Security and Compliance challenges in Mobile environment

Transcription

1 Security and Compliance challenges in Mobile environment Emerging Technologies November 19, 2013 Bob Bastani

2 Introductions Bob Bastani, Security & Compliance Program Manager, IBM, , 2

3 Agenda Trends in Mobile Computing Benefits, challenges and risks Movie Security & Risk mitigation technologies Summary 3

4 Trends in Mobile Computing 4

5 Mobile is a mandatory transformation 10 Billion devices by % of CIOs put mobile as priority 45% increased productivity with mobile apps 5

6 Fun Mobile Marketing Facts 1 billion of the world s 4+ billion mobiles phones are now Smart Phones 9 out of 10 mobile searches lead to an action, and over 50% lead to a purchase 70% of mobile online searches lead to an action within an hour, while 70% of desktop online searches lead to an action within a month Mobile ads perform 4 to 5 times better than traditional online ads 40% of tablet owners said they have looked up information on a show on their tablet while they were watching that same show 74% of smartphones users use their phones for shopping, and of that 79% make a purchase as a result of using their phones Mobile coupons have a redemption rate 10 times higher than that of print coupons 50% of smartphones users have bought a product on their phone 6

7 Trends in Mobile Computing for Mobile App Developers Are Popular: As businesses find new ways to harness mobility in 2013, the demands for specialized apps and support will only increase. 2. HTML5 comes on board: Android and IOS have the market for the moment, but developers are also interested in HTML5 3. Consumerization: BYOD is here to stay.and Consumerization leads to other related BYOD (personal cloud, app stores, Windows 8, etc.) 4. Mobile Device Management: Growth in BYOD programs will lead to increased popularity of MDM solutions and services 5. Mobile Collaboration: Social Business trend drives need for new mobile collaboration capability 6. Video Streaming: Live and recorded videos embedded into mobile business processes 7. Mobile Assistants: Workers demand enterprise versions of Watson/Siri for mobile search and productivity apps 8. Mobile Analytics and Visualization Apps: New analytical and visualization solutions will be developed and deployed for remote and mobile workers. 9. Mobile Clouds: Enterprises will develop and deploy mobile clouds for specific apps 10. Mobile Payments: Employee expenses paid via mobile. Business accepting payments for products solutions and services via mobile 11. Increased Need for Speed: Big data, analytics, social, and mobile video will drive demand for faster mobile networks 12. CIO Leadership: CIOs take lead in managing the enterprise mobile strategy, including developing new business models, embedding mobile technology innovations into processes, and protecting mobile data. IBM Mobile Computing 2013 HorizonWatch Trend Report 7

8 Benefits, challenges and risks 8

9 With enormous opportunities Business to Enterprise Business to Consumer Increase worker productivity Improved claims processing Increase revenue with sales engagements Extend existing applications to mobile workers and customers Reducing fuel, gas, or fleet maintenance costs where relevant Increase employee and business partner responsiveness and decision making speed Resolve internal IT issues faster Reduce personnel cost (utilizing personal devices instead of corporate devices) Improve customer satisfaction Deeper customer engagement and loyalty Drive increased sales through Personalized offers Customer service Competitive differentiator Improve brand perception Deeper insight into customer buying behavior for up sell and cross sell Improve in store experience with mobile concierge services 9

10 But mobile also brings business and IT challenges Enterprise Business Model Changes New business opportunities based upon geolocation Anytime, anywhere business transactions Importance of social business interactions App Development Lifecycle Complexity Complexity of multiple device platforms with fragmented Web, native, and hybrid model landscape Connecting the enterprise back-end services in a secure and scalable manner Unique mobile requirements (user interface, connected/disconnected use, version upgrades, etc.) Faster time-to-market demands and iterative delivery Mobile Security and Management Protection of privacy and confidential information Use of client-owned smartphones and tablets Visibility, Security & Management of mobile platform requirements Top Mobile Adoption Concerns: 1. Security/privacy (53%) 2. Cost of developing for multiple mobile platforms (52%) 3. Integrating cloud services to mobile devices (51%) Source: 2011 IBM Tech Trends Report /blogs/techtrends/entry/home?lang=en 10

11 Mobile Security IvaVEI 11

12 Mobile security, risk and mitigation technologies 12

13 Top Risks introduced by Mobile Computing Device loss or theft Exposure or loss of sensitive data Malicious software, viruses, and malware Application Security Secure network penetration Regulatory Compliance 13

14 Mobile Device Management (MDM) Mobile Device Management functionality Policy & Security Management -- Manage password policies, device encryption, jailbreak and root detection Management Actions -- Selective wipe, full wipe, deny access, remote lock Application Management -- Application inventory, recommended app deployment, app categorization Enterprise Access Management -- Manage access to enterprise resources including , VPN, and wifi Location Services -- Optionally track device locations for corporate devices Management rules for device and user authentication Push out security patches to protect against malware 14

15 Mobile Device Security the problem End User Mail / Calendar / Contacts Access (VPN / WiFi) Apps (app store) Enterprise Apps Encryption not enforced VPN / WiFi Corporate Network Access Mobile devices are not only computing platforms, but also communication devices, we could have: Potential unauthorized access (lost, stolen) Disabled encryption Insecure devices connecting to network icloud Corporate data leakage itunes Sync icloud Sync 15

16 Mobile Device Security the solution End User Personal Mail / Calendar Personal Apps Corporate Profile Enterprise Mail / Calendar Enterprise Access (VPN/Wi-Fi) Enterprise Apps (App store or Custom) Encryption Enabled VPN / Wi-Fi itunes Sync Secured by policy icloud icloud Sync Corporate Network Access Enable password policies Enable device encryption Force encrypted backup Disable icloud sync Access to corporate , apps, VPN, Wi-Fi contingent on policy compliance! Selectively wipe corporate data if employee leaves company Fully wipe if lost or stolen 16

17 How does Endpoint Manager manage devices? Agent-based Management Android via native BigFix agent IOS via Apple s MDM APIs -based management through Exchange and Lotus Traveler Supported platforms: IOS, Android, Windows Phone, Windows Mobile, Symbian Category Platform Support Management Actions Application Management Policy & Security Management Location Services Enterprise Access Management Expense Management Endpoint Manager Capabilities Apple ios, Google Android, Nokia Symbian, Windows Phone, Windows Mobile Selective wipe, full wipe, deny access, remote lock, user notification, clear passcode Application inventory, enterprise app store, whitelisting, blacklisting, Apple Volume Purchase Program (VPP) Password policies, device encryption, jailbreak & root detection Track devices and locate on map Configuration of , VPN, Wi-fi Enable/disable voice and data roaming 17

18 Allows management of mobile devices for managing applications and security considerations into the enterprise 18

19 Detect Security Problems and non- Compliance 19

20 Applications can be provisioned to devices targeting different populations of users 20

21 Identity Management in a Mobile World 80 percent of organizations of BYOD program require only a password for mobile access To help prevent fraudulent access, mobile users need to prove their identity within the context in which they are accessing corporate resources Type of device Application running on the device Location or their patterns of activities 21

22 Context Aware Access Control Using contextual data analytics to calculate risk, organizations can grant access based on a dynamic risk assessment of the confidence level of a transaction When a user requests access to a protected resource, a risk score is calculated and determinations is made on whether access is permitted, denied, or permitted after a condition is met (such as answering a specific question only known by the device owner) In some situations, depending on the risk score, the user may be denied access to certain IT resources because the security risk is deemed to be too high 22

23 Identity Management Multifactor authentication including integration with third party authentication solutions Device authentication Use session management to force an authentication challenge when the user has been inactive for a period of time 23

24 Adaptive Mobile Security 24

25 Identity Aware applications Some mobile applications typically require users to enter a name and password to prove their identity. Some applications may store the credentials locally to help improve the user experience, which introduces additional vulnerabilities Security Access Manager for Mobile can make applications identity-aware by using OAuth. User credentials are not stored on the device only device tokens that are exchanged transparently each time the application is launched. 25

26 Summary Mobile computing is here, it is pervasive and it has changed the fabric of social interactions, business and commerce Persistent use of mobile devices has also increased the overall security and privacy risks Creating a holistic mobile computing strategy which clearly identifies vulnerabilities, threats, risks and mitigation strategies is paramount to security of any agency or enterprise 26

27 References Securing Mobile Devices, ISACA white paper August 2010, Center/Research/ResearchDeliverables/Pages/Securing-Mobile-Devices.aspx IDC Government Insights, United States Government IT Infrastructures Strategies Methods and Parctices, #G I , 71b b /$FILE/GI pdf IBM Mobile Platform Strategy IBM Mobile Foundation, Greg Truty, IBM Distinguished Engineer, Chief Architect, ibm.com/events/wwe/grp/grp004.nsf/vLookupPDFs/Mobile%20Presentation%20for%20Hursle y%20comes%20to%20you/$file/mobile%20presentation%20for%20hursley%20comes%20to% 20You.pdf Beyond passwords: Protect the mobile enterprise with smarter security solutions, IBM Thought Leadership Paper, 27