On July 23, BlackBerry hosted its second annual Security Summit, once again in New York City. As with last year's event, this was a relatively intimate gathering of analysts and IT journalists, brought together for the lowdown on BlackBerry's security and privacy vision.
By his own account, CEO John Chen has met plenty of scepticism over his diverse and, some say, chaotic product and services portfolio. And yet it's beginning to make sense. There is a strong credible thread running through Chen's initiatives. It all has to do with the Internet of Things.
Disclosure: I traveled to the Blackberry Security Summit as a guest of Blackberry, which covered my transport and accommodation.
The Growth Continues
In 2014, John Chen opened the show with the announcement he was buying the German voice encryption firm Secusmart. That acquisition appears to have gone well for all concerned; they say nobody has left the new organisation in the 12 months since. News of BlackBerry's latest purchase - of crisis communications platform AtHoc - broke a few days before this year's Summit, and it was only the most recent addition to the family. In the past 12 months, BlackBerry has been busy spending $150M on inorganic growth, picking up:
- Secusmart - voice & message encryption (announced at the inaugural Security Summit 2014)
- Movirtu - innovative virtual SIM solutions for holding multiple cell phone numbers on one chip
- Watchdox - document security and rights management, for "data centric privacy", and
- Athoc (announced but not yet complete; see more details below).
Chen has also overseen an additional $100M expenditure in the same timeframe on organic security expansion (over and above baseline product development). Amongst other things BlackBerry has:
- Rekindled Certicom, a specialist cryptography outfit acquired back in 2009 for its unique IP in elliptic curve encryption, and spun out a a new managed PKI service.
- And it has created its own Enterprise Identity-as-a-Service (IDaas) solution. From what I saw at the Summit, BlackBerry is playing catch-up in cloud based IDAM but they do have an edge in mobility over the specialist identity vendors in what is now a crowded identity services marketplace.
The Growth Explained - Secure Mobile Communications
Executives from different business units and different technology horizontals all organised their presentations around a now comprehensive product and services matrix. It looks like this (before adding AtHoc assuming that deal closes):
And so the BlackBerry theme makes good sense: they're striving to lead in Secure Mobile Communications. In that context, for me, the highlights of the Security Summit were as follows.
The Internet of Things
BlackBerry's special play is in the Internet of Things. It's the consistent theme that runs through all their security investments, because as COO Marty Beard says, IoT involves a lot more than machine-to-machine communications. It's more about how to extract meaningful data from unbelievable numbers of devices, with security and privacy. That is, IoT for BlackBerry is really a security-as-a-service play.
Chief Security Officer David Kleidermacher repeatedly stressed the looming challenge of "how to patch and upgrade devices at scale".
MyPOV: Functional upgrades for smart devices will of course be part and parcel of IoT, but at the same time, we need to work much harder to significantly reduce the need for reactive security patches. I foresee an angry consumer revolt if things that never were computers start to behave and fail like computers. A radically higher standard of quality and reliability is required. Just look at the Jeep Uconnect debacle, where it appears Chrysler eventually thought better of foisting a patch on car owners and instead opted for a much more expensive vehicle recall. It was BlackBerry's commitment to ultra high reliability software that really caught my attention at the 2014 Security Summit, and it convinces me they grasp what's going to be required to make ubiquitous computing properly seamless.
Notably, COO Beard preferred to talk about economic value rather than the bazillions of devices we are all getting so jaded about. He said the IoT would bring about $4 trillion of required technology within a decade, and that the global economic impact could be $11 trillion.
BlackBerry's real time operating system QNX is in 50 million cars today.
AtHoc
AtHoc is a secure crisis communications service, with its roots in the first responder environment. It's used by three million U.S. government workers today, and the company is now pushing into healthcare.
Founder and CEO Guy Miasnik explained that emergency communications involves more than just outbound alerts to people dealing with disasters. Critical to crisis management is the secure inbound collection of info from remote users. AtHoc is also not just about data transmission (as important as that is) but it works also at the application layer, enabling sophisticated workflow management. This allows procedures for example to be defined for certain events, guiding sets of users and devices through expected responses, escalating issues if things don't get done as expected.
"CHACE"
We heard more about BlackBerry's collaboration with Oxford University on the Centre for High Assurance Computing Excellence, first announced in April at the RSA Conference. CHACE is concerned with a range of fundamental topics, including formal methods for verifying program correctness (an objective that resonates with BlackBerry's secure operating system division QNX) and new security certification methodologies, with technical approaches based on the Common Criteria of ISO 15408 but with more agile administration to reduce that standard's overhead and infamous rigidity.
CSO Kleidermacher announced that CHACE will work with the Diabetes Technology Society on a new healthcare security standards initiative.
The need for improved medical device security was brought home vividly by an enthralling live demonstration of hacking a hospital drug infusion pump. These vulnerabilities have been exposed before at hacker conferences but BlackBerry's demo was especially clear and informative, and crafted for a non-technical executive audience.
MyPOV: The message needs to be broadcast loud and clear: there are life-critical machines in widespread use, built on commercial computing platforms, without any careful thought for security. It's a shameful and intolerable situation.
Wither the handset?
There was an elephant in the room for most of the day, and that was handsets. Several hours passed before anyone from BlackBerry even mentioned a handset. In the media Q&A session over lunch, the question on many minds was eventually given voice: should BlackBerry get out of handsets altogether?
The answers at first were stilted and unconvincing. They said the corporate strategy was all about profitability not product; they said the Summit was focused on security platforms not cell phone features. But John Chen later gave what was to my mind the most credible explanation. He plainly insists that BlackBerry continues to support the things that have been sold to customers, and that includes an ongoing commitment to the handset product line.
Privacy
I was impressed by BlackBerry's privacy line. It's broader and more sophisticated than most security companies, going way beyond the obvious matters of encryption and VPNs. In particular, the firm champions identity plurality. WorkLife by BlackBerry, powered by Movirtu technology, realizes multiple identities on a single phone. BlackBerry is promoting this capability in the health sector especially, where there is rarely a clean separation of work and life for professionals. Chen said he wants to "separate work and private life".
The health sector in general is one of the company's two biggest business development priorities (the other being automotive). In addition to sophisticated telephony like virtual SIMs, they plan to extend extend AtHoc into healthcare messaging, and have tasked the CHACE think-tank with medical device security. These actions complement BlackBerry's fine words about privacy.
Conclusion
So BlackBerry's acquisition plan appears to have gelled. It now has perhaps the best secure real time OS for smart devices, a hardened device-independent Mobile Device Management backbone, new data-centric privacy and rights management technology, remote certificate management, and multilayered emergency communications services that can be diffused into mission critical rules based M2M messaging. It's a powerful portfolio that makes strong sense in the Internet of Things.
BlackBerry says IoT is 'much more than device-to-device'. It's more important to be able to manage secure data being ejected from ubiquitous devices in enormous volumes, and to service those things - and their users - seamlessly. For BlackBerry, the Internet of Things is really all about the service.
