Managing Mobile: BYOD, MDM, MAM, and more acronyms. John H Sawyer Senior Security Analyst InGuardians, Inc.

Transcription

1 Managing Mobile: BYOD, MDM, MAM, and more acronyms John H Sawyer Senior Security Analyst InGuardians, Inc.

2 Who Am I? InGuardians Senior Security Analyst Penetration Testing Web, Network, Smart Grid, Mobile, Physical Architecture Review Incident Response & Forensics Author for Dark Reading and InformationWeek Infosec Volunteer and Mentor DEF CON 14/15 Capture the Flag

3 Today s Agenda Quick look at the 2014 InformationWeek Mobile Survey The BYOD Movement (and why it s a bad thing) Enterprise Mobility Management Mobile Application Security

4 2014 Mobile Security Survey March Respondents Top Mobile Concerns Importance of Mobile Security Plan Corporate vs Personal Devices Confidence in Security Controls

5 Top Mobile Concerns Security at public hot spots Mobile malware on applications from public app stores Data loss due to lost or stolen devices Penetration of our corporate Wi-Fi networks Users forwarding corporate information to cloud-based storage services (e.g., Drop Box, Google Drive)

6 Top Mobile Concerns Results Hot Spots Top Concerns Pub Malware Corp WiFi Top Concerns Forwarding Data Loss 0% 20% 40% 60% 80%

7 Missing Mobile Devices In the past 12 months, has any mobile device containing enterprise data, including laptops or netbooks, come up missing (including accidental loss and theft)?

8 Missing Mobile Devices Results Lost Devices 55% 45% Yes No

9 The BYOD Movement

10 BYOD Drivers Cost: Less capital expenditures on mobile devices But what about support headaches? Productivity: Users are happier with their own devices Yet more distracted? Mobility: Work from anywhere Securely?

11 Bring Your Own Data loss Disaster Disruption Destruction DEVICE

12 Admin server compromised Text sent to all users Devices wiped Admin server taken out

13 Blackberry was King In the beginning, there was BlackBerry, and it was very good.

14 Invasion of Consumer Devices

15 Which lead to Mobile Device Management Mobile Application Management Mobile Content Management

16 Enterprise Mobility Management Suites

17 EMM Features Hardware inventory Software and Application inventory Configuration management Source: Gartner 2014 Magic Quandrant for Enterprise Mobility Management Suites

18 EMM Features Mobile app deployment/confi guration/removal Remote view, wipe, etc. Mobile content management Source: Gartner 2014 Magic Quandrant for Enterprise Mobility Management Suites

19 Securing Mobile Applications If you put it out there, it will get attacked Native app vs web application Data handling SDLC Penetration testing

20 Closing Thoughts BYOD = untrusted devices on your network Many options to choose from Still an emerging space and constantly changing Reduce your attack surface as much as possible (EMM & app)

21 Thank You Questions? Contact information: John H Sawyer