To finish our discussion of securing data on unmanaged devices, let’s focus on three categories of apps designed for secure file access:

Sandboxed file browsers and mobile file gateways

While messaging apps generally do a good job of handling email, they don’t necessarily link into file servers or integrate into enterprise encryption. Secure file management apps skip messaging and focus on access to enterprise file repositories. They support the following core features:

• Use of either iOS Data Protection or their own embedded encryption.
• A secure connection to the file repository (which may require a VPN for remote access to internal sources).
• Support for the iOS document viewer to view supported document types (iWork, Microsoft Office, PDF, etc.).
• Authentication and authorization to enable or restrict access on a per-user, per-device basis.
• Ability to restrict or allow “Open In…” to control file movement to other apps.

There are a few different flavors. Most require server components or plugins to repositories like Microsoft SharePoint. If the tool doesn’t isolate documents by restricting the “Open In…” feature, it is not suitable for enterprise use.

• Sandboxed file browser: These allow connections to enterprise file shares using standard connections and store the downloaded documents in an encrypted container. Most use Data Protection rather than to their own encryption scheme. They are usually read-only, although some support annotation of PDF files.
• Sandboxed cloud file browser: Instead of relying on direct network connections to enterprise file stores, these apps access cloud storage repositories and are specific to their cloud service.
• Mobile file management gateway: This is a more refined extension of the sandboxed file browser. Rather than allowing access directly to file repositories, mobile devices connect to the gateway using a sandboxed app and are then given access to files through the gateway. These support more granular policies, monitoring, and directory integration. They often also support multiple mobile platforms (yes, there is a world outside Apple).
• Document management system extensions: These are similar to a mobile file management gateway, but instead of a separate server they run as plugins to an existing document management system. Users connect directly to the document management system (such as SharePoint) via the extension/plugin, which might be centrally managed.

Some of these tools support commenting and annotating files (usually restricted to PDFs) but we know expanded document editing is on the roadmap.

Sandboxed mobile file encryption apps

Mobile computing is one of the big drivers of cloud computing, and cloud storage is, in turn, expanding use of encryption. Encryption apps extend on the sandboxed file browser by integrating with enterprise encryption. They expand on the file browser by:

• Maintaining file and document isolation in the sandbox.
• Transparently decrypting files accessed by the app (when integrated into an enterprise encryption scheme and key management server).
• Accepting files from other apps via “Open In…” and keeping them encrypted in private storage, then enabling protected access to such files.
• Support for connections to common cloud storage platforms such as Box.net and Dropbox.

The big division in this category is between apps designed to open files passed to them by other applications, such as encrypted mail attachments, versus those that integrate directly into cloud storage or other file browsers. Some tools also support decryption of password protected files versus those managed using centralized enterprise keys.

When integrated with enterprise key management, the entire process of accessing encrypted files on iOS is completely transparent to the user. They go into the app, which connects to the file store, and files are stored within the app’s secure data store and decrypted as needed. The documents can then be restricted so they are only usable within the app, as with our other sandboxing examples. Some apps also support encryption of files from other apps.

This actually provides more protection than normal desktop encryption because it’s far easier to isolate documents and keep them within the app.

Mobile Enterprise Digital Rights Management

The next option for handling files securely on unmanaged devices expands on encryption into Digital Rights Management. EDRM provides more granular controls that travel with the documents, getting closer to information-centric security. The easiest way to distinguish between an encryption app and EDRM on iOS is:

• An encrypted document opened in a sandbox may be isolated in that app, but isn’t generally protected when accessed on other systems which also have access (such as a laptop or desktop). Protection is binary, like a lockbox – controlling only who can access the file. We rely on the sandbox app for additional controls, such as restricting movement into other apps – usually on an all-or-nothing basis).
• An EDRM protected document stays encrypted, but can only be opened by applications that respect the more granular controls applied to the file (including compatible mobile apps). This allows a wide range of control – including who can open the file, who can edit it, who can forward it via email, which devices can access it, and even time limits for access.

Encryption is for trusted users and environments, while EDRM also supports untrusted environments.

In the mobile space EDRM is better for protecting files you want to share externally and still protect – while encryption is generally only suitable for internal use, or securely transmitting documents, but unable to restrict what they can do once they have it. EDRM is very oriented towards office documents, while encryption is better for arbitrary files.

Mobile EDRM requires a server or service to manage the keys. The rights themselves are embedded in the documents. There are a variety of potential deployment models, including:

• Mobile file gateway
• File server/SharePoint integration
• Email client integration
• Email server integration
• Microsoft Office integration

To simplify this a bit: documents can either be manually protected when you create them in Office or email them, when you upload them to an EDRM-enabled file gateway/storage platform, or automatically when you save them into a protected directory or email them to a certain destination.

The documents can only be read using the vendor’s proprietary solution (app), which enforces all the rights. Some tools integrate into Microsoft’s Windows Rights Management (RMS) service or another EDRM platform which is integrated into Office.

Rights you can manage on a per file basis generally include:

• Who can read a file.
• Who can edit a file (with the same annotation/commenting limitations we see in most iOS apps, although that should be changing soon).
• Who can transfer a file out of the sandbox (“Open In…”).
• Who can print a file.
• Who can share a file (allow others to read it).
• How long the file is accessible.
• Who can copy/paste out of the file.

Unless you allow users to remove rights (or copy/paste out of the document), content is always encrypted and protected as it moves around different locations, users, and platforms. Rights are tied directly to users in enterprise environments through directory servers, so there is little sharing of credentials to allow access. If you want to exchange protected documents with external users you have them download the (usually free) app and send them the file, then use an alternate authentication and authorization model, such as federation.

For external users or mobile users without VPN access, your keys and rights management server must to be Internet accessible – perhaps hosted by a SaaS provider.

Sandboxed file browsers, mobile encryption, and mobile EDRM all use the same basic model – a sandboxed app for handling files – with different degrees of security, flexibility, and integration.

This covers all our options for unmanaged devices, nearly all of which also come into play on partially-managed or fully-managed devices… which we will cover in our next post, followed by advice on how to choose a strategy.