Fundamentals of Secure Collaboration in the Mobile Workforce. Sinisha Patkovic

Transcription

1 Fundamentals of Secure Collaboration in the Mobile Workforce Sinisha Patkovic 1

2 DISCUSSION Hyper connected X-Times future and blurring of lines between personal, social cloud, & enterprise. CIO Challenge: lost balance between productivity, user satisfaction, and risk management. Governance & Decision Making: Boards don t speak Cyber. Bias: do you know we are wired to value gain over risk? Who is liable for corporate privacy and security? Collaborating in the Cloud who is liable for data breach? 2

3 WHAT IS THE FUTURE OF MOBILITY? The world is moving to a X-Times future 10+ times the connected devices (all end points) 100+ times the apps BYOX & Corporate deployed 1,000+ times the amount of data 10,000+ times the collaboration opportunities 3

4 THE CHALLENGES Users = More integrations BYOD = More devices = More apps Tons of desktop applications! These apps run your business They need to go mobile New technologies Future Proof Data is behind the firewall VPNs not designed for mobile What about UX? How do you manage all the apps How develop these apps? Takes the world by storm. Now we have to embrace it What did MDM get us? ( ) Enterprise apps challenging to build and deploy Application s 4

5 5

6 SECURITY MATTERS $5.4M 752M 50% In 2013, the average cost per data breach fin the U.K. was 2.16 million or 41 per record. By 2016, there will be 752M business use smartphones worldwide. Only 273M will be under MDM management. By 2017, half of employers will require employees to supply their own device for work purposes. 2X 83.9M Employee-owned devices will be compromised by malware at more than double the rate of corporate-owned devices. In 2016, 83.9M corporate liable devices will be shipped, up from 61.4M in Cost of Data Breach Study, Ponemon Institute and IBM 6

7 UNDERSTAND THE SECURITY THREAT Cyber Defense & Mobile Malware Need for automated scanning of applications before they ever reach the device. Also application activity (on device/network) monitoring is necessary. Consumer Applications in the Enterprise Need to separate corporate information from consumer apps. Personal apps only have access to personal information. Someone is ALWAYS Listening The assumption must always be that every data route is insecure. We must built our data channels accordingly. The Insider Threat Being able to limit access to data on mobile devices is equally important as it is on laptops and desktops. 7

8 SECURITY LAYERS Security as a foundation of product development. Product Layers that benefit from security Secure Hardware Secure OS Secure EMM Secure Cloud Infrastructure Secure Value Added Services Secure IoT Microkernel Innovative security: better usability, better accuracy, user centric, context aware. 8

9 UNDERSTANDING ENTERPRISE FORCES Business Enablement Mobile Productivity, App Strategy Secure Voice Collaboration Cost of Ownership Risk Management Intellectual Property Sensitive Data (need for DRM) Regulatory Compliance Privacy User Experience Usability Design / Style Personal Preference Consumer Applications Risk Management Business Enablement \ User Experience 9

10 DATA LEAK RISKS WITH WORK & PERSONAL USE COMMINGLING Private Enterprise Resources Mobile Device Public Networks Work Use ERP, CRM, MIS, FIS Content & Asset mgmt.,etc. Sensitive & Regulated Data User Activity File attachment Cut & Paste USB / microsd Malware Data at rest Direct access Other Personal Use Social networking Personal / webmail IM, SMS, P2P USB / microsd Others Data Loss Data Loss Hacker Command & 10 Control

11 THREAT ATTACK VECTORS Eavesdropping and interception: Insecure external , SMS, P2P chat, and other consumer communications Voice: over-the-air and carrier infrastructure Insecure file sharing Malware: App store malware Device rooting / Operating System compromises Cyber attack with physical possession of device: Device rooting / Operating System compromises Weak or no data-at-rest encryption, weak or no authentication Data loss due to personal use Forwarding work data and files with personal use (webmail, cloud file sharing, SMS/P2P etc.) Insecure file offloading and sharing (cloud file sharing, USB/SD card storage)

12 TRENDS THREATS FOLLOW ASSETS 12

13 DEVICE MANAGEMENT MODELS BYOD Bring Your Own Device CYOD Choose Your Own Device COPE Corporate Owned Personal Enabled COBO Corporate Owned Business Only Organizations continue to invest in Corporate liable devices - COPE demand continues to grow. 83.9M Corporate liable devices worldwide to be shipped in 2016 Growing from 61.4M in 2013 IDC - Worldwide Business Use Smartphone Forecast Update 13

14 CONTAINER SPECTRUM Best Practices In Mobile Device Management Phil Redman, July 26,

15 ECONOMY DATA LEAK PREVENTION Desktop Virtualization VDI/HDV $$/$$$ Application Neutral Containers (pseudonative SDK) $ Application Specific Containers (bolt-on SDK) $$$ Integrated Containers (Native SDK) $ Mobile OS Virtualization (Mobile Hypervisor) $$$ Total Cost of Ownership (including app development) $ least expensive $$ $$$ most expensive Security Data Leak Prevention For Dual Use 15

16 EMM CORE COMPETENCIES Core: MDM, VPN, Container, App Management, is commoditized. Need for Consumer-level User Experience in Container App Baseline Security, License Management, App Analytics, Single Sign On Reputation Services: real time risk engine for compliance and risk related to OS, apps, privacy. Expanded Analytics to manage scale Intelligence Aggregation, Policy Automation 16

17 EMM COMPETENCIES Unified end-point management Desktop, laptop, tablet, smartphone, IoT nodes Mobile Identity and Access User/Person driven, contextualized. File Level protection DRM Operation-level security across file life-cycle. Collaboration Video conferencing, screen sharing. Back-end integration both on premise and cloud. 17

18 FUTURE OPPORTUNITIES Confidence based security: wider context for authenticating user sensors, content, biometrics Right-time Experiences: dynamic content based on multi-source context. Needs breaking of data/service silos. Indoor Location Services. Geo-fencing: automated policy enforcement. 18

19 DISCUSSION Hyper connected X-Times future and blurring of lines between personal, social cloud, & enterprise. Governance: Boards don t speak Cyber Collaborating in the Cloud who owns the risk? Bias: wired to value gain over risk New threat vectors 19