IBM MOBILE SECURITY SOLUTIONS - Identity and Access Management Focus

Transcription

1 IBM MOBILE SECURITY SOLUTIONS - Identity and Access Focus May 2012

2 Executive Overview Mobile devices are pervasive in our daily lives and increasingly coming to work Bring Your Own Device (BYOD) IBM is helping CISOs manage the risks associated with mobility IBM Mobile Security Solutions are helping customers address their challenges across the board Security Intelligence People Data Applications Infrastructure 5.6 Billion connections growing to 7.4 by Gartner Mobile Security is a natural extension to our security portfolio Mobile devices are simply another enterprise endpoint to be managed, secured, audited... 2

3 Challenges of Enterprise Mobility Adapting to the Bring Your Own Device (BYOD) to Work Trend - Device and Security - Application management Achieving Data Separation - Privacy - Corporate Data protection Providing secure access to enterprise applications & data - Secure connectivity - Identity, Access and Authorization Developing Secure Mobile Apps - Vulnerability testing Designing an Adaptive Security Posture - Policy - Security Intelligence 3

4 Mobile Security Enabled with IBM Solutions IBM can bring together a broad portfolio of technologies and services to meet the mobile security needs of customers across multiple industries Enterprise Analytics and Compliance Mobile Identity and Access Mobile Network Protection Mobile Device Mobile Device Security Firewall Network IPS System IPS Virtual IPS Mobile Information Protection Mobile Threat Secure Mobile Application Development 4

5 Enterprise Use Case Pattern: Security from Devices to Mobile Apps WiFi Internet Mobile apps Web sites Develop, test and deliver safe applications Secure endpoint device and data Telecom Provider Achieve Visibility and Enable Adaptive Security Posture Security Gateway Corporate Intranet & Systems Secure access to enterprise applications and data 5

6 Mobile Information Protection Secure Mobile Application Development Application Security Solution: WorkLight Security by Design Develop secure mobile apps using corporate best practices Code obfuscation Application Security Objectives Protecting Mobile App Data Encrypted local storage for data, Offline user access Challenge response on startup App Authenticity Validation Enforcement of organizational security policies Enforcing Security Compliance Direct Updates Integration with User Security Solutions App Analytics Remote Disabling of apps Streamline Corporate security approval processes Protect Local Application Data Integrate with User Security Solutions Proactively Enforce Security Updates Integration point with IBM Tivoli Access Manager (TAMeb) Protect From Known Application Security Threats 6

7 Mobile Identity and Access User Security Solution: IBM Security Access Manager for Mobile (actual product name: Tivoli Access Manager for e-business - TAMeb) Delivers user security by authenticating and authorizing the user along with their device. Supports open standards applicable to mobile such as OAuth IBM Access Manager Access Manager Servers (e.g., Policy) User registries (i.e. LDAP) VPN or HTTPS Authentication many options Coarse-grained authorization Session management Auditing/ reporting Linkage to QRadar SIEM (Security Intelligence) External Authentication Provider Application Servers (i.e. WebSphere, WorkLight) Federated Identity Manager 7 Mobile Browser or Native Applications Web Services Web Applications Enterprise

8 Mobile Identity and Access TAMeb Support for Mobile Applications How are apps on different phone platforms supported? Mobile apps are written in different languages depending on the phone platform Objective C for ios Java for Android C# for Windows Mobile apps use HTTP libraries from the browser engine (Webkit) on mobile phones to make HTTP 1.1 calls out 4Q TAMeb states support for HTTP 1.1 TAMeb support will work with browsers on ios, Android, Symbian and Windows Phones 8

9 Mobile Identity and Access European Bank Aims to Deliver Secure Mobile Internet Banking Customer Objectives Give mobile customers secure access to banking applications Enable employees to perform secure banking transactions via mobile devices Target Mobile Platforms ios (ipad/iphone) Android Windows Mobile (future) IBM Security Solution IBM s Access Manager and WorkLight solutions provide security services - Access Manager authenticates (certificate-based) - Mobile apps run on WorkLight platform - Result: secure access to back-end banking applications Business Value Reduce operational complexity and cost with a single, scalable infrastructure to secure access to various back-end services from multiple mobile applications Customizability of authentication mechanism empowers the bank to guarantee the security of its customers Safeguard trust relationship between the bank and its customers using a safe app platform that encrypts local data and delivers app updates immediately once they are available 9

10 Mobile Identity and Access Architectural View of the Solution Being Deployed at the Bank IBM Security Solution User Security coupled with Application Security IBM Access Manager for e-business serves as a Reverse Proxy and provides Web Access (WAM) for WorkLight Server WorkLight server interfaces with banking services to deliver the data to authorized mobile users of the bank s mobile app WorkLight shell for the mobile app provides encrypted cache for app data 10

11 Secure Mobile Application Development Application Security Solution: AppScan 80% of development costs are spent identifying and correcting defects! Average Cost of a Data Breach $7.2M from law suits, loss of customer trust, damage to brand Find during Development $80/defect Find during Build $240/defect Find during QA/Test $960/defect Find in Production $7,600 / defect AppScan Source AppScan Standard / Enterprise 11 Static Application Security Testing White box Ounce Labs Dynamic Application Security Testing Black box Watchfire

12 Mobile Device Mobile Device Security Device Security Solution: IBM Endpoint Manager For Mobile Delivers device security by providing visibility of the devices connected to the enterprise, and supports core capabilities such as device lock, selective wipe and jailbreak detection. Traditional Endpoint Mobile Device OS provisioning Patching Power Mgmt Anti-Virus Mgmt Device inventory Security policy mgmt Application mgmt Device config (VPN/ /Wifi) Encryption mgmt Roaming device support Integration with internal systems Scalable/Secure solution Easy-to-deploy Multiple OS support Consolidated infrastructure Device Wipe Location info Jailbreak/Root detection Enterprise App store Self-service portal ios, Android, Symbian, and Windows Phones 12

13 Enterprise Analytics and Compliance Mobile Security Intelligence: QRadar Delivers Mobile Security Intelligence by monitoring data collected from other mobile security solutions visibility, reporting and threat detection Ingest log data and events from: Endpoint Manager for Mobile Devices Access Manager Mobile Connect WorkLight 1B+ Events per Day High Priority Offenses Unified collection, aggregation and analysis Common SIEM search, filtering, rule writing and reporting platform Single user interface for Log management Risk modeling Vulnerability prioritization Incident detection Impact analysis 13

14 External Resources IBM Mobile Security Website: IBM Mobile Security Video: Whitepaper: Securing mobile devices in the business environment - e_rn_mobilesecurity Podcast: Enterprise mobile management and security - Blogs: Exploiting Innovation with Confidence

15 Summary Mobile Security is not one off Mobile Security is not ad hoc Mobile Security is being delivered by IBM today through a combination of: Existing security capability that is applicable to all clients, including mobile clients Solutions that deliver security that is unique to mobile configurations 15

16 16

17 Legal Disclaimer IBM Corporation All Rights Reserved. The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBM s current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results. If the text contains performance statistics or references to benchmarks, insert the following language; otherwise delete: Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here. If the text includes any customer examples, please confirm we have prior written approval from such customer and insert the following language; otherwise delete: All customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer. Please review text for proper trademark attribution of IBM products. At first use, each product name must be the full name and include appropriate trademark symbols (e.g., IBM Lotus Sametime Unyte ). Subsequent references can drop IBM but should include the proper branding (e.g., Lotus Sametime Gateway, or WebSphere Application Server). Please refer to for guidance on which trademarks require the or symbol. Do not use abbreviations for IBM product names in your presentation. All product names must be used as adjectives rather than nouns. Please list all of the trademarks that you use in your presentation as follows; delete any not included in your presentation. IBM, the IBM logo, Lotus, Lotus Notes, Notes, Domino, Quickr, Sametime, WebSphere, UC2, PartnerWorld and Lotusphere are trademarks of International Business Machines Corporation in the United States, other countries, or both. Unyte is a trademark of WebDialogs, Inc., in the United States, other countries, or both. If you reference Adobe in the text, please mark the first use and include the following; otherwise delete: Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. If you reference Java in the text, please mark the first use and include the following; otherwise delete: Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. If you reference Microsoft and/or Windows in the text, please mark the first use and include the following, as applicable; otherwise delete: Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both. If you reference Intel and/or any of the following Intel products in the text, please mark the first use and include those that you use as follows; otherwise delete: Intel, Intel Centrino, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. If you reference UNIX in the text, please mark the first use and include the following; otherwise delete: UNIX is a registered trademark of The Open Group in the United States and other countries. If you reference Linux in your presentation, please mark the first use and include the following; otherwise delete: Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. If the text/graphics include screenshots, no actual IBM employee names may be used (even your own), if your screenshots include fictitious company names (e.g., Renovations, Zeta Bank, Acme) please update and insert the following; otherwise delete: All references to [insert fictitious company name] refer to a fictitious company and are used for illustration purposes only. 17

18 Driving Key Set of Mobile Security Requirements Mobile devices are not only computing platforms but also communication devices, hence mobile security is multi-faceted, driven by customers operational priorities Mobile Security Intelligence Mobile Device Data, Network and Access Security App/Test Development Mobile Device Acquire/Deploy Register Activation Content Mgmt Manage/Monitor Self Service Reporting Retire De-provision Mobile Device Security Device wipe and lockdown Password Configuration Policy Compliance Mobile Threat Anti-malware Anti-spyware Anti-spam Firewall/IPS Web filtering Web Reputation Mobile Information Protection Data encryption (device, file and app) Mobile data loss prevention Mobile Network Protection Secure Communications (VPN) Edge Protection Mobile Identity and Access Identity Authorize & Authenticate Certificate Multi-factor Secure Mobile Application Development Vulnerability testing Mobile app testing Enforced by tools Enterprise policies Mobile Applications i.e. Native, Hybrid, Web Application Mobile Application Platforms and Containers Device Platforms 30 device Manufacturers, 10 operating platforms i.e. ios, Android, Windows Mobile, Symbian, etc. 18

19 Mobile Network Protection Solution: IBM Mobile Connect Delivers secure connectivity from mobile devices to back-end systems and adapts to a mobile user's unique requirements such as roaming support and cost-based routing A high availability intelligent solution providing: Mobile VPN SSL VPN Least cost routing & data optimization 19 End-to-end encryption

20 A Review of IBM s Single Sign-On Coverage FIM Web Services Federated Internet-B2C Extranet-B2E SAM E-SSO Intranet/Kiosk 20 AMeb SAM E-SSO Web Workplace Web SSO Targets Non-Web Targets URL SOA Web Servers Web Applications Portals, e.g. WPS Windows Java Citrix/ Term. Svcs. Mainframe