Windows Phone 8

Security Overview

This white paper is part of a series of technical papers designed to help IT professionals

evaluate Windows Phone 8 and understand how it can play a role in their organizations.

It discusses and contains information about Windows Phone 8 security.

October 2012

Windows Phone 8 Security Overview

Windows Phone 8 Security Overview

Legal Disclaimer

© 2012 Microsoft Corporation. All rights reserved. This document is provided "as-is." Information

and views expressed in this document, including URL and other Internet website references, may

change without notice. You bear the risk of using it.

This document does not provide you with any legal rights to any intellectual property in any

Microsoft product. You may copy and use this document for your internal, reference purposes.

Published: October 2012

Windows Phone 8 Security Overview

Windows Phone 8 Security Overview ---------------------------------- 1

WINDOWS PHONE SECURITY GOALS------------------------------------- 1

SYSTEM INTEGRITY ----------------------------------------------------- 1

APP PLATFORM SECURITY ---------------------------------------------- 2

DATA PROTECTION --------------------------------------------------- 5

SECURED ACCESS ----------------------------------------------------- 7

CONCLUSION -------------------------------------------------------- 7

RESOURCES ---------------------------------------------------------- 8

Table of Contents

Windows Phone 8 Security Overview

1

Windows Phone security goals

Distributed computer networks and increasing numbers of smartphones help

organizations be productive and competitive, but these technologies also require

increased security vigilance. The pervasive threat of malicious software, or malware,

and the need to prevent data leaks are two of the reasons why a thoughtful,

comprehensive security design is essential. Organizations require smartphones that

protect data when it is stored and when it is communicated, not only because their

business partners and customers expect it but also because of the need to comply

with the increasing number of laws and regulations that require security, privacy,

and confidentiality. Windows Phone 8 uses a defense-in-depth approach that

addresses security requirements in numerous ways.

System integrity

Secure boot and code signing help assure platform integrity of Windows Phone 8.

These features help to protect the Windows Phone 8 boot process and operating

system from malware attacks, especially rootkits, by allowing only validated

software components to execute. These features help deliver a secured platform

for application developers and corporate customers alike, and help assure

consumers that the information they care about is safe.

Secure boot

Secure boot is a technology that validates firmware images on Windows Phone

devices before they are allowed to load the operating system. Secure boot builds

on a chain of trust that extends to the hardware/firmware. All boot components

have digital signatures that are cryptographically validated from the pre-UEFI

(Unified Extensible Firmware Interface) boot loaders to the UEFI environment.

Secure boot helps to ensure that only authorized code can execute to initialize the

device and load the Windows Phone operating system.

Windows Phone architecture uses a System-on-a-Chip (SoC) design provided by

SoC vendors. The pre-UEFI boot loaders and the UEFI environment are provided by

the SoC vendor and device manufacturers. The UEFI environment implements the

UEFI secure boot standard described in section 27 of the UEFI specification

Windows Phone 8 Security Overview

2

(http://www.uefi.org/specs/). This standard describes a process by which all UEFI

drivers and applications are validated against keys provisioned into a UEFI runtime

variable before they are executed.

The UEFI and Windows (http://msdn.microsoft.com/en-

us/windows/hardware/gg463149.aspx) document on MSDN describes the

advantages of using UEFI and how UEFI is supported by desktop versions of the

Windows operating system. Although the document focuses on UEFI and

Windows, most of the information in the document also applies to Windows

Phone.

Extended secure boot

Microsoft provides the Windows Phone boot manager in the UEFI environment.

After the pre-UEFI and UEFI components complete their boot processes, the boot

manager takes over to complete the boot process so the user can start using the

smartphone. All code in the Windows Phone operating system is signed by

Microsoft, including OEM drivers and applications. Also, applications that are

added after manufacturing or installed from the Windows Phone Store or a private

enterprise store must be properly signed to execute.

Secure boot and code signing are the primary ways that Windows Phone 8 helps to

protect the integrity of the operating system, but they are not the only security

controls built into the phone to help prevent malware from taking over.

App platform security

Viruses and other forms of malware on some smartphone platforms are a growing

concern for IT professionals today, in addition to concerns about information

disclosure and compliance. These concerns are amplified by the increasing number

of smartphones that are used to connect to corporate networks.

Microsoft takes a multi-pronged approach to help protect Windows Phone 8 devices

against malware. One aspect of this approach is the secure boot process described in

the previous section that helps to prevent rootkit installation.

Chambers and capabilities

The Windows Phone security model utilizes a chamber concept, which is based on

the principle of least privilege and uses isolation to achieve it; each chamber

Windows Phone 8 Security Overview

3

provides a security boundary and, through configuration, an isolation boundary

within which a process can run. Each chamber is defined and implemented using a

policy system. The security policy of a specific chamber defines what operating

system capabilities the processes in that chamber can use. A capability is a resource

for which user privacy, security, cost, or business concerns exist with regard to

Windows Phone use. Examples of capabilities include geographical location

information, camera, microphone, networking, and sensors.

Every app on Windows Phone (including both Microsoft apps and non-Microsoft

apps) runs in its own isolated chamber that is defined by the declared capabilities

that the app needs to function. A basic set of permissions is granted to all app

chambers by default, including access to isolated storage. However, the set of

permissions for a chamber can be expanded by using capabilities that are granted

during app installation. App permissions cannot be elevated at run time.

The chamber concept is advantageous for the following reasons:

Attack surface reduction. Each app receives capabilities needed to perform all

its use cases, but no more.

User consent and control. Each app discloses its capabilities to the user on the

app details page in the Windows Phone Store, and it provides an explicit

prompt upon app installation for those capabilities that have legal

requirements for explicit disclosure and specific consent collection, such as

geographic location.

Isolation. No communication channels exist between apps on the phone other

than through the cloud. Apps are isolated from each other and cannot access

memory used or data stored by other applications, including the keyboard

cache.

The browser

Windows Phone 8 includes Internet Explorer 10 for Windows Phone. Because

viruses can be downloaded by merely visiting infected websites, Microsoft took the

approach of making the browsing experience safer.

Internet Explorer helps to protect the user because it runs in an isolated chamber

and prevents web apps from accessing other app resources. In addition, Internet

Explorer does not support a plug-in model, so malicious plug-ins cannot be

installed.

Finally, the SmartScreen technology that was available in previous versions of

Internet Explorer is now also available in Internet Explorer for Windows Phone. This

technology warns users of websites that are known to be malicious.

Windows Phone 8 Security Overview

4

Windows Phone Store

Microsoft uses a carefully architected Store submission and approval process to

prevent malware from reaching the Store. All Windows Phone apps submitted to

the Store are certified before they are made available to users for downloading and

installation. The developer is validated and the certification process checks

Windows Phone apps for inappropriate content, Store policies, and security issues.

This process plays an important role in protecting Windows Phones against

malware. In addition, Microsoft scans all apps for viruses before publication.

Although most malware exists on the Internet, apps that are developed in

unmanaged environments with minimal security precautions could be unwitting

transmitters of malware. Apps are also signed during the certification process,

which is required for apps to be installed and run on Windows Phones.

Enterprise line-of-business (LOB) apps

Although users obtain apps from the Windows Phone Store, organizations want

the ability to distribute custom LOB apps that have been developed for their

employees. With Windows Phone 8, Microsoft delivers this capability.

Organizations can register with Microsoft to obtain the tools to privately sign and

distribute apps, and they are no longer required to submit business apps to the

Windows Phone Store before deploying them. With registration comes the ability

to privately develop, package, sign, and distribute apps to employees using a

validated process.

Windows Phone updates

The Windows Phone update service is the only source of updates for the Windows

Phone operating system. Microsoft manages and distributes feature updates and

bug fixes that originate from hardware manufacturers and the Windows Phone

engineering team. In addition, the Windows Phone team has developed security

review processes with the Microsoft Security Response Center to deliver critical

security updates to all Windows Phones globally if high-impact vulnerabilities are

discovered.

Also, Windows Phone was designed using the Microsoft Security Development

Lifecycle (SDL). SDL is a software development security assurance process used by all

Microsoft engineering teams that includes extensive threat modeling, penetration

Windows Phone 8 Security Overview

5

testing, and security development practices, all of which help prevent unauthorized

access to phone resources.

Data protection

Microsoft understands that organizations of all sizes need to protect the

confidentiality and integrity of their data. Users who store personal information or

conduct transactions using their smartphones have the same need. The Windows

Phone security design addresses the need for data protection by mitigating the risk

of unauthorized data access or unintended information disclosure.

In addition, every Windows Phone includes by design the same set of management

and security controls, regardless of hardware manufacturer, which enables

organizations to manage all Windows Phones in a consistent, predictable way to

mitigate risk.

Device access and security policies

As a first line of defense, access to a Windows Phone can be controlled through a

PIN or password. A user can set a PIN or password via the settings panel to lock

their phone.

In addition, IT departments can use Exchange ActiveSync policies to require users

to set PINs or passwords, and also to configure additional password policies to

manage password length, complexity, and other parameters. Exchange ActiveSync

policies can also be used to configure additional security functionality.

Many organizations worldwide currently use Exchange Server, so Microsoft chose

to focus on Exchange infrastructure to achieve the broadest possible reach.

Exchange ActiveSync is communications protocol that provides Windows Phone

users with mailbox synchronization functionality. Windows Phone 8 is compatible

with version 14.1 of the Exchange ActiveSync protocol and supports synchronizing

email, calendar, task, and contact information with Exchange Server 2003 SP2 and

subsequent releases or with Microsoft Office 365.

In addition, Windows Phone 8 has a built-in device management client that can be

used by a mobile device management system to set policy on the phone. More

details will be available at a later date.

If a Windows Phone is lost or stolen, IT professionals can initiate a remote wipe of

the device by using the Exchange Server Management Console, and users can

initiate a remote wipe of the device by using Outlook Web App. In addition, users

Windows Phone 8 Security Overview

6

can locate a lost phone, map its location, make it ring, and wipe its data if they

register the phone with windowsphone.com.

Device encryption

To help keep everything from documents to passwords safe, Windows Phone 8

encrypts the internal storage of the device, including the operating system and

data partitions. Device encryption is enabled by EAS or device management policy.

Device encryption in Windows Phone 8 uses BitLocker technology to encrypt all

internal data storage on the phone. Once enabled, BitLocker conversion

automatically starts encrypting the internal storage. With both PIN-lock and

BitLocker enabled, the combination of data encryption and device lock would make

it extremely difficult for an attacker to recover sensitive information from a device.

Removable storage

Windows Phone 8 supports removable storage using micro SD cards, so users can

easily extend the memory of their phones to store pictures, movies, or music when

needed. However, the Windows Phone operating system prevents users from

storing anything but media files on SD cards.

Although the Windows Phone 8 operating system and user data partitions are

encrypted, files on SD cards that are inserted in the phone are not encrypted.

IT professionals can prevent the use of external storage cards on Windows Phones

by configuring a policy setting.

Data leak prevention

IT professionals wanting to prevent leaks of intellectual property should consider

using Information Rights Management (IRM), which allows content creators to

assign rights to documents that they send to others. The data in rights-protected

documents is encrypted so that it can be viewed only by authorized users. In

addition, a rights-protected document stores an issuance license that specifies the

rights that users have to the content. For example, authors can specify that the

document is read-only, that text in the document cannot be copied, or that the

document cannot be printed.

IRM relies on Windows Rights Management Services (RMS), a Windows Server-

based technology that IT pros can configure to create the issuance license and

Windows Phone 8 Security Overview

7

perform the encryption and decryption of rights-protected documents. In addition,

RMS can be applied to email so that messages can circulate in a protected

environment but not be forwarded outside of the organization. RMS can also be

applied to documents that are attached to email or stored on Microsoft SharePoint

servers, limiting distribution and editing capabilities and helping to prevent

information from being leaked to unauthorized personnel.

Windows Phone users can fully participate in IRM conversations and read IRM

documents on their phones. Windows Phone is the only smartphone currently

available that includes a built-in capability to handle rights-protected email and

documents.

Secured access

Windows Phone is built to take full advantage of cloud-based services. At first use,

the user is prompted to enter Microsoft account information to access and connect

to web services that enable many of its engaging capabilities, such as access to

personal email, the Windows Phone Store, SkyDrive, and many more.

Data synchronization between Windows Phone and most cloud services or on-

premises servers uses an SSL connection. All network traffic for critical Windows

Phone business apps, such as Exchange Server and SharePoint, is encrypted using

128-bit or 256-bit AES encryption. This use of encryption applies to on-premises

server deployments as well as to Office 365 deployments. And most third-party or

custom business apps on Windows Phone also use the SSL encryption

infrastructure to protect information in transit.

Conclusion

Because mobile devices are used to communicate and store corporate data,

personally identifiable information, and intellectual property, Microsoft has applied

the strictest security standards to design and develop Windows Phone.

Windows Phone 8 secure boot and code signing provide system integrity, and the

chambered security model is the foundation for protecting confidential data.

Building on this foundation, the combination of full-device encryption and device

access policies establishes a powerful security model that can withstand many

attacks. In-depth protection against mobile malware creates an environment that

creates trust.

Windows Phone 8 Security Overview

8

Resources

For more information about all the aspects of using Windows Phone in your

company, see, Windows Phone for Business (http://www.windowsphone.com/en-

US/business/for-business).

To learn more about the Security Development Lifecycle, see

www.microsoft.com/security/sdl/default.aspx. Additional information is available in

the following articles:

“Understanding Information Rights Management” at

http://technet.microsoft.com/en-us/library/dd351035.aspx

“How IRM works in Office and Exchange Server” at

http://technet.microsoft.com/en-us/library/cc179103.aspx

“Understanding IRM with Exchange ActiveSync” at

http://technet.microsoft.com/en-us/library/ff657743.aspx