Embracing BYOD. Without Compromising Security or Compliance. Sheldon Hebert SVP Enterprise Accounts, Fixmo.

Transcription

1 Embracing BYOD Without Compromising Security or Compliance The Mobile Risk Management Company Sheldon Hebert SVP Enterprise Accounts, Fixmo

2 New Realities of Enterprise Mobility Mobile devices are pervasive, demand for smartphones and tablets as equals to desktops Beyond Documents, Apps, Browsing, Collaboration Consumerization of IT & BYOD is the weakest link, but necessary What we re hearing from Enterprise & Government: Can our mobile devices be trusted as they roam across networks and are increasingly used for personal services? Can we confidently maintain and prove compliance as we open up corporate-liable and BYOD devices to more corporate data? Can we focus more on managing and securing the business apps and less on managing the entire device??

3 Challenges Facing IT Organizations Device Integrity & Protection Data Security, Privacy & DLP Compliance & Audit Reporting Employee Enablement (full utility of devices and apps) How can we empower employees to do their jobs using the mobile devices & apps of their choice - without compromising security, integrity or compliance? 3

4 Security & Compliance Considerations in a Mobile Device World 1. Smartphones and tablets are now full-fledged computing devices Unconstrained access to (and storage of) enterprise , browsing, apps and data 2. Policy governance: Devices, Apps, Data all of the above? IT policy capabilities differ from BlackBerry to ios to Android 3. Vulnerability of mobile devices to tampering and exploit Jailbreaking, tampering with security configurations, malware, insecure networks, etc. 4. Emerging threats and adversaries putting your organization at risk Hackers, phishing, corporate espionage professionals, rogue wireless networks, etc. 5. Mobile apps and storefronts Even non-malicious apps can put your data at risk and out of compliance 6. Device ownership considerations Corporate-owned vs. employee-owned may impact on how you can implement GRC 4

5 Enterprise Mobility & BYOD: Through the Lens of Risk Management

6 Mobile Risk Management: Understanding Threats 1. Physical device loss or theft Unknown state of device / data, potential compliance breach even if not compromised 2. Casual attackers, snoopers, inexperienced hackers Gaining unauthorized access to lost, stolen or misplaced device 3. Device harvesters Seek to recover data from lost/discarded devices in order to sell the information 4. Industrial espionage professionals Seek corporate data from lost, stolen or easily attacked devices often snoop via WiFi 5. Malicious software developers and hackers Trick users into installing apps with broad security manifests and access rights 6. Poorly designed 3 rd Party Apps Send private corporate data to 3 rd party servers (may or may not have malicious intent) 7. Authorized device users Unintentional & intentional actions Accidental forwarding of private data, falling victim to malware/phishing, etc. Jailbreaking or Rooting a device, forwarding private documents to public servers, etc. 6

7 Mobile Risk Management: Understanding Vulnerabilities 1. Native Application Vulnerabilities Browser/Webkit exploits, and PIM data freely accessible if device is unlocked 2. Platform API Exposures Open API s to access native , Contacts, Phone, Camera, Audio, Screen Capture 3. Hardware-Related Exposures Background audio recording, camera image/video capture 4. Wi-Fi and Bluetooth Vulnerabilities Transmission of data over insecure and unverified WiFi and Bluetooth connections 5. Vulnerabilities Exposed by Jailbroken/Rooted OS s Root access enables bad actors to remove policies, alter config files, access private data 6. Vulnerabilities in Keystore / Keychain Corporate user credentials (VPN, ActiveSync, etc.) stored with varying degrees of encryption in local keystore which is highly susceptible to attack and extraction 7

8 Mobile Risk Management: Threats + Vulnerabilities >> RISK 1. Corporate Data Leakage 2. Privacy Loss 3. Network Intrusion and Corporate Espionage 4. Regulatory Compliance Breaches Standard Mobile Device Management (MDM) & ActiveSync tools do not effectively address the risks if you allow personal apps and some degree freedom on the device 8

9 Fixmo s Approach to Mobile Security & Risk Management 9

10 Corporate Data Security and Containment

11 Fixmo SafeZone Product Overview Defense-Grade Secure Workspace for Corporate Data Security & Compliance Secure and Corporate Data Container Encrypted enterprise workspace on smartphones and tablets Contained from personal apps Full Suite of Native Enterprise Productivity Apps Secure and Resilient BYOD Enablement , Calendar & Contacts Secure Browser Document View/Edit/Annotate Secure Camera, Microsoft SharePoint Extensible to new apps at no charge FIPS AES 256-bit data encryption Resilient no-noc architecture Support for S/MIME Container-level policy management Remote wipe of all corporate data Support for ios and Android 11

12 Fixmo SafeZone Product Architecture DMZ Enterprise Management and Reporting Fixmo Sentinel Management Server (or 3 rd party MDM) Only Approved Apps in SafeZone can access intranet ActiveSync over 128-bit SSL Enterprise Server (ActiveSync) AES 256-bit Encrypted Dataat-Rest DMZ Relay Server SafeZone Enterprise Server http(s) (browser/apps) intranet AES 256-bit Encrypted Data-in-Transit (Optional also deployable with 128-bit SSL direct to ActiveSync) 12

13 BYOD Without Compromise Designed as a Comprehensive Secure Workspace Environment with /PIM, Documents, Browsing, SharePoint and Apps All in One Fully Extensible to Custom Apps and 3 rd Party Apps FIPS Encryption for all Corporate Data-at-rest and in-transit Only trusted apps within SafeZone can connect to the enterprise Wipe ALL corporate data and apps without impacting personal data Support for S/MIME and Two-Factor Authentication Deployable Independent of MDM Solution 13

14 Considerations for Secure and Compliant BYOD (Or ios/android deployments in general!) 1. What are the requirements and expectations of your employees for how they will use mobile devices? 2. Do you want to allow ? Intranet Browsing? Document access? SharePoint access? Custom business apps? 3. Do you need to be able to wipe all business data (structured app data and unstructured documents/files) without wiping the entire device? 4. Do you have regulatory compliance requirements related to encryption of data-at-rest and data-in-transit? 5. Do you see BYOD as a near-term problem or a long-term strategic direction for your company? 14

15 Resources on Fixmo.com Whitepaper: Enabling Your Business through Mobile Risk Management Monthly Newsletter: Mobile Risk Insider Fixmo Blog 15

16 Embracing BYOD Without Compromising Security or Compliance Thank You! Sheldon Hebert SVP Enterprise Accounts, Fixmo