HERE BE DRAGONS* - The enterprise mobility journey
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Quagliana, Dan
From Golden Images to Rolling Releases Since 2016 I've been involved in multiple projects explaining to enterprises how the new mobile security scenario requires new rules of engagement. It’s now necessary to move from a "Golden Image" mentality to the idea that mobile devices need to be updated regularly with "Rolling Releases". This talk is about the challenges, and the opportunities, that enterprises needs to be prepared to address when deploying a modern mobile solution. We’re going to look into some of the common questions, like: What does security mean for an enterprise? What needs to be in place to support a secure solution? What are the biggest surprises? and present the state of the art solutions available in 2018. * "Here be dragons" means dangerous or unexplored territories, in imitation of a medieval practice of putting illustrations of dragons, sea monsters and other mythological creatures on uncharted areas of maps.
 All right, thank you very much. So my name is Dan Qualiana as you for technologies I understand this is the last session before lunch So I'll do my best to keep it energetic and exciting to tide you guys over until we can dive in so the sessions here be dragons and While it would be fun. We're not talking about dragon like toothless from How to train your dragon no game of thrones Not even looking at Dracarys versus smog from the Hobbit and you know My personal favorite dragon from the old Hobbit cartoon But we're not talking about that So when we say here be dragons, it's referencing Back in medieval times on maps. They used to mark dangerous and unexplored areas with dragons or sea serpents and when we look at enterprise Mobility particularly with huge adoption of Android with from businesses There's a lot of danger. There's a lot of unknown as this is something new So I'm not sure if you guys said in on the session yesterday that Sean led but he or I think Greg said in the opening This 65% of business mobile devices are Android today But businesses aren't really ready For these consumer devices and the adoption. So we're going to walk through some of those challenges. We're going to walk through How to manage that operating system and what's going on with that? We're going to get into the application layer as well So what can application developers do to help with this security issue? So I did have you know one obligatory slide about who is zebra technologies that I work for so zebra we are are focused on enterprise mobility we do this With Android mobile computers we focus on helping businesses track their employees their assets Give better visibility to what's going on. So we have we use barcodes RFID other technology like that We have a booth right outside the door here So any questions following the session that we I'm not able to answer please follow up and you can talk to us there So but to give a little background on what do we do? So imagine you go to the hospital you have a nurse nurses now are connected. They have Android devices They're going to scan your wristband with a barcode so they can make sure everything All the medication that they give to you all the records. They're taking any blood. They're drawing It's all attached directly to you if you go to a retailer each store associate needs to know exactly what items they have in stock how what sizes what colors Help you to so that you can purchase those devices whenever you want and when you think of a route delivery driver They also need to be able to track every package through the entire Journey through the supply chain all the way from when it's manufactured to when it's delivered at your door And that's the space that zebra is playing in And we have been playing in this space for quite a quite some time So we came out with our first barcode scanner in 1980 and we've had a mobile computer in the market since the mid 90s So these things you can see very old very ancient whether it was pocket PC palm OS Windows mobile, you know, we've had to work across all of these platforms and in 2012 we launched our first Android device which was a tablet and And starting that journey up until where we are now we've seen dramatic changes So we're going to walk through some of those and some of the enhancements that we've seen kind of building off some of the other things That we've heard from the Android enterprise team, but we're also going to look at the challenges that this is bringing to the end user customers So specifically for us we we used to For the last 10 15 years build devices with Windows mobile. This was a very niche group So we had these niche products You see this one up here. We call those brick on a stick You have your little handle so you can squeeze a scanner trigger you have you know this essentially It's almost like a blackberry on steroids with a keyboard So these are the devices that many of these businesses are used to having you can see you have very large number of them deployed Just in the last eight years. So we also had a niche group of developers So a really small group that focused on this Windows mobile Windows CE environment and Then a few years ago Windows announced that these platforms are going end of sale end of support And so all these customers now needed to make a transition. So that was why we launched in Android and As we all know Android now is becoming or is the dominant Operating system that businesses and others are needing to adopt So When we go into our customers They're used to this niche environment this niche operating system in types of devices They've built out a lot of processes for how they manage those devices how they use those devices and They're not always as open to change and what's going to happen. So yesterday Felix Dossman who is a Software lead talked about the experience. He's had building applications in the enterprise And he said that he has an application he built in 2002 that he deployed to a customer That is still running the exact same way as it was in 2002 and that Unfortunately is part of the mentality that a lot of enterprises have that they would have this golden image type of mentality They buy something and they keep it and they maintain it as is Well, we all know that that's not the way that the world is working anymore Right so today in Android, there's over two billion devices that are out there This is a consumer operating system Android is updating monthly at a minimum with security updates The security landscape has major vulnerabilities that are disclosed each and every year whether they have to do with an operating system or not You know last year we saw Blue born on the Bluetooth stack and just you know all sorts of things you're covering the wireless whether it's the processor So when we look across this and we think of that golden image mentality We also see that there's an estimated one billion Android devices that will never be updated So how do we rationalize these two worlds and that's a big part of why we have this dragons the dangerous the unknown So we have these workers where businesses they have you know their Finances they have personal identifiable information all of this that's of huge value to them and yet We have a consumer platform. We have security issues and how do we rationalize these two things together? So a few things that we're going to walk through First just looking at the operating system. So Android enterprise. There's been a number of sessions already walking through What is Android enterprise some of the features? I'm also just going to highlight a little bit on the management side and then how do we do security lifecycle management as well So on the Android enterprise side in December 2017 there was a Gartner report that analyzed the major mobile operating systems and This is a big chart, but what you can see is as you go through Android starting in Android 7 really surpassed iOS on the security side So whether you're looking at the corporate managed security Or even just on the built-in security a lot more features have been added to Android Particularly through some of these enterprise tool sets that they're building in So you have a third party independent third party who's showcasing Android as a top security operating system This is also an eyesight that the Android team built together and I always find it fascinating that looking all the way back to lollipop huge number of Features have been added in so the managed play store is a great tool that now allows Enterprises to be able to manage the applications on the device Specific APIs for EMMs that some of those were highlighted in the session before this going to Marshmallow Looking at certificate support in new get file based encryption was a huge increase and zero touch in Oreo To help you provision deploy those devices In terms of management some of the things that we have here, you know, we look a lot at deployment So within our enterprise customers, you may have someone who's just purchasing one device But we have customers that are purchasing tens of thousands of devices So how do you help those tens of thousands of devices get set up quickly and easily and ready for people to be able to use them? So zero touch is a great new feature that's come out for Android P or Android P Or oh, I'm sorry That we see a lot of people using Leveraging some of the management APIs and we even have some things where you know most of our devices have a barcode scanner built in So you can just simply scan a barcode take in all those settings and provision that device easily In terms of managing that whole fleet, you know, EMMs are a great offering Having the device owner concept as well as work profiles so you can separate your consumer use cases and apps from that work Device and then also just in terms of the app management I mentioned the manage Google Play Store allows you to take apps whether they are in The public Play Store or not and be able to distribute and manage those across all these devices So just a huge amount of improvements and I think Google Play Protect is another great thing to highlight Because there are a huge number of security scans being run constantly through Google Play Protect to help notify people of what's going on The last thing is the security lifecycle management So we talked a little bit before about how Android is publishing minimum monthly security updates to make sure that your operating system is up today But in the fragmented world of Android a Google update doesn't always trickle down to the device To the user because you have the OEMs who are building the devices in the middle So in general most of the OEMs are taking those updates They have to make updates to work on their platform and then they roll them out So that's a challenge and something that needs to be addressed Another big challenge we see in the enterprise is that there's an expectation That a device will not be used for the typical two to three years of a consumer device That it's minimum five years and sometimes longer So how can we address that with Android really only committing to do three years of updates within an operating system And so Zebra launched a program we call Lifeguard for Android And within Lifeguard for Android we're directly addressing this So as we look at the security concerns we look at those security concerns We look at those updates being rolled out by Google and how do we cover that And that's why we've taken it so that we are then extending an additional two years So we get the security updates from Android We update that for our devices and every month we roll those out There was a study I think three or four months ago that highlighted that A large percentage of OEMs have not been taking all of the Android security updates And they just do certain blocks and chunks and not all of them are getting rolled out And Zebra is committed that we have done every single one of those And we make sure that our customers are seeing all that security benefit So I do have one chart that I think is a little helpful to understand how this actually comes out in play When there are security vulnerabilities So last year an independent party identified what came to be known as BlueBorne So this was a security vulnerability on the Bluetooth stack So this was not initially publicly disclosed A lot of these companies, they disclose them to the operating system manufacturers And there are rewards that they can receive based on that So in this case the company was Armist, they contacted Google back on April 19th This is in 2017, Google was able to update and patch on August 7th And they then sent that out to all of their OEMs A month later Zebra was able to update and make publicly available September 4th that patch And then Armist and people did not publicly disclose the vulnerability Until after that on September 12th So in this case what you're able to see For Zebra customers as well as Android customers Is that these security vulnerabilities are discovered, they're addressed And fixes are available, sometimes even before a public disclosure of what the issue is So we kind of go through this and we say, oh, so we've got all these great solutions And so maybe we don't have the danger and the unknowns that we think we do But in theory there's no difference between theory and practice But in practice there is, so a little bit of a mind puzzle here But the problem is, as I said, a lot of these enterprises have this golden image mentality They do not have practices and resources in place to necessarily be updating On a monthly basis all these security profiles And for them a lot of this is around being able to test and understand the impact Of taking some of these updates So I mentioned earlier a nurse who's using a device to be able to identify who the patients are What happens if an update's not thoroughly tested and that system goes down Now you're looking at patient safety and significant problems around that For other enterprises it's a lot more around business going down, losing revenue and money But this is a very significant issue for companies Last year alone Zebra put out 250 updates to our operating system That's not something that these companies can actually manage So this is still a challenge, it's an issue out in the market And something that we all need to partner together with our customers To help them understand the importance of the security updates But also ways to mitigate the risk of enrolling in these updates as well Enrolling them out And so that's what I'm going to dive into a little bit next Some of the things that it may be at the application layer that we can do to simplify that So when we look at the application layer there's a lot of best practices that are published out there John yesterday in his session talked through some of these So Android has great documentation around best practices I highly encourage people to go through these, make sure you're implementing all of them There's a lot of other best practices published on the web as well So make sure you're doing your research in terms of how are you architecting and structuring your applications So that you are building in security and doing things in the best possible way Another great option that Android provides are the safety net APIs So this was also talked about yesterday by John I'm not sure if that many people are actually using these today, but they really are of huge benefit So in attestation that allows you to verify that the device that's being used is not rooted And doesn't have a compromise within the device itself And when you think of the issue there, so let's say that there's a bank You're writing the application for a bank You do not want to have your application with people's private information, their access codes and all of that Be entered on a rooted device So you can check and make sure that the device itself is not compromised Verify apps goes at the application layer and helps check that there are not any other applications Installed on that device that have known security vulnerabilities So a few just kind of basic checks that we can do I think another really important thing that we need to focus on as application developers Is looking at how we're leveraging third-party libraries So third-party libraries are really a savior for all of us They save so much time, they allow us to do a lot more in our applications than what we would normally do And it's just a standard part of building an application today The problem is, I think many people don't know the libraries as deeply and as well as they could Nor do they always consistently follow and make sure that they're using the latest versions and what's going on So if you look at some of these quotes here, you know, in Android a study was done, this is in 2015 And I think third-party library usage has actually increased since then Saying that 60% of the code in Android apps is from third-party libraries Looking at the third quote here, this is not specific to Android But just an application usage of open source code saying only 10-20% of the code application developers are doing Is their own with the remaining 80-90% from a third-party library So these are really major things we need to think about So going through this, I read through a few different security reports And wanted to just share some of this information that I think highlights the importance of the issue And then we'll talk through a few kind of best practices of usage of these third-party libraries And then those of you who are making them a few tips as well So Black Duck put out this report earlier this year So they analyzed, and this is not specific to Android, this is looking at open source usage So they analyzed 1,100 applications and found just massive amounts of open source components being used And the scary part here is when you look at 78% of those code bases had at least one security vulnerability So when we look at that and the impact and how that trickles down, it gets really dangerous for us Part of the biggest issue here though is when you look at when there are very well-known issues Such as Heartbleed and others, there's such a high percentage of people still had not addressed these And one of the big things in this report, they also talked about Apache structs Which in the United States that led to one of the company that manages a lot of credit information Gave out 150, they lost 150 million users information And so this was major publicity and this study found that 8% of the code bases were still using that And still had that vulnerability within their applications So these are a big problem and thankfully the Google and Android team does help address some of those open source issues And they do that through the app security improvement program So within this program, when an application is run through Google Play, they're analyzing for 27 different vulnerabilities And they will reach out and notify you if they identify that you are using one of those vulnerabilities So they give you 90 days, fix your issue, otherwise they will not accept any updates to your app until you have fixed that And they also will not allow you to submit any new apps until you've addressed that issue And it's had major impact So that's some good news I also read another study that I think is also really interesting and this one is specific on Android usage And this came out at the end of last year So they analyzed 1.3 million Android applications and their usage of over 2 million libraries And so what they found was that over 70% of those libraries used were significantly outdated And part of that is because on average applications within Google Play are updated once a year And so that means you have an entire year with no updates that you're not looking at how you're using those libraries And some of the feedback that they heard was that many 50% of these developers are concerned around when they update a library What's the impact on their code? That's additional testing they have to do What actually ended up playing out was that they were able to do some analysis of this and found that 86% of those libraries If they updated one version to address a security issue, it would have no impact on functionality Meaning if the application developer simply compiled and used the newer version of the library, the application would have worked fine And then as we look back, you can see the bottom number here, nearly 20,000 of the apps Many had been notified through that Android security improvement or the app security improvement program And they had not made any changes to those applications So what are the big takeaways here? I think for a developer, you really need to make sure you truly understand those libraries that you're using You need to make sure that if, whether they have certain vulnerabilities in them And understand also how often are they updating them So make sure that they are responsive and that you can count on that You need to make sure that a lot of this, it's reliant on us, the developer, to know when those updates come out There's usually not a notification system for you to be aware of that So that's something we need to factor in We also, one of the things that really has come out as a best practice Is when you are making an update for a security reason, keep it focused on that security patch And when you do a focused update, that allows your end customers to feel more comfortable about accepting that And this ties in with third-party library usage as well for developers that when you're doing updates If you're able to just do that patch level, that helps people feel more comfortable with that update I think the other part that we talked about, how do we address that maybe unwillingness or too much challenge for the customers to be updating their applications We really need to partner with our customers And we're rolling out, have those conversations that in this world we need to have regular updates of the application And work through how they can do that, what are some easy methods for them to test So that you can understand what their use cases are, that application developer can do some of that testing The end user can do some of it and work out some of those shared responsibilities When we look at the third-party library developers, a lot of this also, you need to have a commitment that if you're publishing something with the expectation that people are using it You need to regularly update that, you need to be monitoring when there are security vulnerabilities and issues to address that And then also make sure you're documenting everything clearly, help make sure people know what you're including And even reading through some of these studies, whether you're making a major version number change, minor version number change People look into that, they read a lot into it, if there's a major version number change, people are less likely to adopt Because they assume that there will be major impact of how they're using it So just be very conscious of those things So that was the main part of the talk here, and I think you heard that there's still some uncertainty within this world in the enterprise and using Android But there's also ways that we can mitigate that So by working together with our library developers, with the application developers, and with the Android team and our end users We can really help create a more secure landscape to improve this whole security system together So that's the end of my talk, thank you for listening Thank you, Dan Thank you. So my take...
 All right, thank you very much. So my name is Dan Qualiana as you for technologies  I understand this is the last session before lunch  So I'll do my best to keep it energetic and exciting to tide you guys over until we can dive in  so the sessions here be dragons and  While it would be fun. We're not talking about dragon like toothless from  How to train your dragon no game of thrones  Not even looking at Dracarys versus smog from the Hobbit and you know  My personal favorite dragon from the old Hobbit cartoon  But we're not talking about that  So when we say here be dragons, it's referencing  Back in medieval times on maps. They used to mark  dangerous and unexplored areas with dragons or sea serpents and when we look at enterprise  Mobility particularly with huge adoption of Android with from businesses  There's a lot of danger. There's a lot of unknown as this is something new  So I'm not sure if you guys said in on the session yesterday that Sean led but he or I think Greg said in the opening  This 65% of business mobile devices are Android today  But businesses aren't really ready  For these consumer devices and the adoption. So we're going to walk through some of those challenges. We're going to walk through  How to manage that operating system and what's going on with that?  We're going to get into the application layer as well  So what can application developers do to help with this security issue?  So I did have you know one obligatory slide about who is zebra technologies that I work for so zebra we are  are focused on enterprise mobility we do this  With Android mobile computers we focus on helping businesses track their  employees their assets  Give better visibility to what's going on. So we have we use barcodes RFID other technology like that  We have a booth right outside the door here  So any questions following the session that we I'm not able to answer please follow up and you can talk to us there  So but to give a little background on what do we do?  So imagine you go to the hospital you have a nurse nurses now are connected. They have Android devices  They're going to scan your wristband with a barcode so they can make sure everything  All the medication that they give to you all the records. They're taking any blood. They're drawing  It's all attached directly to you if you go to a retailer each store associate needs to know exactly what  items they have in stock how what sizes what colors  Help you to so that you can purchase those devices whenever you want and when you think of a route delivery driver  They also need to be able to track every package through the entire  Journey through the supply chain all the way from when it's manufactured to when it's delivered at your door  And that's the space that zebra is playing in  And we have been playing in this space for quite a quite some time  So we came out with our first barcode scanner in 1980 and we've had a mobile computer in the market since the mid 90s  So these things you can see very old very ancient whether it was pocket PC palm OS  Windows mobile, you know, we've had to work across all of these platforms  and in 2012 we launched our first Android device which was a tablet and  And starting that journey up until where we are now we've seen dramatic changes  So we're going to walk through some of those and some of the enhancements that we've seen kind of building off some of the other things  That we've heard from the Android enterprise team, but we're also going to look at the challenges that this is bringing to the end user customers  So specifically for us we we used to  For the last 10 15 years build devices with Windows mobile. This was a very niche group  So we had these niche products  You see this one up here. We call those brick on a stick  You have your little handle so you can squeeze a scanner trigger you have you know this essentially  It's almost like a blackberry on steroids with a keyboard  So these are the devices that many of these businesses are used to having you can see you have very large number of them deployed  Just in the last eight years. So we also had a niche group of developers  So a really small group that focused on this Windows mobile Windows CE environment  and  Then a few years ago Windows announced that these platforms are going end of sale end of support  And so all these customers now needed to make a transition. So that was why we launched in Android and  As we all know Android now is becoming or is the dominant  Operating system that businesses and others are needing to adopt  So  When we go into our customers  They're used to this niche environment this niche operating system in types of devices  They've built out a lot of processes for how they manage those devices how they use those devices and  They're not always as open to change and what's going to happen. So yesterday Felix Dossman who is a  Software lead talked about the experience. He's had building applications in the enterprise  And he said that he has an application he built in 2002 that he deployed to a customer  That is still running the exact same way as it was in 2002 and that  Unfortunately is part of the mentality that a lot of enterprises have that they would have this golden image type of mentality  They buy something and they keep it and they maintain it as is  Well, we all know that that's not the way that the world is working anymore  Right so today in Android, there's over two billion devices that are out there  This is a consumer operating system  Android is updating monthly at a minimum with security updates  The security landscape has major vulnerabilities that are disclosed each and every year whether they have to do with an operating system or not  You know last year we saw  Blue born on the Bluetooth stack and just you know all sorts of things you're covering the wireless whether it's the processor  So when we look across this and we think of that golden image mentality  We also see that there's an estimated one billion Android devices that will never be updated  So how do we rationalize these two worlds and that's a big part of why we have this dragons the dangerous the unknown  So we have these workers where businesses they have you know their  Finances they have personal identifiable information all of this that's of huge value to them and yet  We have a consumer platform. We have security issues and how do we rationalize these two things together?  So a few things that we're going to walk through  First just looking at the operating system. So Android enterprise. There's been a number of sessions already walking through  What is Android enterprise some of the features?  I'm also just going to highlight a little bit on the management side and then how do we do security lifecycle management as well  So on the Android enterprise side in December 2017  there was a Gartner report that analyzed the major mobile operating systems and  This is a big chart, but what you can see is as you go through  Android starting in Android 7 really surpassed iOS on the security side  So whether you're looking at the corporate managed security  Or even just on the built-in security a lot more features have been added to Android  Particularly through some of these enterprise tool sets that they're building in  So you have a third party independent third party who's showcasing Android as a top security operating system  This is also an eyesight that the Android team built together and I always find it fascinating that looking all the way back to lollipop  huge number of  Features have been added in so the managed play store is a great tool that now allows  Enterprises to be able to manage the applications on the device  Specific APIs for EMMs that some of those were highlighted in the session before this going to Marshmallow  Looking at certificate support in new get file based encryption was a huge increase and zero touch in Oreo  To help you provision deploy those devices  In terms of management some of the things that we have here, you know, we look a lot at deployment  So within our enterprise customers, you may have someone who's just purchasing one device  But we have customers that are purchasing tens of thousands of devices  So how do you help those tens of thousands of devices get set up quickly and easily and ready for people to be able to use them?  So zero touch is a great new feature that's come out for Android P or Android P  Or oh, I'm sorry  That we see a lot of people using  Leveraging some of the management APIs and we even have some things where you know most of our devices have a barcode scanner built in  So you can just simply scan a barcode take in all those settings and provision that device easily  In terms of managing that whole fleet, you know, EMMs are a great offering  Having the device owner concept as well as work profiles so you can separate your consumer use cases and apps from that work  Device and then also just in terms of the app management  I mentioned the manage Google Play Store allows you to take apps whether they are in  The public Play Store or not and be able to distribute and manage those across all these devices  So just a huge amount of improvements and I think Google Play Protect is another great thing to highlight  Because there are a huge number of security scans being run constantly through Google Play Protect to help notify people of what's going on  The last thing is the security lifecycle management  So we talked a little bit before about how Android is publishing minimum monthly security updates to make sure that your operating system is up today  But in the fragmented world of Android a Google update doesn't always trickle down to the device  To the user because you have the OEMs who are building the devices in the middle  So in general most of the OEMs are taking those updates  They have to make updates to work on their platform and then they roll them out  So that's a challenge and something that needs to be addressed  Another big challenge we see in the enterprise is that there's an expectation  That a device will not be used for the typical two to three years of a consumer device  That it's minimum five years and sometimes longer  So how can we address that with Android really only committing to do three years of updates within an operating system  And so Zebra launched a program we call Lifeguard for Android  And within Lifeguard for Android we're directly addressing this  So as we look at the security concerns we look at those security concerns  We look at those updates being rolled out by Google and how do we cover that  And that's why we've taken it so that we are then extending an additional two years  So we get the security updates from Android  We update that for our devices and every month we roll those out  There was a study I think three or four months ago that highlighted that  A large percentage of OEMs have not been taking all of the Android security updates  And they just do certain blocks and chunks and not all of them are getting rolled out  And Zebra is committed that we have done every single one of those  And we make sure that our customers are seeing all that security benefit  So I do have one chart that I think is a little helpful to understand how this actually comes out in play  When there are security vulnerabilities  So last year an independent party identified what came to be known as BlueBorne  So this was a security vulnerability on the Bluetooth stack  So this was not initially publicly disclosed  A lot of these companies, they disclose them to the operating system manufacturers  And there are rewards that they can receive based on that  So in this case the company was Armist, they contacted Google back on April 19th  This is in 2017, Google was able to update and patch on August 7th  And they then sent that out to all of their OEMs  A month later Zebra was able to update and make publicly available September 4th that patch  And then Armist and people did not publicly disclose the vulnerability  Until after that on September 12th  So in this case what you're able to see  For Zebra customers as well as Android customers  Is that these security vulnerabilities are discovered, they're addressed  And fixes are available, sometimes even before a public disclosure of what the issue is  So we kind of go through this and we say, oh, so we've got all these great solutions  And so maybe we don't have the danger and the unknowns that we think we do  But in theory there's no difference between theory and practice  But in practice there is, so a little bit of a mind puzzle here  But the problem is, as I said, a lot of these enterprises have this golden image mentality  They do not have practices and resources in place to necessarily be updating  On a monthly basis all these security profiles  And for them a lot of this is around being able to test and understand the impact  Of taking some of these updates  So I mentioned earlier a nurse who's using a device to be able to identify who the patients are  What happens if an update's not thoroughly tested and that system goes down  Now you're looking at patient safety and significant problems around that  For other enterprises it's a lot more around business going down, losing revenue and money  But this is a very significant issue for companies  Last year alone Zebra put out 250 updates to our operating system  That's not something that these companies can actually manage  So this is still a challenge, it's an issue out in the market  And something that we all need to partner together with our customers  To help them understand the importance of the security updates  But also ways to mitigate the risk of enrolling in these updates as well  Enrolling them out  And so that's what I'm going to dive into a little bit next  Some of the things that it may be at the application layer that we can do to simplify that  So when we look at the application layer there's a lot of best practices that are published out there  John yesterday in his session talked through some of these  So Android has great documentation around best practices  I highly encourage people to go through these, make sure you're implementing all of them  There's a lot of other best practices published on the web as well  So make sure you're doing your research in terms of how are you architecting and structuring your applications  So that you are building in security and doing things in the best possible way  Another great option that Android provides are the safety net APIs  So this was also talked about yesterday by John  I'm not sure if that many people are actually using these today, but they really are of huge benefit  So in attestation that allows you to verify that the device that's being used is not rooted  And doesn't have a compromise within the device itself  And when you think of the issue there, so let's say that there's a bank  You're writing the application for a bank  You do not want to have your application with people's private information, their access codes and all of that  Be entered on a rooted device  So you can check and make sure that the device itself is not compromised  Verify apps goes at the application layer and helps check that there are not any other applications  Installed on that device that have known security vulnerabilities  So a few just kind of basic checks that we can do  I think another really important thing that we need to focus on as application developers  Is looking at how we're leveraging third-party libraries  So third-party libraries are really a savior for all of us  They save so much time, they allow us to do a lot more in our applications than what we would normally do  And it's just a standard part of building an application today  The problem is, I think many people don't know the libraries as deeply and as well as they could  Nor do they always consistently follow and make sure that they're using the latest versions and what's going on  So if you look at some of these quotes here, you know, in Android a study was done, this is in 2015  And I think third-party library usage has actually increased since then  Saying that 60% of the code in Android apps is from third-party libraries  Looking at the third quote here, this is not specific to Android  But just an application usage of open source code saying only 10-20% of the code application developers are doing  Is their own with the remaining 80-90% from a third-party library  So these are really major things we need to think about  So going through this, I read through a few different security reports  And wanted to just share some of this information that I think highlights the importance of the issue  And then we'll talk through a few kind of best practices of usage of these third-party libraries  And then those of you who are making them a few tips as well  So Black Duck put out this report earlier this year  So they analyzed, and this is not specific to Android, this is looking at open source usage  So they analyzed 1,100 applications and found just massive amounts of open source components being used  And the scary part here is when you look at 78% of those code bases had at least one security vulnerability  So when we look at that and the impact and how that trickles down, it gets really dangerous for us  Part of the biggest issue here though is when you look at when there are very well-known issues  Such as Heartbleed and others, there's such a high percentage of people still had not addressed these  And one of the big things in this report, they also talked about Apache structs  Which in the United States that led to one of the company that manages a lot of credit information  Gave out 150, they lost 150 million users information  And so this was major publicity and this study found that 8% of the code bases were still using that  And still had that vulnerability within their applications  So these are a big problem and thankfully the Google and Android team does help address some of those open source issues  And they do that through the app security improvement program  So within this program, when an application is run through Google Play, they're analyzing for 27 different vulnerabilities  And they will reach out and notify you if they identify that you are using one of those vulnerabilities  So they give you 90 days, fix your issue, otherwise they will not accept any updates to your app until you have fixed that  And they also will not allow you to submit any new apps until you've addressed that issue  And it's had major impact  So that's some good news  I also read another study that I think is also really interesting and this one is specific on Android usage  And this came out at the end of last year  So they analyzed 1.3 million Android applications and their usage of over 2 million libraries  And so what they found was that over 70% of those libraries used were significantly outdated  And part of that is because on average applications within Google Play are updated once a year  And so that means you have an entire year with no updates that you're not looking at how you're using those libraries  And some of the feedback that they heard was that many 50% of these developers are concerned around when they update a library  What's the impact on their code? That's additional testing they have to do  What actually ended up playing out was that they were able to do some analysis of this and found that 86% of those libraries  If they updated one version to address a security issue, it would have no impact on functionality  Meaning if the application developer simply compiled and used the newer version of the library, the application would have worked fine  And then as we look back, you can see the bottom number here, nearly 20,000 of the apps  Many had been notified through that Android security improvement or the app security improvement program  And they had not made any changes to those applications  So what are the big takeaways here? I think for a developer, you really need to make sure you truly understand those libraries that you're using  You need to make sure that if, whether they have certain vulnerabilities in them  And understand also how often are they updating them  So make sure that they are responsive and that you can count on that  You need to make sure that a lot of this, it's reliant on us, the developer, to know when those updates come out  There's usually not a notification system for you to be aware of that  So that's something we need to factor in  We also, one of the things that really has come out as a best practice  Is when you are making an update for a security reason, keep it focused on that security patch  And when you do a focused update, that allows your end customers to feel more comfortable about accepting that  And this ties in with third-party library usage as well for developers that when you're doing updates  If you're able to just do that patch level, that helps people feel more comfortable with that update  I think the other part that we talked about, how do we address that maybe unwillingness or too much challenge for the customers to be updating their applications  We really need to partner with our customers  And we're rolling out, have those conversations that in this world we need to have regular updates of the application  And work through how they can do that, what are some easy methods for them to test  So that you can understand what their use cases are, that application developer can do some of that testing  The end user can do some of it and work out some of those shared responsibilities  When we look at the third-party library developers, a lot of this also, you need to have a commitment that if you're publishing something with the expectation that people are using it  You need to regularly update that, you need to be monitoring when there are security vulnerabilities and issues to address that  And then also make sure you're documenting everything clearly, help make sure people know what you're including  And even reading through some of these studies, whether you're making a major version number change, minor version number change  People look into that, they read a lot into it, if there's a major version number change, people are less likely to adopt  Because they assume that there will be major impact of how they're using it  So just be very conscious of those things  So that was the main part of the talk here, and I think you heard that there's still some uncertainty within this world in the enterprise and using Android  But there's also ways that we can mitigate that  So by working together with our library developers, with the application developers, and with the Android team and our end users  We can really help create a more secure landscape to improve this whole security system together  So that's the end of my talk, thank you for listening  Thank you, Dan  Thank you. So my take...
HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_0_347.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_348_587.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_588_659.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_660_827.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_828_995.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_996_2459.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_2460_4715.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_4716_5843.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_5844_7475.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_7476_8891.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_8892_9755.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_9756_10031.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_10032_10667.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_10668_10727.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_10728_10799.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_10800_11231.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_11232_12287.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_12288_13391.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_13392_13451.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_13452_15683.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_15684_17183.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_17184_17315.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_17316_17531.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_17532_18527.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_18528_20483.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_20484_20531.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_20532_21047.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_21048_23219.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_23220_24083.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_24084_25775.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_25776_27899.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_27900_30299.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_30300_31319.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_31320_33635.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_33636_36335.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_36336_37535.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_37536_38567.png HERE_BE_DRAGONS__-_THE_ENTERPRISE_MOBILE_SECURITY__XyQKj6KsJiI_38568_38586.png