Ibrahim Yusuf Presales Engineer at Sophos Smartphones and BYOD: what are the risks and how do you manage them?

Transcription

1 Ibrahim Yusuf Presales Engineer at Sophos Smartphones and BYOD: what are the risks and how do you manage them?

2 Tablets on the rise 2

3 Diverse 3

4 The Changing Mobile World Powerful devices Access everywhere Mixed ownership User in charge

5 Powerful devices Music player Personal Calendar Internet Company Text messages Chat Photos File store Banking 5

6 Access everywhere In the office In the coffee shop Whilst travelling At home

7 Paradigm shift Threats remain the same, but they differ on each platform

8 Mixed ownership Employee-owned devices Corporate-owned devices 8 Analysts forecast a shift in ownership over the next 3 to 5 years

9 The user as the administrator 59% 51% 76% Say employees circumvent or disengage security features such as password and key lock Have experienced data loss in the last 12 months due to insecure mobile devices Believe mobile devices put their organization at risk but many do not have the controls (39%) or enforceable policies (45%) to reduce this risk 9 Source: Ponemon Institue, Global Study on Mobility Risks, February 2012

10 IT Security Challenges Stay compliant Optimize usability Protect data and devices Multiple Devices Multiple Platforms

11 For the bad guys Valuable information straight from your mobile

12 For the bad guys Threats remain the same, there are new ways to get closer to your money =

13 Risk through 13 The jailbreaking/rooting community are masters at exploiting undisclosed vulnerabilities

14 Attacks Malware though rogue Apps Mobile malware disguised as fake online banking applications 14

15 Attacks SMS fraud App (becoming more common) Intercepting banking authentication code 15

16 Attacks SMC Messaging attack text-messaging attacks (also becoming more common) 16

17 Attacks Hobbyists is one thing, imagine what governments can do 17

18 Threads Top most detected malware fake Opera app FndNCll-A BBridge-A PJApps-C Duh Plankton malware. DroidRt-A Generic-S BaseBridge Opfake-C DrSheep-A 18 Ikee

19 Threads Top most detected malware 19 Sophos: SophosLabs

20 Inevitable 20

21 Inevitable, really? 21

22 Basics Do the basic well and really really well 22

23 Do the basics well Develop an enterprise strategy for mobile security Create a comprehensive policy (including detailed guidelines) for all employees and contractors who use mobile devices in the workplace. Establish organizational accountability Launch awareness training for end-users (to reduce employee mistakes). 23

24 Do the basics well Use application control, patching and other controls to prevent hacking and surreptitious malware infections. Whenever feasible, use remote wipe, mobile device encryption and anti-theft technologies to reduce data breach risk. Understand emerging privacy issues inherent with mobile devices. 24

25 you also nee the tools:

26 Mobile management approaches Fat client v Lightweight agent Sandboxes business access Enables tight control May create support challenges Uses built-in capabilities and apps Manages the entire device May cause difficulties in segregating data 26

27 In summary Password Encryption Patched 27 Current

28 Control, secure, protect Sophos Mobile Control - Mobile Device Management On-premise or cloud-based solution to manage, control and protect mobile devices. Enable BYOD without the risks Sophos Mobile Security Anti-Virus for Android Scans for malicious data-stealing apps and provides loss and theft protection. Free download è è è Protect devices from Android malware Sophos Mobile Encryption Mobile Data Protection Extends SafeGuard Encryption for Cloud Storage to mobile devices ios or Android* Ensure persistent encryption Android version available late September 2012

29 Complete security Everything you need to stay protected Endpoint Web Data Mobile Network Anti-malware Anti-malware Anti-malware Disk Encryption Anti-malware Unified Threat Management Firewall Intrusion prevention Malicious URL Filtering Anti-spam File encryption Mobile Control Secure branch offices Device Control Application Control Productivity Filtering Data Control Key management Mobile app security WiFi security Access control Endpoint Web Protection Anonymizing Proxy blocking encryption Device Control Web Application Firewall Encryption Patch Manager Content control Data Control archiving Data Control Virtualization HTTPS Scanning Encryption for cloud

30 Thank you. Ibrahim Yusuf Presales Engineer at Sophos