Posted on

Meeting ISN 2022/04 Secure by Design Requirements

Armour Mobile in use at the MoD

Recently the UK Government published Industry Security Notice 2022/04 Secure by Design Requirements, which informs the UK Defence Supply Base of the Secure by Design policy and approach which has been set out to ensure cyber secure delivery of capabilities for the MoD.

Before we outline just how closely Armour complies, we address the issue; What is the difference between Secure by Design and Secure by Default?  The National Cyber Security Centre (NCSC) uses both terms in different contexts.

Secure by Design

Broadly speaking, Secure by Design means that software products and services are designed to be secure from the ground up.  Every layer is considered from a security and privacy standpoint and starts with a robust architecture design.  Secure by Design incorporates strategies such as forcing patterns of behaviour, for example, strong authentication, and the use of best practice protocols such as least privilege access.

More specifically, Secure by Design is part of the Government’s National Cyber Security Strategy. The Department for Digital, Culture, Media & Sport (DCMS) and the NCSC conducted a review into how to improve the cyber security of consumer Internet of Things (IoT) products and associated services, and as a result published various documents regarding the security of smart devices.

Secure by Default

Secure by Default builds on the premise of Secure by Design.  According to NCSC Secure by Default is about taking a holistic approach to solving security problems at the root cause rather than treating the symptoms. It covers the long-term technical effort to ensure that the right security attributes are built into software and hardware. As well as ensuring that security is considered at every stage when developing products and services, it also includes ensuring that products are delivered to the end-user in such a way that the default settings enforce good security practices, while balancing usability with security. After all, if a product is too difficult to use, people will simply find a workaround, meaning that security ends up being compromised anyway.

Secure by Default principles prescribed by NCSC are:

      • security should be built into products from the beginning, it can’t be added in later;
      • security should be added to treat the root cause of a problem, not its symptoms;
      • security is never a goal in and of itself, it is a process – and it must continue throughout the lifetime of the product;
      • security should never compromise usability – products need to be secure enough, then maximise usability;
      • security should not require extensive configuration to work, and should just work reliably where implemented;
      • security should constantly evolve to meet and defeat the latest threats – new security features should take longer to defeat than they take to build;
      • security through obscurity should be avoided;
      • security should not require specific technical understanding or non-obvious behaviour from the user.

 

Armour Mobile complies with Secure by Design AND Secure by Default

At Armour Comms we have been working with NCSC since our inception a number of years ago to ensure that our products are designed with Best Practice security protocols in place. Our initial products were CPA certified to demonstrate they adhered to these security principles; when that scheme finished (for all products with the exception of smart meters) we focused on ISO27001 and Cyber Essentials Plus certification as externally audited proof of our strong security practices.

Our products are approved for use up to OFFICIAL-SENSITIVE, NATO Restricted and for Higher Assurance requirements and are already deployed at these levels. Our innovative developers work hard to deliver products that strike the balance between providing a user experience that mimics consumer-grade apps, while delivering the security credentials required for higher assurance use.  Armour Mobile is in use in many Government departments as well as having been deployed for numerous use cases across the MoD.

Armour Mobile and MoD Secure by Design Requirements

One of the key principles within the ISN 2022/04 Secure by Design Requirements is to Define Security Controls, and within that, the requirement is that: “Existing processes, knowledge, standards and technologies should be identified, assessed and reused where possible to avoid duplication of effort.”  With this in mind, and our track record of working with NCSC and the MoD, Armour Mobile is the obvious choice for any secure comms requirement within the Defence sector.

For a more detailed look at the NCSC Secure by Default principles read our blog: The future of NCSC Technical Assurance: https://www2s.armourcomms.com/2022/01/25/the-future-of-ncsc-technical-assurance/  and for more information about the NCSC Secure by Default principles please read: https://www.ncsc.gov.uk/information/secure-default

Watch this space for future articles describing in more detail how Armour Mobile meets the Secure by Design requirements.

Posted on

Unity by Armour Secure Conferencing wins Best Communications Security Solution at SC Awards

We are delighted to announce that Unity by Armour has won the SC Award for Best Communications Security Solution. Unity is the third Armour product to be honoured by these highly prestigious Awards (previous accolades went to Armour Mobile and SigNet by Armour).

The award was presented at the first live celebration of the SC Awards in three years, held yesterday (21st June – midsummer’s day) at the London Marriott, Grosvenor Square, where we were joined by clients for a glitzy evening.  According to the organiser: “The SC Awards Europe recognise and reward products and services that continue to stand out from the crowd, exceeding customer expectations to help defeat imminent threats and cyber-security attacks.”

From our perspective, we are pleased that our products stand out for their innovation and value to business in the fight against cyber threats.  However, the award is also a huge ‘well done’ to our employees who have worked so hard to deliver real-world solutions to the dilemma of providing the functionality of a consumer app, with the Secure by Default design and security required for business communications and collaboration.

Here’s a summary of the winning entry……………

Enterprise Conferencing that’s more secure and easier to use

Unity by Armour® delivers secure conferencing in an easy-to-use app for mobile and desktop use, with enterprise security features not provided by free-to-use consumer products including a choice of cloud or on-premises installation to ensure data sovereignty. Unity is available in several configurations to ensure the level of security matches the sensitivity of the conversation. Unity combats the issue of ghost callers that may eavesdrop on sensitive conversations by highlighting to all users whether a participant has joined the call via Armour’s secure app, or via a browser – the latter often introduce vulnerabilities.

Unity extends the Armour ecosystem by working in conjunction with Armour Mobile to provide pre-defined or on-the-fly secure video conferencing, screen sharing and integration with secure chat groups and interconnectivity with trusted unified communications systems.

Unity delivers picture-in-picture and multiple screens, and offers a familiar video conferencing interface, making it easy and intuitive to use.

Armour Mobile won the award for Best Mobile Security Solution in 2019 and SigNet and Armour Mobile were Highly Commended in the same category in 2021.

If your organisation needs a conferencing tool with enterprise capabilities and security credentials to match, call us today to find out more +44(0)20 36 37 38 01

Posted on

User Success – Are you making the most of Armour technology?

Convincing people to use security products is a challenge.  Employees are often reluctant to change their working practices, especially if it involves any kind of inconvenience. So when you have successfully built the business case, found the product, got budget approval, procured the product and rolled it out to end users – then what? How can you ensure that the product is being used, and can you demonstrate business value, or return on investment?  With security products this is notoriously difficult because if the product is successful at diverting a threat, then there may be no obvious outcome or benefit to the end user.

With this in mind we’re going to be revisiting customer successes that we think will help our clients achieve maximum benefit from their investment in Armour technology.

Secure Note to Self – Provide a great user experience

Evidence shows that the most enthusiastic adoption of Armour Mobile and SigNet by Armour is where it solves a compelling business problem, as well as providing better security. The product must be easy and pleasant to use, and users need to see immediately how it makes their lives easier.

By talking to our many clients about how they are using our products on the ground, we have learnt about some surprising real-world benefits.  For example, SigNet has an extremely useful Note to Self capability – something that once users discover they absolutely love. No more sticky notes, or emails to self, just a voice memo that is completely secure and cannot be eavesdropped or overheard by anyone other than the intended recipient that goes to devices linked to the same account.

Cyber Essentials Plus and BYOD don’t mix – or can they?

Another point worth keeping in mind, if your organisation is planning to undertake Cyber Essentials Plus accreditation, then employees’ unmanaged personal devices (i.e. BYOD) cannot be used to access corporate information, including email.  Employees are generally highly resistant to Mobile Device Management (MDM) solutions on their personal devices, however, by using Armour Mobile all corporate information shared using the app is completely isolated from the rest of the device.  This makes Armour Mobile an extremely viable alternative to MDM which employees are more than happy to use as it does not interfere with their personal apps, while protecting business information. The same device can be used for both personal and business communications. For more information about this read our blog: https://www2s.armourcomms.com/2022/05/03/protecting-sensitive-comms-on-byod-devices-without-resorting-to-mdm/

In the coming weeks and months, we’ll be sharing different scenarios where our customers have achieved sometimes unexpected benefits from different use cases.  In the meantime, if you have a business problem, get in touch and it may be that someone else has already faced that same issue, and we have the solution ready and waiting.

Posted on

Recall by Armour – Armour Mobile Audit capabilities

Unofficial channels now subject to FoI requests

If you need to audit secure calls, protect evidence, or prove compliance, Armour can help.

A recent ruling by the Information Commissioner’s Office (ICO) (https://www.civilserviceworld.com/professions/article/freedom-of-information-foi-covers-whatsapp-and-other-private-channels-confirms-ico) states that emails and messages between officials and ministers sent from private accounts, including consumer-grade apps such as WhatsApp, are covered by the Freedom of Information (FoI) Act. The ruling aims to deal with the concerns that unofficial communication channels may impede official record keeping and the public record.

 

Keep Professional and Personal Comms separate

Quite apart for the need for government officials and those in public office to remain transparent and accountable, our previous blog entitled: Insider trading, a Russian banker and WhatsApp – the case for Audit  explains the importance of keeping professional and personal communications totally separate, and why organisations should use an enterprise app for business communications. There are many security reasons that consumer-grade apps are unsuitable for professional use, not least that free-to-use apps simply don’t have the features required for use at enterprise level, such as audit.

 

Privacy with an Audit trail

One of the key reasons that many organisations will want to use to use Armour solutions is to maintain complete privacy and security of communications. However, there are instances, when audit functionality is a requirement. We understand that providing the option for an auditor to be able to review sensitive calls after the event is, in itself, a security management conundrum.

 

With Recall by Armour we have solved this challenge

Recall by Armour is available as an additional module to Armour Mobile for on-premises deployments. Designed for organisations in regulated industries Recall provides call audit capabilities for security-conscious organisations that need to be able to prove who said what, to whom, and when.

 

How it works

Armour Mobile and Desktop support an audit capability enabling communication (text, audio) to be captured in its entirety within the centralised audit log, allowing detailed retrospective analysis of all conversations.   Each entry within the audit log is encrypted using keys unique to the user to whom the entry relates, and access to the decrypted content can only be gained when an Administrator with sufficient access rights has access to the audit tools to securely retrieve the key material and perform the necessary decryption tasks.

With Recall, all communications via Armour Mobile are protected and preserved automatically, the user doesn’t need to do anything extra. This supports the NCSC ethos of Secure by Design, making security easy for the end user.

For more information about how Armour Comms can help your organisation preserve, check and interrogate secure and sensitive conversations, contact us today. sales@armourcomms.com

Posted on

Advice from NCSC – Using Secure Messaging, Voice & Collaboration Apps

NCSC recently published a blog containing some great advice about using secure messaging, voice and collaboration apps. https://www.ncsc.gov.uk/blog-post/using-secure-messaging-voice-and-collaboration-apps.  

As the world of work has morphed into one of hybrid working where many people now work partly from home, partly from the office, and often other locations while travelling, so people have adopted messaging and collaboration apps for business use.

However, as many headlines in the press have highlighted, consumer-grade apps are simply not designed nor suitable for business use.  Apart from the fact that none of these apps address the rigours of data privacy legislation such as GDPR, there are some serious security concerns around the wholesale selling or distribution of users’ data and meta-data by the multi-national organisations that own many of the consumer apps.

Here are just some of the issues:

  • User details can be sold to third parties

 

  • Even with end-to-end encryption meta-data can be hacked and compromised

 

  • Your location and who you are talking to can be visible

 

  • There is no management of users – anyone that finds your mobile number could contact you

 

  • User identities are easily spoofed – you can’t be sure who you are in contact with

 

  • Data privacy regulations, like GDPR (and others) are flouted

NCSC spells out exactly what organisations should look for when procuring a secure messaging and collaboration solution that is suitable for business use, and in our White Paper we outline exactly how Armour Mobile meets and exceeds those requirements.

To download your copy, please complete this form:

Posted on

Unity by Armour Secure Conferencing an SC Awards Finalist

We are delighted to announce that Unity by Armour has been shortlisted for an SC Award for Best Communications Security Solution.

Unity is the third Armour product to be a finalist, and it is the 5th year in a row that we have been shortlisted.  Armour Mobile won the award for Best Mobile Security Solution in 2019 and SigNet and Armour Mobile were Highly Commended in the same category in 2021.

 

Enterprise Conferencing that’s more secure and easier to use

Unity by Armour® delivers secure conferencing in an easy-to-use app for mobile and desktop use, with enterprise security features not provided by free-to-use consumer products including a choice of cloud or on-premises installation to ensure data sovereignty. Unity is available in several configurations to ensure the level of security matches the sensitivity of the conversation. Unity combats the issue of ghost callers that may eavesdrop on sensitive conversations by highlighting to all users whether a participant has joined the call via an app, or securely via a browser –browser options often increase vulnerabilities.

Unity extends the Armour ecosystem by working in conjunction with Armour Mobile to provide pre-defined or on-the-fly secure video conferencing, screen sharing and integration with secure chat groups and interconnectivity with trusted unified communications systems.

Unity delivers picture-in-picture and multiple screens, and offers a familiar video conferencing interface, making it easy and intuitive to use.

If your organisation needs a conferencing tool with enterprise capabilities and security credentials to match, call us today to find out more

Tel: +44(0)20 36 37 38 01

Posted on

Protecting Sensitive Comms on BYOD Devices without resorting to MDM

Managing corporate data on Bring Your Own Devices (BYOD) has been a thorny issue for years. Businesses and employees alike appreciate the convenience of people using their own devices, and in fact, the organisation probably doesn’t have much choice in the matter without taking draconian measures. However, protecting sensitive information that finds its way onto unmanaged devices can open organisations up to risk of industrial espionage and even threaten national security, quite apart from more mundane, but nevertheless serious data protection regulatory issues (GDPR being the most obvious).

 

Athletes advised to use burner phones for security reasons

To add to those threats, if people travel abroad they may find their devices compromised by lapses in local security. A recent case in point was athletes and teams taking part in the Winter Olympics in China. Many governments advised people to take burner phones and hire laptops once there, rather than risk their own devices becoming compromised. Full story here: https://www.bbc.co.uk/news/world-asia-china-60034013

Burner phones create additional security issues

This raises an important point, that of the additional complexity posed by the use of burner phones.  Typically they are bought in country, used and disposed of prior to return. These phones, usually Android, for cost reasons, should be considered unsafe because their provenance cannot be certain. Using apps on such phones can create undue risk and uncertainty as they may have been ‘jailbroken’ (modified to remove restrictions imposed by the manufacturer, to allow the installation of unauthorised software) or contain potentially malicious apps from local carriers or distributors.

 

Managing BYOD without MDM

True BYOD devices that are owned by the employee create a different challenge. Employees do not like the fact that their employer might wish to take control of their personal device with a Mobile Device Management (MDM) solution, and so have the ability to restrict the use of the capability of the device e.g. disable the camera. However, the concerns around corporate data being held on a device that is not owned or controlled by the business must still be addressed – something that Armour can do without the need for a full MDM solution.

 

How Armour helps

Armour Mobile and SigNet by Armour provide a mobile comms solution that completely isolates the communications and any associated data, metadata or files (attachments such as documents, images, video clips). All data is encrypted and secured within the app protecting contacts, messages and attachments from malware on the device or if the device is lost or stolen. The ultimate goal is to minimise the organisation’s risk by reducing the residual data held on the device. Armour’s products are Secure By Design, for example technology in the app requires sole use of the microphone ensuring rogue apps are not ‘listening’ in to voice or video calls.

In addition, before the app can be used, the Armour software checks to see if the device has been jailbroken, if so, the user will not be able to use the Armour app.

Armour provides its own viewers for certain types of attachments, so as not to share information with the operating system or third-party viewers, and preventing the user from sharing the attachment (and its sensitive information) outside of the Armour app, thus avoiding the potential for data leakage.

To avoid the use of the public internet and untrusted, insecure networks, the Armour apps can be installed in a variety of ways. Depending on the specific use case requirements this can include via SD card or via a completely closed VPN network (using additional technology from Armour technology partners).

Armour Mobile and SigNet also include many security features within the app to protect against data leakage.  This includes the Message Burn and Disappearing Messages features, where the sender of a message can set it to automatically delete at a set time, either after it has been read, or after it has been sent.  This feature can be deployed as a standard setting across chat groups or communities of users.

In the coming months we will deliver the capability to remote wipe any data held within the Armour app on devices that have been lost, stolen or otherwise compromised and in addition will have the ability to centrally control the length of time messages are available to be accessed on phones.

For more information about how Armour can help you to ensure secure communications even when using BYOD devices, contact us today: sales@armourcomms.com

Posted on

SigNet by Armour v3.3 introduces secure group video calls and upgrades enterprise features to improve licencing and usability

Latest release of Armour’s WhatsApp replacement product extends user management capabilities for easier enterprise deployments and a raft of features for greater user adoption

London, UK, 25 April 2022 – Armour Comms has announced the latest version of SigNet by Armour®, its enterprise-grade WhatsApp replacement platform. SigNet v3.3 includes enhancements to streamline the administration of enrolling new users, license management and managing groups, saving time for IT and security. The new version also includes many end-user improvements designed to boost user-adoption which in turn increases security around communication of sensitive information. SigNet now supports up to 8 participants on a group secure video call.

David Holman, Director at Armour Comms said; “SigNet by Armour was developed for enterprises looking to increase security around the use of informal messaging and communications apps, and to provide a replacement solution for consumer-grade apps, that staff will be highly motivated to use. The extension of secure video capabilities for up to eight people that can be used from a mobile device or desktop is a significant enhancement that will enable enterprises to mandate the use of SigNet for all business conversations.”

“Every organisation has sensitive commercial information to protect, and this can now be shared securely, and conveniently, with colleagues using SigNet without ever using an email service or consumer app. Users love the ease of use and anonymity of SigNet, where there is no requirement to provide their mobile phone number as their unique identifier.”

Group Management:

Chat groups within SigNet v3.3 have admin account capabilities for configuring and managing the group by adding and removing users, permission control, and appointing new admins.

Licensing

SigNet v3.3 strengthens enterprise licensing, with license expiry messaging and multiple licence support and management. If an employee leaves or is no longer required to use SigNet the license can be redeployed to a new user, similarly if a device is lost or stolen, the license is rescinded and can be re-used. This new feature enables enterprises to more tightly control licenses and the associated costs, particularly for an on-premises implementation.

A new ‘last seen’ facility indicates if a contact is currently online or displays the last time the contact used the application. This is helpful for end-users and enables administrators to identify where licenses are not being used, and therefore not required.

Group Calling

Group audio and video calls are now supported for up to 8 people to be involved in the same call/video at any one time. When first using the feature users are prompted to grant camera and microphone permissions. With three or more participants, users have the option of a grid layout or a view that focuses on the active speaker by simply swiping up or down whilst in a group call.

@Mentions

The @Mentions feature is now supported, simply typing “@” and selecting the name from the picker allows the user to get someone’s attention. People mentioned in this way can quickly jump to the message at the click of a button. Users can set their notifications if they wish to receive an alert when they are mentioned.

Enterprise Benefits of SigNet by Armour

SigNet provides secure comms for voice, text, messaging, video and attachments, with Disappearing Messages (timed deletion of messages sent). All communications including attachments are encrypted using 256-bit AES encryption.

Increasing Security Awareness – Using SigNet encourages a culture of heightened security awareness amongst employees while also protecting user anonymity and privacy.

One-step provisioning – end-users simply download the app, and they can start using it straight away once provisioned by IT using a one-time use QR code.

Strong user adoption rates – the app is so easy and intuitive to use, people like it and are happy to use it.

Anonymity and protection of privacy – users do not need to reveal their mobile number, email address or even full name in order to use the app.

Use across multiple linked devices – the same instance of the app can be installed on desktop, laptop, tablet and mobile, so that information can be shared across devices securely, without the need to use email.

Desktop instance – the app can be used by desk-based employees on PCs and laptops, which is often more convenient than using a mobile device.

Note to Self facility – voice-to-text notes and reminders are held within the app, and can be shared with linked devices.

Ultra secure sharing of information – documents for signature, instructions or commercial details can be shared via SigNet, meaning that the use of email systems or printed sensitive documents can be avoided. Users receive a timestamp when a screenshot is taken of a message they have sent, ensuring they retain full visibility of exactly where information and data has gone.

SigNet by Armour supports IPv6, the latest network communications protocol, enabling calls to seamlessly transition between modern networks.

SigNet is available as a Software as a Service (SaaS) product hosted on Armour’s secure cloud, or as an on-premises installation, and uses a peer-to-peer key management system.

Posted on

Armour achieves Cyber Essentials Plus

Cyber Essentials Plus 

As a cyber security vendor, and an advocate for a Secure by Design approach to developing products and services, we believe that validation by independent third parties is an important process, and one that generates many benefits, not just for ourselves but our customers too.  We are committed to continually improving our internal processes to ensure that they are of the highest quality and stand up to external scrutiny.  We are therefore delighted to announce that we have now achieved Cyber Essentials Plus certification for our whole organisation.

Cyber Essentials is a government backed scheme that helps organisations to protect themselves from a whole range of cyber attacks. There are two levels of certification:

Cyber Essentials, which is a self assessment framework (which we’ve held since 2017)

Cyber Essentials Plus, the higher level of certification which includes additional external technical verification.

More details here: https://www.ncsc.gov.uk/cyberessentials/overview.

We undertook this extra level of certification to provide additional peace of mind to our customers that our internal standards of cyber security comply with industry best practice. In submitting to a thorough and rigorous external verification, we also received feedback, which is a highly valuable part of the process.

Cyber Essentials Plus (CE+) certification is completed annually, and as such, demonstrates our continual commitment to ensure our processes are constantly evolving and improving.  CE+ complements our ISO27001 certification – a proven methodology for ensuring processes are security focused – achieved in March 2021.

Secure by Default is in our DNA

At Armour, Secure by Design and Secure by Default principles are in our very DNA.  We’ve been working with the NCSC for many years to ensure that our products conform to the appropriate industry standards, and are designed with the end user in mind. If a security product isn’t easy to use, then it isn’t a security product (because the end user will simply find something that is easy to use instead).

Cyber Essentials Plus is the latest milestone in our mission to demonstrate that we practice what we preach – our internal processes have been validated as cyber secure. This focus on external certification fosters a cyber-aware environment for our employees so that they are able to deliver great products that are Secure by Design, directly address the real-world challenges of secure communications, and that people enjoy using.

For more about Secure by Default, Secure by Design and the NCSC’s Principles Based Assurance read our blog: The Future of Technical Assurance