WHITE PAPER SPON. Protecting Mobile Devices from Malware Attack. Published March An Osterman Research White Paper. sponsored by.

Transcription

1 WHITE PAPER N Prtecting Mbile Devices frm An Osterman Research White Paper Published March 2015 spnsred by SPON spnsred by Osterman Research, Inc. P.O. Bx 1058 Black Diamnd, Washingtn USA Tel: Fax: inf@stermanresearch.cm twitter.cm/msterman

2 Prtecting Mbile Devices frm EXECUTIVE SUMMARY An emplyee is traveling n cmpany business and needs t access crprate frm her laptp thrugh a Wi-Fi access pint in a Starbucks between meetings. A develper wrking frm hme needs t uplad cde t a crprate develpment system. An engineer wrking frm a custmer site needs t initiate a Skype call with managers at anther cmpany lcatin. All f these scenaris are increasingly cmmn and represent a significant risk f malware incursin because sensitive and/r cnfidential infrmatin is being accessed frm the Internet r anther netwrk nt under the direct cntrl f the crprate IT department. Even a single incursin f malware r a single data breach can have disastrus cnsequences and can cst an rganizatin millins f dllars in remediatin csts, damage t their crprate reputatin, and ther prblems. T mitigate sme f the risks f malware incursin and data breaches that can result frm accessing a crprate netwrk using the Web and Web-enabled tls, lcally deplyed anti-malware sftware can be deplyed n each laptp. Hwever, by far the best apprach is t rerute Web traffic thrugh a prxy r Web gateway. While there are several appraches that can be used t d s use f a virtual private netwrk, use f a clud-based prxy, r use f a prxy aut-cnfiguratin file the best apprach is t use a client prxy agent. KEY TAKEAWAYS The advantages f using a client prxy agent include: It is lcatin-aware and will activate autmatically nce the user leaves the cnfines f the crprate firewall. It cannt be evaded by nn-brwser applicatins like Skype, nr can it be disabled by end users thrugh switching t anther brwser r changing their brwser settings. It wrks with any Web brwser and requires n brwser settings in rder t wrk. It prvides significant flexibility by lcating the nearest prxy r the prxy that ffers the lwest latency. It autmatically manages authenticatin. ABOUT THIS WHITE PAPER This white paper was spnsred by McAfee/Intel Security; infrmatin abut the cmpany and its fferings is prvided at the end f this paper. THE GROWING USE OF MOBILE DEVICES GREATER EMPHASIS ON EMPLOYEE MOBILITY Enabled by pwerful laptps and ther mbile devices, reliable and widely available bradband services, and a grwing number f clud-based services, the wrkfrce is becming mre mbile. Fr example, the United States Census Bureau fund that US-based emplyees wh telewrk increased t 4.4% f ttal emplyees in 2012, up frm 2.3% in 1980 i. Hwever, there are tens f millins mre infrmatin wrkers wh wrk frm hme albeit nt fficially as telewrkers t check their wrk r t perfrm ther wrk-related tasks after hurs, n weekends, and when n vacatin. Mrever, use f cntractrs and temprary staff is increasing at a significant rate, many f whm are cntract infrmatin wrkers wh wrk frm hme, custmer sites and the like. Fr example, ne surce fund that 42% f 2015 Osterman Research, Inc. 1

3 Prtecting Mbile Devices frm emplyers intended t hire cntractrs r ther temprary wrkers fr staffing purpses during 2014 ii, a 14% increase frm 2009 t The implicatins f mbility n the cmputing landscape are prfund in tw imprtant ways: Laptps have eclipsed desktp cmputers as the primary cmputing platfrm. Fr example, the laptp/desktp split in 2010 was 56%/44%, grew in favr f laptps t 59%/41% in 2014, and will increase t 61%/39% by 2017 iii. Remte wrkers are mre apt t use unauthrized clud-based apps and ther tls because they are nt under the direct cntrl r supervisin f their IT department. While these tls are generally helpful fr individual emplyees, they represent increased risk by pening anther unmanaged pint thrugh which malware can enter a crprate netwrk r frm which data can be exfiltrated. While a mbile device is ften cnsidered t be a smartphne r tablet, a 2014 Osterman Research survey fund that the majrity f mbile devices emplyed as the primary cmputing device by emplyees is a laptp cmputer, as shwn in Figure 1. Figure 1 Primary Mbile Cmputing Platfrm in Use Surce: Osterman Research, Inc. MOBILE PLATFORMS CONNECT TO CRITICAL SYSTEMS Laptps and ther mbile platfrms are used increasingly t cnnect t critical cludand SaaS-based systems. Fr example, as shwn in Figure 2, the grwth f Office 365 amng rganizatins that are at least cnsidering deplying the platfrm is expected t mre than duble by early Osterman Research, Inc. 2

4 Prtecting Mbile Devices frm Figure 2 Penetratin f Varius Business-Grade Systems, Surce: Osterman Research, Inc. Mrever, mbile platfrms are cmmnly used t access a wide range f ther clud-based systems, including: File sync and share tls like Drpbx, Micrsft OneDrive, Bx, Ggle Drive, Apple iclud and many thers that allw synchrnizatin f user files acrss many platfrms, including in the clud. Custmer Relatinship Management (CRM) systems, which increasingly are clud-based, nt n-premises. Fr example, Gartner fund that 41% f CRM systems in 2013 were SaaS-based iv and this share cntinues t grw. Enterprise Resurce Planning (ERP) systems, which are primarily n-premises tday, but will increasingly be clud-based. Desktp prductivity applicatins are increasingly being delivered using cludbased capabilities, including thse frm Micrsft, Ggle, Amazn, Apple and thers. Wrkgrup cllabratin tls like SharePint and its grwing array f cmpetitrs like Evernte and Basecamp. Web cnferencing and nline meeting tls, such as WebEx and Citrix GTMeeting. Scial media tls, including bth cnsumer-fcused tls and true enterprisegrade alternatives. Nn- cmmunicatin tls like Skype and instant messaging systems. Clud-based file transfer tls are ften used t circumvent IT limits n the size f messages that can be sent r received thrugh the crprate system. While IT des this t maintain acceptable levels f server perfrmance, it can prevent users frm sending large files as part f their wrk, 2015 Osterman Research, Inc. 3

5 Prtecting Mbile Devices frm and s users will deply their wn tls t bypass crprate gvernance activities. Users are heavily influencing the tls that are used in the enterprise. While emplyees must still meet the security and infrmatin gvernance requirements that IT is bligated t impse, they will be much mre satisfied, and in turn mre prductive at their wrk, when they have at least sme invlvement in the types f tls and applicatins that shuld be used. GREATER MOBILITY = INCREASED RISK Greater mbility results in increased prductivity because it allws users t have access t all f their cmputing resurces, files and ther cntent regardless f their lcatin. This makes them mre prductive because they can wrk frm anywhere enabling wrk-at-hme and ther telewrk prgrams and it makes it easier fr emplyees t wrk after hurs withut the need t g back t the ffice t access , files r ther resurces. Hwever, greater mbility substantially increases the risk f malware incursin, data breaches and ther serius prblems because increased mbility means that mre laptps and ther devices are used utside f the crprate firewall. This als means that there is less direct IT cntrl ver the platfrms that are cnnecting t critical crprate systems like , SharePint, CRM systems, etc., and less IT cntrl ver what gets installed n mbile devices and the sites that they access. Mrever, there is less IT cntrl ver hw users access critical systems a traveling emplyee may access his r her crprate frm the unprtected Wi-Fi netwrk at an airprt r a cffee shp, fr example. The bttm line f greater mbility is this: there is greater risk f malware incursin fr the mbile devices themselves and in the crprate netwrk, a greater likelihd f emplyees accessing inapprpriate Web sites r clud-based tls, and a greater risk f data breaches. OPTIONS FOR MOBILE USERS OPTIONS FOR PROTECTING MOBILE USERS FROM MALWARE There are three basic ptins that IT decisin makers have with regard t prtecting mbile users frm malware incursins frm varius surces: D nthing Sme decisin makers will pt t d nthing with regard t slving the ptential incursin f malware thrugh unmanaged and unprtected mbile devices. While this is the easiest and, initially, the least expensive ptin, the benefits will quickly disappear with the first malware infiltratin, r wrse, the first data exfiltratin. Use security installed n lcal devices A better ptin than ding nthing is t install anti-malware sftware n mbile devices in rder t scan Web cntent fr malicius cntent. Hwever, while gd anti-malware capabilities will catch sme f this cntent, much f it will still get thrugh because f a) the inherent limitatins in signature-based slutins that are unable t detect zer-day and ther threats fr which n signature is available, and b) the fact that at least 390,000 new malicius prgrams are detected n a typical day v, and there is simply n way that lcally installed antimalware slutins can keep up with this level f malicius activity. Rerute all Web traffic thrugh a prxy/web gateway The best ptin t prtect mbile users frm malware is t rerute all Web traffic thrugh a prxy/web gateway that will scan all traffic, filter ut blacklisted r unsuitable sites (prn sites, gambling sites, etc.) befre users can access their cntent, and filter ut malware that wuld therwise infiltrate users mbile 2015 Osterman Research, Inc. 4

6 Prtecting Mbile Devices frm devices. The primary advantages f reruting all Web traffic thrugh a prxy/web gateway cmpared t lcally deplyed anti-malware slutins is their much higher detectin rate fr malware, their ability t use real time blacklists, and their use f a real-time threat intelligence capability that lcally deplyed slutins cannt ffer. FOUR METHODS FOR REROUTING TRAFFIC There are fur primary methds fr reruting traffic that can be used t prtect remte r mbile users Web experience: Cnnect using a VPN A mre traditinal methd fr reruting Web traffic is the use f a virtual private netwrk (VPN) that will emply encryptin and varius security capabilities t ensure that access t a private netwrk frm a public ne is limited nly t authrized users. The advantages f using a VPN are that they are based n industry-standard sftware fferings, they cntrl all netwrk traffic between the private netwrk and mbile users, traffic cannt evade the VPN nce it has been activated, and it is brwser-independent. The dwnside f the VPN apprach t reruting traffic frm a mbile device is that it requires deplying an agent n each user s laptp, users must manually activate the VPN in rder fr it t be used, and brwser settings must be cnfigured in advance t use the prxy. Other disadvantages f the VPN apprach is that separate authenticatin must be established when users lg int the crprate netwrk, and the backhauling f traffic culd significantly increase bth netwrk traffic and latency. User brwser settings t redirect Web traffic t a clud-based prxy Easily the mst widely adpted ptin is t mdify the brwser settings n the mbile device s that all Web traffic is redirected t a clud-based prxy. This industry-standard apprach is supprted by all majr brwsers and requires n prgramming skills t implement. Hwever, there are a number f disadvantages t this apprach: It requires directly mdifying the brwser settings n each mbile device that will be used t cnnect t the netwrk. The change t the brwser settings is static, and s cannt accmmdate alternative r failver scenaris. Users r applicatins can easily evade these settings, such as using anther brwser that has nt been apprpriately cnfigured, r the prxy settings can be easily edited r remved. The prxy settings are dependent n the particular perating system and brwser in use. Fr example, Internet Explrer and Chrme will enfrce Windws prxy settings, but Firefx will nt. Further, there is nt an easy way t lck settings in OS X. Mdifying prxy settings wrks fr brwser-based traffic (with exceptins), but it des nt manage nn-brwser applicatins like Skype. This apprach requires separate authenticatin t be perfrmed. Use a prxy aut-cnfiguratin (PAC) file A better apprach is t use a PAC file because it is based n industry-standard technlgy and because it prvides flexibility that is nt inherent when mdifying prxy settings, such as in failver situatins. Hwever, the use f a PAC file requires deplyment f the PAC file t each laptp in cnjunctin with updates f brwser settings, it requires sme level f prgramming skill t execute, and it 2015 Osterman Research, Inc. 5

7 Prtecting Mbile Devices frm suffers frm the same perating system and brwser limitatins as the apprach discussed abve. Mrever, if nt lcked dwn, the use f a PAC file can be evaded by using anther brwser, editing r remving the brwser settings, r simply deleting the PAC file itself. Plus, as with the apprach discussed abve, the use f a PAC file will nt manage traffic thrugh nn-brwser applicatins like Skype, and it als requires separate authenticatin. Use a client prxy agent A furth apprach, use f a client prxy agent, ffers the best apprach t reruting Web traffic fr mbile users. There are several advantages f this apprach relative t the thers discussed abve: A client prxy agent is lcatin-aware and s will activate autmatically if the user is utside the crprate firewall. It wrks with any Web brwser and requires n pre-cnfiguratin f the brwser r any specific settings as with ther appraches. Plus, users cannt disable r delete settings t get arund it. It cannt be evaded by nn-brwser applicatins, but will instead rute all traffic. The use f a client prxy agent ffers mre flexibility than ther appraches because it accmmdates failver situatins and pr netwrk quality issues nicely by lcating the nearest prxy r the prxy with the lwest latency. It des nt require any prgramming skills t implement. It autmatically manages authenticatin withut requiring a separate authenticatin capability. While the use f a client prxy agent is the best apprach fr reruting Web traffic, there are sme minr dwnsides t its use, including the fact that this is nt an industry-standard apprach and s is dependent n prprietary prtcls. Mrever, this apprach will nt always supprt nn-pc devices, such as iosbased smartphnes, ipads, r Andrid smartphnes and tablets, a ptentially serius issue fr sme cmpanies whse users rely heavily n these devices fr Web access. RECOMMENDATIONS Osterman Research recmmends that decisin makers cnsider fur key issues t prtect mbile users frm the grwing variety f Web-based threats: Use a client prxy agent Laptp users shuld have their Web traffic reruted using a client prxy agent because this apprach ffers the greatest upside f the varius appraches that can be used, and its dwnsides are generally minimal. Cnsider prtectin fr ios and Andrid devices While the use f a client prxy agent wrks well fr laptps, it des nt generally wrk as well fr ios r Andrid phnes r tablets. Fr users that are reliant upn these devices fr accessing the Web, a different apprach, such as explicit prxy settings, may be required. Cnsult netwrk security prviders Netwrk security prviders shuld be cnsulted t determine which slutins they ffer and what slutins they plan t ffer t prtect their custmers Web users Osterman Research, Inc. 6

8 Prtecting Mbile Devices frm Implement the slutin that delivers maximum prtectin Finally, decisin makers shuld implement the traffic reruting slutin that will deliver the maximum level f prtectin fr mbile users especially laptp users because they represent the largest prprtin f mbile users with the lwest acquisitin and peratinal csts. SUMMARY A grwing prprtin f crprate users are accessing sensitive crprate data assets and systems via the Web and a variety f Web-enabled applicatins frm laptps that are cnnected t public and ther netwrks utside the cntrl f crprate IT departments and utside the crprate firewall. The increasing level f mbility raises crprate risk substantially by making it mre likely that malware will infiltrate the netwrk thrugh these mbile devices, and that sensitive data will be exfiltrated by cybercriminals. T prtect against these threats, decisin makers shuld mandate the use f a client prxy agent fr all laptp users that will rerute Web traffic and scan it fr malware. A client prxy agent ffers a number f imprtant advantages ver ther Web trafficreruting appraches. ABOUT McAFEE/INTEL SECURITY McAfee Web Prtectin can prvide the additinal threat prtectin businesses need t prevent targeted attacks and advanced malware infiltratin: McAfee Client Prxy, which is included at n extra cst with McAfee Web Prtectin, enfrces plicy-based redirectin f all web traffic fr mbile r remte users vi. The cmbinatin f McAfee Glbal Threat Intelligence, which cllects real-time data frm ver 100 millin sensrs acrss file, web, , and netwrk vectrs, and multiple antivirus engines blcks knwn viruses, while the McAfee Gateway Anti-malware engine, with its unique web page emulatin, prevents the vast majrity f zer-day webbrne malware dwnlads vii Integrated reprting expses all web applicatins being accessed by end-users, while included applicatin cntrls prvide IT and security peratins with the tls t restrict access based n numerus criteria, such as User ID, grup, IP address, etc. Built-in DLP technlgy scans all utbund web traffic fr DLP rules vilatins, preventing leakage f sensitive cntent, while integrated file encryptin prtects files upladed t cllabratin sites. Fr the mst advanced web threats, McAfee Advanced Threat Defense integrated with McAfee Web Prtectin can detect stealthy r delayed malware using static and dynamic analysis. Suspicius files fund in web pages are sent t McAfee Advanced Threat Defense and bserved in a sandbx envirnment while simultaneusly disassembled fr thrugh analysis Osterman Research, Inc. 7

9 Prtecting Mbile Devices frm 2015 Osterman Research, Inc. All rights reserved. N part f this dcument may be reprduced in any frm by any means, nr may it be distributed withut the permissin f Osterman Research, Inc., nr may it be resld r distributed by any entity ther than Osterman Research, Inc., withut prir written authrizatin f Osterman Research, Inc. Osterman Research, Inc. des nt prvide legal advice. Nthing in this dcument cnstitutes legal advice, nr shall this dcument r any sftware prduct r ther ffering referenced herein serve as a substitute fr the reader s cmpliance with any laws (including but nt limited t any act, statute, regulatin, rule, directive, administrative rder, executive rder, etc. (cllectively, Laws )) referenced in this dcument. If necessary, the reader shuld cnsult with cmpetent legal cunsel regarding any Laws referenced herein. Osterman Research, Inc. makes n representatin r warranty regarding the cmpleteness r accuracy f the infrmatin cntained in this dcument. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL. REFERENCES i ii iii iv v vi vii 961b3f9f350cecfde38d403e04c7a709&cid=WB521&aName=EMWBW&src=web&aType= reprt&regin=us 2015 Osterman Research, Inc. 8