Mobile Devices Using Without Losing

Transcription

1 Mobile Devices Using Without Losing Mark K. Mellis Associate Information Security Officer Stanford University Information Security Office Tech Briefing 30March 2012

2 We all have mobile devices iphones, ipads, Droids There s an App for that! What can we do to protect our own privacy and the University s data while enjoying the convenience of mobile personal computing devices? Mobile Devices Using Without Losing

3 Preview Risks of Mobile Computing Tips What If You Lose Your Phone? Review MDM Walk Through (if we have time) Mobile Devices Using Without Losing

4 The Future is Mobile Mobile Devices Using Without Losing

5 What do we use at Stanford? Mobile Devices Using Without Losing

6 Risks - What s on the device? Not merely documents Access credentials for networks and applications Presentations / Briefing Notes Stanford (including secure ) Address Book information Personal photos, movies, and Personal health, salary, and benefits information Indirect costs Regulatory Issues, Reputation Impact (think donors ) Enough to make you wish you never heard of computers should you lose it Mobile Devices Using Without Losing

7 Risks What could happen? Loss or Theft of the Device At security inspection points In cabs and airplanes Public places, hotel rooms, and offices Confiscation of the Device By the local police department, US Government, or other governments Spying Reading over the shoulder Targeted attacks planting keyloggers or other malware Intercepting network traffic Mobile Devices Using Without Losing

8 Stanford s Policy Mobile devices used to store or access Restricted Information (per AGM 63) are required to be managed with an approved mobile device management system (e.g. Stanford MDM) and profile (e.g. the MDM Restricted profile). Examples include Health Information, including Protected Health Information (PHI), Passport and visa numbers, and export controlled information under U.S. law. More information about information classification and handling at: Mobile Devices Using Without Losing

9 Label your device A label can help honest people return your lost device, even if the battery is dead. Anonymous labels are available the round label pictured came from stuffbak.com Mobile Devices Using Without Losing

10 Use a passcode A four digit passcode is plenty unless you access Restricted Data Don t use or Set the screen to auto-lock after a minute or two Set the phone to erase itself if the wrong passcode is entered too many times ten or more is fine Mobile Devices Using Without Losing

11 A digression on passcodes Daniel Amitay studied* the most-used f0ur digit PINs used in his app - 204,508 samples Top ten (in order of popularity) were 1234, 0000, 2580 (vertical line), 1111, 5555, 5683 (LOVE), 0852 (vertical line), 2222, 1212, 1998 (birth year?) Of these, 1234, 0000, 1111, 2222, 1212 are blocked by the MDM passcode policy. Beware of the others! * Mobile Devices Using Without Losing

12 Phones - Keep the software updated Updates are issued frequently as new vulnerabilities are exposed, the vendor patches them. Applies to both the basic device software and applications for ios devices, the operating system is updated via itunes or over the air, and applications are updated via the App Store. The update story is not so nice for Androids. Mobile Devices Using Without Losing

13 Don t jailbreak or root it It is popular in some circles to circumvent the security controls on mobile devices in order to avoid paying for particular features or to enable capabilities that the carrier or vendor doesn t provide. This is called jailbreaking or rooting. Jailbreaking removes a layer of protection that helps keep malware from running on the device Jailbreaking is usually prohibited by mobile phone company contracts Jailbreaking is contrary to security best practices for those reasons Mobile Devices Using Without Losing

14 Sign up for "find my iphone It s available free on the itunes App Store. Of course you might have an Android phone there s an app for that. Lookout Mobile Security Premium for example. Mobile Devices Using Without Losing

15 Sign up for "find my iphone Allows you to: Display a message or make a sound Set a passcode lock remotely Remote wipe Display location on a map Mobile Devices Using Without Losing

16 Backups If it s an ios device, you can use itunes or icloud to back it up. Other devices have other backup mechanisms. If you have a good backup of your phone, and you lose it, you can do a remote wipe without having to worry about losing your contacts, photos, and other valuable information. It helps make doing the right thing easier. Mobile Devices Using Without Losing

17 Encryption If it s an ios device running recent software, merely setting a PIN or passcode will automatically encrypt the phone. If you have a good backup of your phone, and you lose it, you can do a remote wipe without having to worry about losing your contacts, photos, and other valuable information. It helps make doing the right thing easier. Mobile Devices Using Without Losing

18 What if you lose it? Next to the pictures of your loved ones, the most valuable things on your mobile device are probably your SUnetID and password If your device is lost or stolen, call the Help Desk at 5- HELP. They will assist in changing your SUnetID s password. Doesn t matter if you are in MDM or not, works even for Androids and other devices that MDM doesn t support yet. If you are enrolled in Stanford MDM, the Help Desk can lock it, wipe University data, and help you think through your options for trying to recover the device. Mobile Devices Using Without Losing

19 Mobile Device Management Stanford has a new service called Mobile Device Management It will set up your and calendar, and these security and privacy best practices for you Read about it at Mobile Devices Using Without Losing

20 Enrollment Walk-thru 1

21 Enrollment Walk-thru 2

22 Enrollment Walk-thru 3

23 Enrollment Walk-thru 4

24 Enrollment Walk-thru 5

25 Enrollment Walk-thru 6

26 Enrollment Walk-thru 7

27 Enrollment Walk-thru 8

28 Enrollment Walk-thru 9

29 Enrollment Walk-thru 10

30 Enrollment Walk-thru 11

31 Enrollment Walk-thru 12

32 Enrollment Walk-thru 13

33 Enrollment Walk-thru 14

34 Enrollment Walk-thru 15

35 Enrollment Walk-thru 16

36 Enrollment Walk-thru 17

37 Enrollment Walk-thru 18

38 Enrollment Walk-thru 19

39 Enrollment Walk-thru 20

40 Self-Management Interface 1

41 Self-Management Interface 2

42 Self-Management Interface 3

43 Self-Management Interface 4

44 Self-Management Interface 5

45 Self-Management Interface 6

46 Support Management Interface 1 $ remctl mdm1 mdm list-devices -u mkmellis fde2f92601f64fb48fb7847cf9599f58ec85ff8c mkmellis AT&T iphone4, c:d0:f8:4e:df:16 Mark K. Mellis's iphone $

47 Support Management Interface 2 $ remctl mdm1 mdm show-device fde2f92601f64fb48fb7847cf9599f58ec85ff8c Device 1 of 1: DB id: 3158 UDID: fde2f92601f64fb48fb7847cf9599f58ec85ff8c Device Name: Mark K. Mellis's iphone User Name: mkmellis Model: iphone 4S Last Check-in: :03:09 OS Version: ios (9A405) Cert Expires: :02:18 WiFi Mac Address: 3c:d0:f8:4e:df:16 [continued]

48 Support Management Interface 3 [continued] Phone Number: Cellular Technology: GSM Cellular NetworkId: Sim Carrier: AT&T Last Carrier: Serial Number: C39GPJ9QDT9V Carrier Settings Version: 11.0 Modem Firmware Version: Capacity (GB): Last Updated: :02:42 Profiles Installed: MDM Regular [v ] ActiveSync [v ] Cisco VPN [v ] $

49 Support Management Interface 3 $ remctl mdm1 mdm show-apps fde2f92601f64fb48fb7847cf9599f58ec85ff8c Applications Installed: AirPort(100.14) BayAreaNews(1.02) BodyMedia(2413) Calc 16C(1.1.0) [ ] Yelp(5.5.1) Z-Subsonic(2.8) $

50 Here s what you do 1. Review these tips (and more) at mobile 2. Put them into practice today! 3. Enroll in Mobile Device Management at Mobile Devices Using Without Losing

51 Questions? Mark K. Mellis Mobile Devices Using Without Losing