Upload
dr-ranbijay-kumar
View
238
Download
0
Embed Size (px)
Citation preview
Agenda
� Secure Work Space – What Is It? � BlackBerry Balance Comparison � Secure Work Space – Developer Insights � What Is Required? � Container Demo � Resources � Q&A
Screen shots are conceptual renderings only.
Secure Work Space Overview � A device work space where applications are secured
� Integrated Email, Calendar, Contacts, Notes* and Tasks* � Secure Browser � Secure attachment viewing and editing � Ability to secure enterprise applications
� A separation of work and personal data that is secured and controlled � Authentication is required � Data is saved to the secure file system as work data � Work data cannot be shared outside the secure work space
� Cut / copy / paste is only allowed within the secured work space � Personal applications cannot access work data
*iOS only
Secure Work Space Secure Connectivity
� Provides an AES 256bit secure connection between the Secure Workspace and corporate network via BlackBerry Enterprise Service 10
� All apps provided in the Secure Work Space will use this secure connection, including securely wrapped enterprise applications
� Does not require a 3rd party VPN for Secure Workspace apps
� Uses the port 3101 already configured for communication between BES and BlackBerry smartphones
� Robust Connection for Anything and Everything!
� Out-of-the-box connection behind the firewall
� Secure � Managed
� Browse behind the firewall � Immediate access to Web-based
Enterprise Tools � Provides deployed apps with a
connection to internal servers � Complete solution for your
mobile future
Secure Work Space Architecture
Screen shots are conceptual renderings only.
BlackBerry Device Service
BlackBerry Protocol 256 AES Encryption
IOS/Android
Secure Work Space
Application Server(s)
Activesync Port 443 Port 3101
BlackBerry Infrastructure
Secure Work Space Secure Browser
Enterprise Grade Browser � Supports cookies, bookmarks,
tabbed viewing, saved passwords and content caching
� Supports HTML5 and TLS/SSL
Securely integrated into the users workflow � Files/images are downloaded only to
the secure work space � Open web pages in the secured browser � Prevent copy/paste to personal
applications
Secure Work Space Document Editing and Viewing
� Fully featured document viewing and editing solution
� Support for various document types and file formats
� Used to open/edit documents in Secure Work Space
Secure Work Space for iOS and Android • Separate and Secure
• Work Inbox • Work Calendar • Work Contacts • Work Browser • Securely wrapped Enterprise Apps
• Complete separation of work and personal data at the UI
• Only enterprise owned applications can be secured*
BlackBerry Balance • Unified and Secure
• Unified inbox • Unified Calendar • Unified Contacts
• Flexible separation of data based on organization specific requirements
• Apps from BlackBerry World and enterprise owned apps can be secured
Managed by BlackBerry Enterprise Service 10 Security measures can apply against work data only All devices supported by BlackBerry Secure Connectivity Data secured at rest and in transit
*Dependent on application distribution rights
BlackBerry Balance Comparison
BlackBerry Enterprise Service 10 Application Deployment
Secure Work Space for iOS/Android App Store Secure delivery of company hosted apps
- With secure connectivity Mandatory Applications
- Compliance based Optional Applications
- User Self-Service Delivery of third-party apps outside container
BlackBerry World for Work Secure delivery of company hosted apps Optional
-Self Service user installation Mandatory applications
-Silently installed on end user devices Secure delivery of BlackBerry World apps
-Self-Service user installation
Container Approach – Comparison
Embedding of SDK Application Wrapping
� No source code modification required � Saving effort � Preventing error
� Decision on whether app can be securely deployed with MDM Admin
� Additional development effort � Risk: Potential for error
integrating the SDK � Decision on whether app can
be securely deployed during app development
Container Approach – Comparison Method Chosen
Embedding of SDK Application Wrapping
� No source code modification required � Saving effort � Preventing error
� Decision on whether app can be securely deployed with MDM Admin
� Additional development effort � Risk: Potential for error
integrating the SDK � Decision on whether app can
be securely deployed during app development
System APIs
OS
App
Unwrapped App
� Create application � Interact with API’s
and available OS entry points
� Manage all security for data at rest
Application Wrapping Traditional Application Architecture
Wrapped App
Wrapping
System APIs
OS
App
System APIs
OS
License/lock/policy validation, basic accounting Secure file I/O, copy & paste, network accounting
App
Unwrapped App
� Secure wrapping manages interaction with system APIs � Compliance � Authentication � Application level
controls
� Network
� Data encryption using AES 256 for data-at-rest
Application Wrapping Under the Covers
BlackBerry Secure Connectivity
AApp is wrapped and returned to BES10
2
Work Space Managment
Customer 1
Customer 2
Customer 3
,,, RIM
Clo
ud
BlackBerry Enterprise Service 10 Customer A
1 A
Work Space enabled app provided to mobile dev team for signing
3A
Signed App uploaded to BES 10
4
AApp sent to Secure service
1 A App after Secure Work Space Process
N iOS Distribution/Android signing Cert for customer
A App after Secure Work Space Process and Signing
A App before Secure Work Space Process
Application Wrapping High Level Process Look
AApp sent to Secure service
1
A2
A Signed app deployed to device
5
Work Space Managment
Customer 1
Customer 2
Customer 3
,,, RIM
Clo
ud
A Signed app deployed to device
5
BlackBerry Enterprise Service 10 Customer A
1 A
Work Space enabled app provided to mobile dev team for signing
3A
Signed App uploaded to BES 10
4
A App after Secure Work Space Process
N iOS Distribution/Android signing Cert for customer
A App after Secure Work Space Process and Signing
A App before Secure Work Space Process
App is wrapped and returned to BES10
Application Wrapping How It All Works
BES 10 BlackBerry Data Center
3101
APNs
443
Enterprise Application Servers
443
2195
VPN
Customer Network Internet AES 256 Encrypted Tunnel
BlackBerry Enterprise Service 10 (10.0) iOS and Android Management
BlackBerry Enterprise Service 10 iOS and Android Management With Secure Work Space
BES 10 BlackBerry Data Center
3101
APNs
C2DM
443
MS Exchange / IBM Traveler
Enterprise Application Servers
AES 256 Encrypted Tunnel
Customer Network Internet
Administrative Cooperation Wrapping the Application
� The Administrator uploads your application to start the secure app process
� Rebuilding applications is not required
Administrative Cooperation Wrapping the Application (cont.)
24
• Wait for the process to secure the app to finish
A2
Work Space Managment
Customer 1
Customer 2
Customer 3
,,, RIM
Clo
ud
BlackBerry Enterprise Service 10 Customer A
1 A
Work Space enabled app provided to mobile dev team for signing
3A
Signed App uploaded to BES 10
4
AApp sent to Secure service
1 A App after Secure Work Space Process
N iOS Distribution/Android signing Cert for customer
A App after Secure Work Space Process and Signing
A App before Secure Work Space Process
App is wrapped and returned to BES10
Administrative Cooperation Process Review
Administrative Cooperation Downloading the Wrapped App
� Administrator downloads the wrapped app and provides to the development team for final signing
Developer Input – Again Android Application – Resigning
� Applications need to be signed with a certificate to run on the device (certificate requirements for Android not very strict)
� Signing involves running a few commands � App developers typically familiar with
the procedure � At the end of process you have an .apk
file, which can be distributed OTA � More info
http://developer.android.com/tools/publishing/app-signing.html#signapp
Developer Input – Again iOS Application – Resigning
� Application need to be signed to run on an iOS device
� For in-house apps signed using distribution certificate for Apple Enterprise Developer Program
� Signing involves running a few commands on a Mac (tool codesign)
� At the end of the process you have an .ipa file, which can be distributed OTA
Administrative Cooperation – Last One Creating Access to Application
� Administrator adds wrapped and signed app to the Software Configuration
� The Software config is assigned to a user or group
� The application is deployed to the Enterprise App Store on the device
� The user clicks install
Resources
BlackBerry Live Sessions: � BPD06 – Understanding Secure Work Space for iOS and
Android Devices � BPD04 – Understanding Multi-platform Management � BPD11 – Q&A Panel: Managing iOS and Android Devices � JAM13 – BlackBerry Enterprise Service 10 Connection
Service versus VPN ... Fight! Websites: � www.bes10.com
Resources BlackBerry Partners for Enterprise Gives you access to: � Latest news, updates, and exclusive webinars � Product toolkits containing the latest
product collateral � Creative assets to support your
marketing campaigns � Technical content focused on enterprise
applications and solutions � BlackBerry Enterprise Server and
BlackBerry Enterprise Service 10 software1
� Latest BlackBerry devices for application testing2, 3
For more details and to register, visit us today at https://partners.blackberry.com
1 Some fees apply 2 Subject to regional availability 3 On loan for a fixed period of time