Integrate Mobile Threat Defence into Microsoft Intune

Transcription

1 Integrate Mobile Threat Defence into Microsoft Intune Tom Klaver

2 Tom Klaver Senior Consultant InSpark Modern Workplace

3 Integrate MTD in MS Intune

4 Integrate MTD in MS Intune

5 Integrate MTD in MS Intune

6 Integrate MTD in MS Intune

7 How are you protecting your corporate data? APPS DEVICE NETWORK WEB & CONTENT Selected, purchased, and managed by company Selected, purchased, and managed by company LAN / corporate Wi-Fi VPN when traveling Filtered at corporate perimeter PC - Anti-Virus - Data Lost Prevention - Vulnerability scanning - Administered by IT - Managed by SCCM - OS version control - OS integrity monitoring - Behavioral monitoring - On device firewalls - Corporate perimeter firewall - Secure Web Gateways Selected, purchased, and managed by user Corporate issued and BYOD Always on cellular User selected Wi-Fi Unfiltered MOBILE - Partially managed using MDM

8 COMPONENTS OF RISK MOBILE RISK MATRIX VECTORS APPS DEVICE NETWORK WEB & CONTENT THREATS - Spyware & surveillanceware - Trojans - Other malicious apps - Privilege escalation - Remote jailbreak/root - Man-in-the-middle - Fake cell towers - Root CA installation - Phishing - Drive-by-download - Malicious websites & files SOFTWARE VULNERABILITIES - Out-of-date apps - Vulnerable SDKs - Poor coding practices - Out-of-date OS - Dead-end hardware - Vulnerable pre-installed apps - Network hardware vulnerabilities - Protocol stack vulnerabilities - Malformed content that triggers OS or app vulnerabilities BEHAVIOR & CONFIGURATIONS - Apps that leak data - Apps that breach company security policy - Apps that breach regulatory compliance - User initiated jailbreak/root - No pin code/password - USB debugging - Proxies, VPNs, root-cas - Auto-joining unencrypted networks - Opening attachments and visiting links to potentially unsafe content

9 Integrate MTD in MS Intune Mobile Threat Defense Partners Lookout Symantec Endpoint Protection Mobile Check Point SandBlast Mobile Zimperium

10 Integrate MTD in MS Intune Protection from app-based risks Trojans and spyware that can exfiltrate data from the device Vulnerabilities in app data transfer and storage Risky app behaviors that pose a compliance risk Sideloaded apps that bypass official app stores 47 out of 1000 Android enterprise devices encounter app-based threats 1 out of 1000 ios enterprise devices encounter app-based threats 110 out of 1000 ios devices encounter a sideloaded app

11 Integrate MTD in MS Intune Protection from web and content threats Phishing s on personal or corporate accounts Text messages with shortened links to malicious websites Browser URL addresses that are obscured Apps containing URLs that download malicious plug-ins

12 Integrate MTD in MS Intune Protection from device-based risks Advanced root or jailbreak Out-of-date operating systems (coming) Device configuration risks Behavioral anomalies 6 out of 1000 enterprise devices are jailbroken or rooted by the end user.

13 Integrate MTD in MS Intune Protection from network-based risks Man-in-the-middle attacks Host certificate hijacking SSLStrip attacks TLS protocol downgrades 8 out of 1000 enterprise devices encounter MiTM attack

14 Integrate MTD in MS Intune Control Access to Corporate Data using: Compliancy Policy Conditional Access When: Threats from malicious apps Threats to network Threats from device

15 How it works LOOKOUT SECURITY CLOUD SECURITY POLICY INCIDENT RESPONSE LOOKOUT CONSOLE MOBILE RISK API! X COMPLIANCE & CONDITIONAL ACCESS Corporate Data X

16 Bron: tweakers.nl Demo GhostChat Bron: Security.nl

17 Victim Attacker

18 Demo Man in the Middle Attack

19 Attacker Victim

20 Attacker Victim

21 Resources: Mobile Threat Defense Integration with Intune Zijn jouw mobiele apparaten echt goed beveiligd? Dark Caracal Report

22 Q & A

23 Next session: 11:35 12:30 hours Microsoft Teams, SharePoint sites & Office 365 Groups Martijn Eikelenboom & Quincy Thomas