Category: Blog

We are delighted to announce that Unity by Armour has been shortlisted for an SC Award for Best Communications Security Solution.

Unity is the third Armour product to be a finalist, and it is the 5^th year in a row that we have been shortlisted.  Armour Mobile won the award for Best Mobile Security Solution in 2019 and SigNet and Armour Mobile were Highly Commended in the same category in 2021.

Enterprise Conferencing that’s more secure and easier to use

Unity by Armour® delivers secure conferencing in an easy-to-use app for mobile and desktop use, with enterprise security features not provided by free-to-use consumer products including a choice of cloud or on-premises installation to ensure data sovereignty. Unity is available in several configurations to ensure the level of security matches the sensitivity of the conversation. Unity combats the issue of ghost callers that may eavesdrop on sensitive conversations by highlighting to all users whether a participant has joined the call via an app, or securely via a browser –browser options often increase vulnerabilities.

Unity extends the Armour ecosystem by working in conjunction with Armour Mobile to provide pre-defined or on-the-fly secure video conferencing, screen sharing and integration with secure chat groups and interconnectivity with trusted unified communications systems.

Unity delivers picture-in-picture and multiple screens, and offers a familiar video conferencing interface, making it easy and intuitive to use.

If your organisation needs a conferencing tool with enterprise capabilities and security credentials to match, call us today to find out more

Tel: +44(0)20 36 37 38 01

Managing corporate data on Bring Your Own Devices (BYOD) has been a thorny issue for years. Businesses and employees alike appreciate the convenience of people using their own devices, and in fact, the organisation probably doesn’t have much choice in the matter without taking draconian measures. However, protecting sensitive information that finds its way onto unmanaged devices can open organisations up to risk of industrial espionage and even threaten national security, quite apart from more mundane, but nevertheless serious data protection regulatory issues (GDPR being the most obvious).

Athletes advised to use burner phones for security reasons

To add to those threats, if people travel abroad they may find their devices compromised by lapses in local security. A recent case in point was athletes and teams taking part in the Winter Olympics in China. Many governments advised people to take burner phones and hire laptops once there, rather than risk their own devices becoming compromised. Full story here: https://www.bbc.co.uk/news/world-asia-china-60034013

Burner phones create additional security issues

This raises an important point, that of the additional complexity posed by the use of burner phones.  Typically they are bought in country, used and disposed of prior to return. These phones, usually Android, for cost reasons, should be considered unsafe because their provenance cannot be certain. Using apps on such phones can create undue risk and uncertainty as they may have been ‘jailbroken’ (modified to remove restrictions imposed by the manufacturer, to allow the installation of unauthorised software) or contain potentially malicious apps from local carriers or distributors.

Managing BYOD without MDM

True BYOD devices that are owned by the employee create a different challenge. Employees do not like the fact that their employer might wish to take control of their personal device with a Mobile Device Management (MDM) solution, and so have the ability to restrict the use of the capability of the device e.g. disable the camera. However, the concerns around corporate data being held on a device that is not owned or controlled by the business must still be addressed – something that Armour can do without the need for a full MDM solution.

How Armour helps

Armour Mobile and SigNet by Armour provide a mobile comms solution that completely isolates the communications and any associated data, metadata or files (attachments such as documents, images, video clips). All data is encrypted and secured within the app protecting contacts, messages and attachments from malware on the device or if the device is lost or stolen. The ultimate goal is to minimise the organisation’s risk by reducing the residual data held on the device. Armour’s products are Secure By Design, for example technology in the app requires sole use of the microphone ensuring rogue apps are not ‘listening’ in to voice or video calls.

In addition, before the app can be used, the Armour software checks to see if the device has been jailbroken, if so, the user will not be able to use the Armour app.

Armour provides its own viewers for certain types of attachments, so as not to share information with the operating system or third-party viewers, and preventing the user from sharing the attachment (and its sensitive information) outside of the Armour app, thus avoiding the potential for data leakage.

To avoid the use of the public internet and untrusted, insecure networks, the Armour apps can be installed in a variety of ways. Depending on the specific use case requirements this can include via SD card or via a completely closed VPN network (using additional technology from Armour technology partners).

Armour Mobile and SigNet also include many security features within the app to protect against data leakage.  This includes the Message Burn and Disappearing Messages features, where the sender of a message can set it to automatically delete at a set time, either after it has been read, or after it has been sent.  This feature can be deployed as a standard setting across chat groups or communities of users.

In the coming months we will deliver the capability to remote wipe any data held within the Armour app on devices that have been lost, stolen or otherwise compromised and in addition will have the ability to centrally control the length of time messages are available to be accessed on phones.

For more information about how Armour can help you to ensure secure communications even when using BYOD devices, contact us today: sales@armourcomms.com

Cyber Essentials Plus 

As a cyber security vendor, and an advocate for a Secure by Design approach to developing products and services, we believe that validation by independent third parties is an important process, and one that generates many benefits, not just for ourselves but our customers too.  We are committed to continually improving our internal processes to ensure that they are of the highest quality and stand up to external scrutiny.  We are therefore delighted to announce that we have now achieved Cyber Essentials Plus certification for our whole organisation.

Cyber Essentials is a government backed scheme that helps organisations to protect themselves from a whole range of cyber attacks. There are two levels of certification:

Cyber Essentials, which is a self assessment framework (which we’ve held since 2017)

Cyber Essentials Plus, the higher level of certification which includes additional external technical verification.

More details here: https://www.ncsc.gov.uk/cyberessentials/overview.

We undertook this extra level of certification to provide additional peace of mind to our customers that our internal standards of cyber security comply with industry best practice. In submitting to a thorough and rigorous external verification, we also received feedback, which is a highly valuable part of the process.

Cyber Essentials Plus (CE+) certification is completed annually, and as such, demonstrates our continual commitment to ensure our processes are constantly evolving and improving.  CE+ complements our ISO27001 certification – a proven methodology for ensuring processes are security focused – achieved in March 2021.

Secure by Default is in our DNA

At Armour, Secure by Design and Secure by Default principles are in our very DNA.  We’ve been working with the NCSC for many years to ensure that our products conform to the appropriate industry standards, and are designed with the end user in mind. If a security product isn’t easy to use, then it isn’t a security product (because the end user will simply find something that is easy to use instead).

Cyber Essentials Plus is the latest milestone in our mission to demonstrate that we practice what we preach – our internal processes have been validated as cyber secure. This focus on external certification fosters a cyber-aware environment for our employees so that they are able to deliver great products that are Secure by Design, directly address the real-world challenges of secure communications, and that people enjoy using.

For more about Secure by Default, Secure by Design and the NCSC’s Principles Based Assurance read our blog: The Future of Technical Assurance

The NCSC has now unveiled its vision for the future of assuring high technology products including secure communications systems such as Armour Mobile.  In its recently published white paper NCSC has announced its Principles Based Assurance (PBA).

In a fast-moving, more connected world, assurance needs to cope with the ever-evolving landscape of threats and technologies.  The NCSC has developed a methodology that is more flexible and agile than the previous stance – which focused on specific product versions mitigating each defined threat by a defined means.

Principles Based Assurance enables a very practical approach that aims to set the basic tenets, by stipulating the outcomes – the ‘what’ – and then leave the ‘how’ to be devised by the vendors and suppliers who have expertise in their particular niche.  A pertinent example of this cited in the white paper is that ‘technology cannot silently default to operate insecurely’ – something we’ve seen time and again with consumer-grade communications apps.  By leaving the ‘how’ to the vendor community, the NCSC fosters innovation, a key point highlighted in the UK’s Integrated Review of Security, Defence, Development and Foreign Policy 2021.  It discusses the ambition of equipping our armed forces with cutting-edge cyber capability, which Armour Comms is already involved with through our work with the MOD.

The phrase ‘Secure by Default’ is central to this thinking, where security is designed into the product, without compromising the user experience.  Secure by Default is about taking a holistic approach to solving security problems at their root rather than treating the symptoms – this approach is embedded in every aspect of Armour’s development and service delivery.

Assurance in context

The new Principles aim to provide an assurance framework that takes account of the threats and risks that a given technology is looking to mitigate.  For example, Armour Mobile can be hosted within the Armour secure cloud, or can be delivered as an on-premises solution giving the end-user organisation total control over every aspect of the deployment and usage.  The decision would be made based on the customer’s level of risk appetite.

The principles will cover three key areas:

• Product design and functionality principles – describing the features a product needs to implement
• Product development principles – describing how a product should be designed, implemented and tested
• Through-life principles – describing the security measures that need to happen beyond development

The Secure by Default principles as prescribed by NCSC are:

• security should be built into products from the beginning, it can’t be added in later
• security should be added to treat the root cause of a problem, not its symptoms
• security is never a goal in and of itself, it is a process – and it must continue throughout the lifetime of the product

• security should never compromise usability – products need to be secure enough, then maximise usability
• security should not require extensive configuration to work, and should just work reliably where implemented
• security should constantly evolve to meet and defeat the latest threats – new security features should take longer to defeat than they take to build
• security through obscurity should be avoided
• security should not require specific technical understanding or non-obvious behaviour from the user.

Secure by Default is in our DNA

We’ve been working with NCSC for many years, indeed, our products were CPA certified while that scheme was applicable.  The Secure by Default principle is one that we’ve subscribed to since the early days of developing our Armour Mobile products (based on NCSC’s MIKEY-SAKKE key management) and our SigNet products (using alternative, leading edge cryptography).  With this in mind, we’ve achieved ISO27001 certification – a proven methodology for ensuring processes are security focused.  As well as a security-first approach to ensure that our products meet the requirements of our customers, they are also designed with the end user in mind, since usability is important to ensuring user engagement.  Feedback from our users is that people enjoy using the Armour secure collaboration products and find many more use cases for it than we originally imagined.

For more information about how Armour Comms can help your organisation to adopt a more secure approach to communications and collaborative working, contact us today

In these days when there is an app for just about everything, we’ve all grown used to downloading new software.  We expect to be able to use the app in question immediately for whatever it was that we first wanted it for.  But how often do we look at the detail, or explore what else the software can do?

Some geeky types do, but most of us just want to get on with our day, and we may well be missing out on some cool features that would save us time.

So, our geeky types have got together to provide edited highlights of the best ‘hidden gems’ within Armour Mobile and SigNet by Armour that could make your day a bit easier.

Contact Management Features

Armour Mobile includes several features to help with contact and list management.  Whether you want to set up a group for a one-off chat, set up a project group for on-going calls, or share contact details with a group, here are a couple of tips that will save you time.

A quick way to share contacts – using the paperclip

You can share contacts via message chat or by selecting export contacts and sharing as a message (if you still have the original contacts file stored within Armour Mobile).

While in the Message facility for both 1-to-1 and group chats it is possible to quickly send either individual contact details or a file of contact details to everyone in the chat session. Simply click on the paperclip icon at the bottom left-hand corner of the screen and select ‘Send Contact File’ or ‘Share Contacts’. If you select ‘Share Contacts’ you are presented with your contacts list from which you can select one or more contacts.  There are a couple of options, here.  You can either click on each entry you wish to share, or click on the box in the top right hand corner to select all contacts, you can then deselect people from the list (sometimes this will be quicker depending on how many contacts you wish to share).

When you have selected the contacts click on ‘Share’ at the bottom right-hand corner of the screen.  Once ‘Share’ has been clicked a new entry is shown in your message timeline, which summarises how many contacts your are sharing (good to check it is actually the number that you are expecting). Then click ‘Send’ to share with everyone in the conversation.

Export contacts to import later – for a new device or to set up a specific sub-group

You can export contacts as a file that can then be imported later on. This is useful for a new device or to set up a new group for a specific call, or an ongoing project.

A file of contacts can be created by selecting the ‘Settings’ option and then selecting ‘Contacts’ and from there selecting ‘Export Contacts’.  Your entire Contacts List is then displayed and you can use the buttons down the right hand side of the screen to select those entries you wish to include in the file (alternatively, click the box in the top right hand corner to select everyone, and then deselect any that you do not want). Choose the default option ‘Save to device’ and click on ‘Export’ in the top right-hand corner of the screen.

To protect all the sensitive details held in the Contacts file it’s essential to enter a high quality password to protect the file. Enter a password and then enter it again to confirm, then click on OK. The file is now saved with the name being the current date and time, for example: 2021-12-07-16-34.

Message Burn in Group Chat

As well as setting the Message Burn feature to delete messages after a set period of time for chats with individuals, it can also be used for group chats too, which saves time and is more secure.

In a group chat, at the bottom left-hand corner of the screen, just above where you type in new messages there is a small calendar+clock icon with the text ‘Message Burn: Never’. Click on the text to allow messages for the entire group to be deleted after a configurable period of time. This could be a number of days, hours or minutes.  Message Burn can be timed from when the message was read, or when the message was sent, and it can be applied to a single message or to all messages sent to the group.

‘Scan text’ facility in iOS 15

For those using an iOS 15 device, briefly touch the cursor in the text entry field and this will then display the text ‘Scan Text’. Touch this text and then the camera is triggered to enable you to use Optical Character Recognition (OCR) to scan text into a message.  This is a native feature of iOS 15 which we’ve included within Armour Mobile to provide a convenient and fast means of inputting text into a message.

Note to Self feature in SigNet

SigNet by Armour, our alternative product line to Armour Mobile, has a Note to Self feature which gets rave reviews from those that use it.  If you’ve woken up in the middle of the night with a brainwave, or think of something while in a meeting, send a note to yourself with SigNet. Simply go to the ‘Chats’ section – select from the bottom of the screen, and click on the ‘Note to Self’ option.  From here you can send yourself a message, either in text, as a recording or a photo. The note will also appear on any connected devices, including your Windows desktop.