provision identities as
necessary to MAM and SaaS providers
• SAML (Security Assertion Markup
Language) to bridge enterprise identity to
MAM and SaaS providers
• OAuth to authorize MAM agents, and SaaS
native apps

34. Enterprise
Components
SCIM
SaaS SaaS
SCIM 1
SAMLMAM O
SCIM O A
SAML
A U
SAML O U T
A T H
U H
Device
MAMT
Browser H SaaS1 SaaS

35. Bob 'pursuing other ventures'
EnterpriseSCIM (delete)
SaaS SaaS
SCIM (delete) 1
MAM
SCIM (delete)
W
I
p
e
Device
MAM
Browser SaaS1 SaaS
wipe
wipe

36. Bob 'loses phone in cab'
EnterpriseSCIM (status=0)
SaaS SaaS
SCIM (status=0) 1
MAM
SCIM (status=0)
L
O
C
K
=
Device
Y
MAM
Browser SaaS1 SaaS

37. Application Provider
Enterprise
Application Provider
Application Provider
Device
Native app
Native app Native
Authz Native app
app Native
agent Native app
app Native
app

38. Wrapping up

39. R R
E
DE
S a S
Business T t T Personal
a
MAM
App
App
T
Policy o
k
Apps T
o e
k n
e s Identity
Identity
Corp Identity
n Identity
s
Tokens

40. Thank you
@paulmadsen

41. Summary
1. Divide device & leave employee personal data
alone
2. Provision apps via MAM based on employee
identity & roles into employee 'side'
3. Provision tokens to those apps via IdM based on
employee identity & roles
4. Apps use tokens on API calls to corresponding
Cloud