Home
›
Security Overview

Security Overview

Hypori delivers a robust security posture centered around its virtual mobile infrastructure (VMI) solution, Hypori. The platform is designed to provide secure access to enterprise resources from personal devices without storing any data on the user’s device. This overview highlights the key components of Hypori's security architecture, strategies for mitigating threats, and compliance with stringent security standards.

Zero Trust Architecture

Hypori implements a zero-trust architecture, which assumes no implicit trust and verifies each request as though it originates from an open network. This approach minimizes the attack surface and enhances security by requiring continuous authentication and validation of all operational transactions and system interactions.

Zero trust is built on the principle of "never trust, always verify," which is crucial in mobile device management (MDM), where devices often operate outside the organization's physical and network security perimeters.

Benefits of Hypori’s Zero Trust Approach

The zero-trust model implemented by Hypori offers several advantages over traditional mobile device management systems:

  • Enhanced Security: By not trusting any device by default and requiring continuous verification, Hypori minimizes the attack surface.
  • Scalability: Hypori's cloud-based model and zero-trust architecture easily scale to manage an increasing number of devices without compromising security.
  • Reduced Costs: Eliminates the need for extensive device management and security software on individual mobile devices, reducing operational costs.

In summary, Hypori’s zero-trust approach to mobile device management fundamentally changes how security is structured, offering a more secure, scalable, and cost-effective solution for managing enterprise mobile devices. This approach ensures that security does not rely on the perimeter but on continuous verification and stringent access controls.

Principles of Zero Trust

Zero-trust security does not inherently trust any entity inside or outside the network perimeter at any time. It requires continuous verification of the operational and security state of all resources, regardless of location. Here are the fundamental principles of a zero-trust approach applied to mobile device management:

  • Least Privilege Access: Only grant access rights essential for the performance of a given task. This minimizes each user's exposure to sensitive parts of the network.
  • Micro Segmentation: The network is segmented into small zones to maintain separate access for different parts of the network. Each segment requires separate access permissions and is controlled stringently.
  • Multi-Factor Authentication (MFA): Requires users to provide two or more verification factors to gain access, which significantly reduces the chance of unauthorized access.

Hypori implements zero-trust principles by ensuring that no data is stored on user devices and secure data transmission standards are maintained. Here's how Hypori applies zero-trust principles specifically to its virtual mobile infrastructure (VMI).

No Data at Rest on User Devices

In traditional MDM solutions, securing data at rest on mobile devices is a significant concern. Hypori’s solution ensures that no enterprise data is stored on the user’s device. Instead, it hosts all operational applications and data in a secure cloud environment. This approach effectively eliminates the risk of data leakage from a lost, stolen, or compromised device because there is no data stored on the device to be exposed.

Pixel Streaming

Hypori utilizes a unique pixel streaming approach, where the user interface of a virtual device is rendered in the cloud and only the graphical output (in the form of pixels) is streamed to the user’s device. This means sensitive data and applications do not directly interact with the user's device. The interaction model limits data exposure and loss, as no usable data is transmitted that could be intercepted or leaked.

Secure Transmission with mTLS

Hypori employs Mutual Transport Layer Security (mTLS) for all data transmissions between the user’s device and the cloud-hosted environment. mTLS enhances the security of TLS by requiring both the client (user device) and the server (Hypori’s cloud services) to authenticate each other, ensuring a doubly secure connection. This method prevents unauthorized access and ensures that data in transit is encrypted and secure from interception or eavesdropping.

Secure Data Transmission

Data security during transmission is ensured through end-to-end encryption protocols. Hypori uses TLS (transport layer security) to create a secure encrypted channel between the user's device and the cloud-hosted virtual mobile device. This prevents interception or alteration of data in transit.

Encryption Standards:

  • mTLS (Mutual TLS): Enhances traditional TLS by requiring both the client and server to authenticate themselves to each other.
  • AES (Advanced Encryption Standard): Used for encrypting data, ensuring that sensitive information remains confidential and secure against unauthorized access.

Hardened Virtual Workspace

The core of Hypori’s service is its cloud-hosted virtual devices, which isolate enterprise applications and data from the end-user’s personal device. This isolation is crucial in preventing data leakage and protecting against malware that might be present on a personal device.

  • Policy Enforcement: Hypori uses an enhanced version of SELinux to host the virtualized Android environment. Using inherent policy enforcement, the Android OS cannot alter its configuration, nor can it run any executable software without expressed permission.
  • Network Segregation: Each virtual workspace is enabled with network access controls that separate traffic based on function using mTLS. Traffic to and from the Hypori Client App negotiates across a separate mTLS tunnel from traffic that accesses organizational resources. This traffic is separate from traffic accessing user storage or key management functions/ad services. Virtual workspaces cannot communicate directly with other virtual workspaces.
  • Data Protection: Each user’s data is encrypted within the data store and accessible only to the user. Admins do not have access to this data.
  • Key Protection: Hypori offloads key management and related cryptographic operations to a dedicated microservice, the Android-protected keystore, and key management services provided by the cloud service provider or a hardware security module. Private keys are encrypted with key-wrapping keys held by a FIPS 140-2 Level 2-certified key management service.

Results: As demonstrated during multiple Red Team and Pen Test events, given full insider credentials to access a virtual workspace, no malware can run in the environment, private keys could not be retrieved, and no component of the Hypori architecture could be enumerated or manipulated.

Authentication and Access Control

Hypori employs robust authentication mechanisms to ensure that only authorized users can access the virtual workspace. It supports various forms of authentication to accommodate organizational security requirements and user convenience.

Security Monitoring and Incident Response

Hypori's security strategy includes continuous monitoring and proactive threat detection to respond to potential security incidents swiftly. The platform uses advanced monitoring tools to track system performance and security, providing real-time alerts to prevent breaches.

Incident Response:

  • Automated Alerts: Systems are set to automatically alert security personnel of potential security events.
  • Rapid Containment: Procedures are in place to quickly isolate affected systems to prevent the spread of any breach.
  • Forensic Analysis: After an incident, a thorough investigation is conducted to determine the breach's cause and prevent future occurrences.