Mobile App Security Take Any Mobile App and Make It Secure

Transcription

1 Mobile App Security Take Any Mobile App and Make It Secure Ray Bennett Microstrategy - Director, Mobile Service Line World, Las Vegas, 2015

2 Agenda - State of the Art Mobile App Security Introduction - Mobile Security Concerns - MicroStrategy s 7 Pillars of Mobile App Security MicroStrategy Security Model 1. Authentication 2. Device/Application 3. Data 4. Authorization 5. Operations 6. Platform Mobile Device Management (MDM) Summary

3 Introduction What are the threats and what is at stake?

4 Mobile Security Concerns and Risks Most Concerning - Lack of Control Network Domain: More Control External Domain: Less Control Malware Rootkits Botnets Phishing Ransom-ware Intrusions

5 Top Mobile Threats for 2015 According to McAfee Labs *From: McAfee Labs Threats Report.

6 How Big a Problem is Mobile Malware? Total mobile malware samples exceeded 5 million in Q3 2014, up by 16% in this quarter and 112% in the past year *From: McAfee Labs Threats Report.

7 The Expanding Mobile Device Ecosystem Increased exposure Devices do not work in a vacuum - Connect to one or more cloud-based services (enterprise Exchange server, Gmail, MobileMe, icloud, etc.), home or work PC, or all of above When properly deployed, both platforms allow users to simultaneously synchronize devices with private and enterprise cloud services without risking data exposure - However, there are several scenarios in which services may be abused by employees, resulting in exposure of enterprise data

8 Mobile Means More Exposure Victims of our own success Cloud Ever Expanding Attack Surface Internet of Things BYOD Bluetooth More >> Users Device Types Integration Points Moving Parts

9 What is Compromised and Needs Protecting? Names, Telephone Numbers - Contact Information Addresses Text Messages Notes Browser history Application Data (Financial Numbers, Forecasts) Trade Secrets..and on

10 Microstrategy Mobile Secure Solution Preview A Complete, Flexible, and Customizable Security Model Authentication - Multi-factor, via Touch ID, Passcode & Certificate Communication - Information Flow Mobile Server Intelligence Server Firewall Firewall Device Security - Native hardware security including passcode, auto-lock, failed attempt limits Application Security - Double encryption with app level passcode, online or offline Data Protection - AES 256-bit encryption of data in transit and at rest Authorization - Access managed dynamically based on profile and privileges Operations Engineered process and methodology that defines how mobile technology is to be securely used Platform Security - multi-tier architecture to ensure integrity of mobile computing / BI data

11 Mobile Security Custom Models are a balancing act A Mobile Security Model needs to be Customizable 1. Authentication 2. Device 3. Application 4. Data 5. Authorization 6. Operations 7. Platform Fully Open Unsecured Least Secure Fully Lock Down Most Secure

12 Tolerance to Risk vs. Corporate and User Needs A Mobile Security Model Needs to be Flexible Security Functionality User Experience

13 Authentication Credentials Request and Access Log-ins

14 Microstrategy Mobile - User Authentication Device Level and Application Authentication Device ios Profile Logon Network Logon (if using VPN or Tunnel) Microstrategy Project Meta-Data Logon 1. Standard 2. Windows 3. LDAP 4. Database Mobile Server Authentication Account/Logon that Mobile Server Web Pool Runs Under: 1. Anonymous 2. Basic 3. Windows (Service Account)

15 Microstrategy App Passcode, as of 9.4.1, Update 3 An added layer of authentication protection Device level application security Issues credential challenge on each entry Encrypts local caches

16 Microstrategy App Passcode First Entry into App Create and Confirm password Challenge Create Confirm

17 Microstrategy App Passcode Each Successive Entry Attempt

18 Touch ID New in 9.4.1, Update 5 Advanced Biometric Authentication Integration 5X stronger According to Apple, there is 1 in 50K chance of registering a false fingerprint match versus 1 in 10K chance of guessing a 4-digit passcode No guessing Trying out 50,000 different fingerprints is an incredible logistical challenge. Hack proof Apple doesn t store the fingerprint as an image; they store it as a mathematical representation that hackers can t reverse engineer. Convenient Split second access. Don t have to remember an additional passcode. Unique to you; impossible to forget. Supported on ios8 for iphone 5s, 6, 6+, ipad Air 2, ipad Mini 3

19 Touch ID Microstrategy Application Level *Unsupported platforms simply enter passcode

20 Touch ID Microstrategy Document Level

21 Introducing - Microstrategy 9s + The world s most sophisticated Analytics Platform. Now including the world s most simple, seamless and sophisticated identity platform.

22 What is Usher? The future of identification and authentication Usher is a self-service, cloud-based application that simplifies user authentication and delivers unprecedented system security. Protect Cyber Assets Replace Physical Badges Secure Facilities and Entryways Monitor and Manage Activities

23 Log into applications without entering password credentials Bluetooth, QR Code

24 Log into applications without entering password credentials Fingerprint

25 See it for yourself with the Secure Analytics 9s Demo Microstrategy default iphone App Download

26 Microstrategy 9s with Usher iphone Application Access Demo 26

27 Microstrategy 9s with Usher Time and Geo-Fence Restrictions User Does Not Satisfy Following Condition: Time Geolocation

28 Microstrategy 9s Builds on top of existing secure architecture and provides 3 factor authentication

29 Microstrategy 9s Usher platform architecture

30 Getting Started with Microstrategy 9s

31 Single SignOn (SSO) OOB Support Seamless SSO Support for Authentication Providers Tivoli Siteminder Oblix Okta Seamless SSO Support for Portal Server Applications Microsoft Sharepoint IBM Websphere Oracle WebLogic SAP Enterprise Portal Also 3 rd Party Identity Management Systems that support SAML (Security Assertion Markup Language) Federated Identity Management Systems (Ping-Fed) TBA

32 Single SignOn (SSO) Basic Mechanism Device side Application Supports: HTML Forms Consumption Allows Custom Log-on Screen Work-flow

33 Device/Application Mobile User Hardware and Software

34 MicroStrategy Mobile Application Security MicroStrategy Mobile Server MicroStrategy Intelligence Server Web User Authen'ca'on Support for SSO Link Encryp'on User Authen'ca'on Standard LDAP Database NT Expira'on can be set to enforce MicroStrategy user creden'als when opening the app User creden'als are stored encrypted on device. Applica'on data is encrypted on device. Caches can be cleared when exi'ng the applica'on. Isola'on protects App data from other Apps. Apps are signed to ensure the App is authen'c. Run'me checks enforce App Security. Password required aeer 'meout or suspended state (Confiden'al Project Mode) Single signon support. LDAP, Kerberos, NT Integra'on. Independent Third Party Security Tes'ng

35 Apple ios ios8 Secure Encryption Model

36 Google Android Security Model 1. Security at the Operating System level through the Linux kernel 2. Mandatory application sandbox 3. Secure inter-process communication 4. Application signing 5. Application-defined and user granted permissions

37 Security Models Android and ios devices - varying degrees Isolation - Limits app s ability to access sensitive data or systems on device Permissions-based access control - Grants set of permissions to each app and then limits each app to accessing device data/systems within the scope of permissions Traditional access control - Protects devices by using techniques such as passwords and idle time screen locking Limited Hardware Access - Apps can not directly access the underlying hardware Data Encryption - Conceals data at rest on device to address device loss or theft

38 Apple s ios vs. Google s Android A General Summation ios A locked-down platform - Strict Controls on Device and Store - Well designed and thus far, resistant to attack - Rigorous certification model which vets the identity of software authors and weeds out attackers Android Freedom with precaution - Major improvement over traditional computing programs - Less rigorous certification model which allows a more open development environment - Relies on users to make important security decisions

39 Data Protecting Sensitive Data at Rest and in Transit

40 Symmetric Cryptography/Encryption Protects data at rest or in transit (i.e., AES (128, 192, 256)) Hello! 6&%3!aO! Hello!

41 Asymmetric (Public Key) Cryptography/Encryption Exchange symmetric keys, digital signing, x.509 certificate authentication Hello! 6&%3!aO! Hello!

42 Asymmetric Encryption x.509 Certificates Certificate Authority Collects Applicant s Money Validates Applicant s Identity Issues Digital Certificate Issues Private Key X.509 Certificate Private Key Version Unique Serial Number Certificate Signature Algorithm CA Name Validity Period Subject Name Public Key Algorithm Subject Public Key CA Signature

43 Putting It All Together Transport Layer Security (TLS). Also SSL Creates Session Key Uses Session Key to Encrypt Hello! Hello Back!, Server sends Cert Client Cert, Key Exchange, Verify Trust Established Encrypted Communication Asymmetric Symmetric

44 Authorization Implementing boundaries and restrictions

45 Mobile Administrator Utility Security Tab

46 Mobile Server Configuration Admin Settings

48 Mobile Server Configuration Admin Settings ipad Settings Part 1

54 User Configuration Microstrategy Mobile App

55 Authorizing User Access to Secure Objects and Data

56 Authorizing User Access to Secure Objects and Data Information Not-Sharing East Northeast Southeast Central West West Total Exec

57 Authorizing User Access to Secure Objects and Data East Region Users East Northeast Southeast Total Exec

58 Authorizing User Access to Secure Objects and Data West Region Users West West Total Exec

59 Authorizing User Access to Secure Objects and Data CXO Executive User No Viewing Restrictions Northeast Southeast Central West Total Exec

60 Authorizing User Access to Secure Objects and Data Information Not-Sharing East West Exec

61 Authorizing User Access to Secure Objects and Data Information Not-Sharing East West Exec

62 Row Level Security Filters Tabular View

63 Authorizing User Access to Secure Objects and Data Users Iden'fied by a Unique Login and User Name Defined in the Metadata Repository Exists Across Mul'ple Projects User Groups Set of Users Can assign Privileges and ACLs Privileges Apply to All Projects Security Roles Set of Privileges Can be assigned to Users and/or Groups Apply to Specified Projects ACLs can be Assigned to User Groups

64 Granting Access Permissions in Microstrategy Privileges Relates to a user s ability to perform certain functions/tasks such as Mobile, Exporting Data, Drilling, etc. Object Permissions via ACL (Access Control List) Provides user, group, role access/restriction on project metadata objects Security Filters (Could use System User Prompt) Introduces column in database tables for user or group or role End user only sees that row if they have explicit access

65 Operations Process and Methods for the User Community

66 Operational Security Situational Awareness - Keep users informed of the importance and impact of their actions Establish Security Policy Passcode Required Passcode Complexity Procedures for Reporting Lost/Stolen Device Device Management Proactive Monitoring Response to lost/stolen device report Information Management Policies for handling of sensitive data Sensitivity Reduction Information Deception Ensure proper placement and operation of WiFi Equipment

67 Platform Providing Secure Connection Access to the Mobile Server

68 Virtual Private Network (VPN) Device Clients

69 Virtual Private Network (VPN) Secure Pin s Generates access credential based on coordinated algorithm processing Physical Tokens iphone Passcode Generator Provides an extra layer of protection Results in extra user authentication step.

70 Virtual Private Networks (VPNs)

71 HTTPS Encrypted Communication (TLS, SSL) Digitally Signed Cert

72 Recommended MicroStrategy Mobile Security Architecture X.509 Cer'ficate Request Firewall MicroStrategy Cer'ficate Server CRL Firewall Cer'ficate Revoca'on List LDAP Server MD HTTPS (AES) MicroStrategy Mobile Server MicroStrategy Intelligence Server DWH

73 Microstrategy Cloud Hosted Model

74 On Premise

75 Platform Network Security WEP (Wired Equivalent Privacy) - Most common protocol - Currently considered not secure WPA (WiFi Protected Access) or WPA2 - Used in commercial WiFi systems - Extremely difficult to compromise Disable identifier broadcasting Maintain wireless emissions within physical corporate boundaries

76 Mobile Device Management (MDM)

77 Mobile Device Management (MDM) AirWatch MobileIron Citrix

78 MDM Benefits of an MDM Integration Supports a variety of mobile devices (Phones, Tablets, Printers) Provides centralized control to manage, monitor, and support mobile users Supports BYOD models Asserts control over user experience Enforces specific levels of security policy across all mobile devices Protects proprietary organizational information Provides On-Demand VPN (or other) access Supports monitoring Supports ActiveSync ( platforms)

79 MDM Integration Internal App Store Distribution Xcode Distribution/Save/Archive MDM Managed Internal App Store

80 MDM API Integration Code Level App Wrapping Code Level App Wrapping Sandboxes and Containers

81 Code Level App Wrapping Secured by Good Dynamics By Microstrategy v Registered on Sep 11, 2014

82 MDM API Integration Current/Planned Offerings Exists for (update 1, 2, 3, 4). Previously for Currently available in Beta Planned. In contract negotiation and test Planned.

83 Summary Microstrategy Low Vulnerability Mobile Security Model

84 Microstrategy Low Vulnerability Mobile Security Model Communications Data in transit always encrypted (Symmetric and Asymmetric) Network administration Firewall Mobile Server Firewall Intelligence Server

85 Microstrategy Low Vulnerability Mobile Security Model Emissions Data in motion encrypted with WPA and WPA2 Disable Identifier Broadcasting Maintain wireless emissions within corporate boundary Firewall Mobile Server Firewall Intelligence Server

86 Microstrategy Low Vulnerability Mobile Security Model Firewall Device ios/android Protections Digital X-509 certificates ios Remote Wipe Device Lock Max number of failed attempts Mobile Server Firewall Intelligence Server

87 Microstrategy Low Vulnerability Mobile Security Model Mobile Server Firewall Firewall Application Encrypt user credentials and app data Clear credentials Clear caches Leverage ios sandboxing Digitally sign apps Runtime checks Single SignOn (LDAP, Kerberos, Tivoli, etc.) Intelligence Server

88 Microstrategy Low Vulnerability Mobile Security Model Firewall Data User and Group Authentication Privileges ACL s Security Roles Database Level Security Mobile Server Firewall Intelligence Server

89 Microstrategy Low Vulnerability Mobile Security Model Mobile Server Firewall Firewall Authentication App passcode (Complexity, Expiration) Touch ID Microstrategy 9s (Usher Mobile Identity) Digital Signing and Certificates (e.g., HTTPS) VPN Tunneling Auth Models (e.g., Windows NT, LDAP, Basic, etc.) Intelligence Server

90 Microstrategy Low Vulnerability Mobile Security Model Mobile Server Intelligence Server Firewall Firewall Operations MDM Device activation, user authentication, certificate enrollment Configuration profiles, Restrict device features Policy and restrictions enforcement Asset management, theft and loss prevention Situational Awareness

91 MSTR SDK (Extending OOTB Capabilities) Application Device Side Edit un-compiled Objective-C code via X-code Potential customizations: - Rebranding - Springboard icon - Opening logo animation - Custom help - Custom Visualizations Mobile Server Side Java Task Framework (e.g., Mobile Logon Task) XML Configuration Files

92 For More Information

93 For More Information Mobile Security Whitepaper Secure Mobile Computing and Business Intelligence on Apple and Android Mobile Devices Security.pdf MicroStrategy Product Manuals Administration Guide Mobile Administration and Design Guide New Microstrategy Community - Mobile Discussion Forums and Knowledge Base Microstrategy Apple App Store Download(s)

94 Thankyou! Questions? Ray Bennett,