BYOD: Should Convenience Trump Security? Francis Tam, Partner Kevin Villanueva, Senior Manager

Transcription

1 BYOD: Should Convenience Trump Security? Francis Tam, Partner Kevin Villanueva, Senior Manager 1

2 AGENDA Mobile Explosion Mobile Trends BYOD Benefits, Challenges and Threats BYOD Security BYOD Strategy Questions 2

3 THE MOBILE EXPLOSION Mobile traffic data in 2011 was nearly 12 times the size of the entire global Internet traffic in 2000 Global mobile traffic will increase 13-fold between 2012 and 2017 By the end of 2013, the number of mobile-connected devices will exceed the number of people on earth By 2017, there will be 8.6 billion handheld or personal mobile-ready devices Gartner predicts that by 2014, 90% of companies will support corporate applications on personal mobile devices Source: Cisco Global Mobile Data Traffic Forecast Update,

4 THE MOBILE EXPLOSION (CONT.) "For many professionals, the mobile phone has become a mobile office - Mike Jones, Symantec "There is no question that mobile security will eventually equal if not surpass PC security as a threat to IT departments" - Denise Culver, Heavy Reading Mobile Networks Insider By 2014, 90 percent of firms will support corporate applications on personal devices - The Economic Times 4

5 COMPUTING TRENDS 4G and WiMax availability continues to expand o Easier and more cost-effective for individuals to gain access to Internet anywhere Smartphones and tablets becoming increasingly powerful o Similar functional capability to desktop/laptop Sophisticated mobile device applications proliferate o Allow extremely robust and dynamic access to information 5

6 COMPUTING TRENDS (CONT.) Cloud computing and SaaS applications are on the rise o Unlimited storage and access capabilities BYOD and Consumerization of IT o Employees choose to stay informed, connected, and productive at work, at home, and everywhere in between Explosion of information o We feel less lost without our wallet than without our smartphone 6

7 MOBILE COMPUTER SALES: TABLETS LEAD Tablets are poised to outsell laptops by

8 MOBILE TECHNOLOGY TRENDS According to CTIA, as of June 2012, there were 327,577,529 active mobile devices connected to US carriers BYOD gaining acceptance in the workplace Mobile Device Sales (3Q 2012): o Android million units (68.1% market share) o ios 26 million units (16.9% market share) o BlackBerry 7.4 million units (4.8% market share) o Symbian 6.8 million units (4.4% market share) o Windows 5.4 million units (3.5% market share) The popularity of smartphones has made them the next major target for cyber criminals 8

9 MOBILE TECHNOLOGY TRENDS 9

10 DEFINING BYOD Bring-Your-Own-Device o Allowing (or not forbidding) the use of personally-owned mobile devices for business purposes Clear benefits: o Drive employee satisfaction and loyalty o Increase productivity o Improved communications, collaboration, and satisfaction o Drive revenue o Improve customer service o Reduce capital expenditures, IT and mobile expenses 10 10

11 BYOD CHALLENGES Additional network load/decreased performance Multiple platforms to support Data leakage risks User is in control Need for management of information security, privacy, and access controls Difficulty of running certain applications on smaller screens Quantifying the benefits of BYOD Compliance with industry and government regulations 11

12 CONSIDERATIONS OF COMPLIANCE PCI Build and Maintain a Secure Network Protect Cardholder Data Maintain a Vulnerability Management Program Implement Strong Access Control Measures Regularly Monitor and Test Networks Maintain an Information Security Policy HIPAA Access Control Audit Control Person or Entity Authentication Transmission Security SOX Section 302 requires that a publicly-traded company s CEO and CFO must vouch for the accuracy of the company s financial reports, including certifying that its internal controls are effective. Section 404 mandates that a publicly-traded company must evaluate its internal controls by an independent auditor and report those results to the SEC. 12

13 CURRENT MOBILE THREATS Malware is the single largest threat to mobile security In 2012, Kaspersky Labs discovered an average of 6,300 new Android malware samples every month, which was an increase of over eight times from 2011 Mobile malware can be divided into three separate categories: Trojans, Backdoors, Spyware Trojans are widely used in SMS attacks Backdoors allow unauthorized access to devices Spyware targets the unauthorized collection of private data 13

14 CURRENT MOBILE THREATS: ANDROID Android is more susceptible to malware than Apple Why? o Lax application markets; apps can be downloaded outside of market o Easy to repackage legitimate applications with malware o Flawed Android security model Large security issues with jail-broken and rooted phones o Hacking mobile phones allows security controls to be circumvented 14

15 CURRENT MOBILE THREATS: FIND AND CALL Apple s first App Store malware: Find and Call App steals phonebook from devices and pushes data back to a command-and-control (C&C) server Data is then used for SMS spam campaigns 15

16 CURRENT MOBILE THREATS: RANSOMWARE Ransomware: o Malware which effectively holds a user s device hostage until a fee is paid 16

17 CURRENT MOBILE THREATS: SMS BOTNETS SMS Spam Botnet: o Directs users to download malware directly on their device 1. An SMS is received containing a URL 2. When the users clicks on the URL, a Trojan is installed on the device with the legitimate application 3. Trojan contacts C&C server to obtain spam message 4. The spam message is sent to the contacts stored in the phone 17

18 CURRENT MOBILE THREATS: ZITMO Banking Trojans: Zeus-In-The-Mobile (Zitmo) Masquerades as a banking activation application and eavesdrops while looking for mobile transaction authentication numbers (mtan) in SMS messages sent by banks to customers for a second form of authentication First appeared in

19 ZITMO CONTINUED 19

20 WHERE ARE ATTACKS COMING FROM? Multitude of Attack Vectors SMS Wi-Fi Bluetooth Infrared Web Browser Client Physical Access Operating System Vulnerabilities Third Party Apps 20

21 DEFINING THE BYOD SECURITY PROBLEM Old: o The good ole static password problem o Cyber attacks: phishing, Trojans, malware, root kits, etc. o Workstations had to be managed, configured, secured, etc. o Data was centralized New: o Multitude of uncontrolled devices o Multitude of unsecured platforms and applications o Several attack vectors o Firewalls irrelevant o Data resides on the endpoints Security burden is shifting o You can t completely protect the end-point from a determined attacker o As device ownership shifts to the employee, so does the burden for protecting it 21

22 IMPLICATIONS FOR THE ENTERPRISE The most intrusive trend for security teams in many years: o Driven by all levels of the corporate hierarchy o Employees sneak in devices despite policies o CEO likes his/her ipad, too o Average number of connected devices per knowledge worker is expected to reach 3.3 by 2014 (from 2.8 in 2012)* Top challenges: o Security o IT Support An opportunity vs. a challenge: o BYOD as a means to embrace security o Security becomes the responsibility of an employee 22

23 BYOD SECURITY: TECHNICAL SOLUTIONS Mobile Device Management (MDM) Software that secures, monitors, manages and supports mobile devices regardless of type, brand, carrier, and ownership. Includes enrollment services, over-the-air (OTA) distribution of applications, data and configuration settings, including the ability to remotely wipe data. (ActiveSync, Good Technology) Mobile Application Management (MAM) Software that is used for provisioning and controlling mobile apps only. Administration of an enterprise app store. Limited to application layer ONLY. (AirWatch, MobileIron) Network Segmentation for Mobile Devices 23

24 BYOD SECURITY BYOD solution providers use a mix of the following strategies: o Sandboxing Roping off business applications using encryption and policy o Containerization Apps cannot inherently share data, new technology is emerging that will allow apps to create a secure tunnel within the OS to share information o App wrapping Applying a management layer and set of policies to a mobile app without required changes to the app itself o Dual-persona Duplicating apps on devices; corporate and personal application o Virtualization emerging model which would allow two separate operating systems 24

25 BYOD SECURITY: SANDBOXING AND CONTAINERIZATION How to implement MAM to ensure the security of the enterprise while allowing employees to freely control their devices. 25

26 BYOD SECURITY: MOBILE VIRTUALIZATION Full mobile virtualization is on the horizon with some implementation taking place for remote access currently VMware offers a solution called Mobile Secure Desktop which allows employees to access their data from any location on any device Remote clients are installed on employee mobile devices which use two-factor authentication (RSA, RADIUS OTP tokens, and smart cards) to access corporate data 26

27 ADMINISTRATIVE STRATEGIES BYOD Policy o Open? More restrictive? o Restrict backup to cloud service providers (e.g., icloud) Set mobile device standards (for support) o ios vs. Android vs. Blackberry OR ask Do you want to manage and support the endpoint hardware or leave it to the user? o What about business continuity needs? Do we replace mobile devices? Training for Employees (transparency of management of devices) 27

28 WHAT IS A GOOD BYOD STRATEGY? People security awareness training, constant education, instill in the culture Process monitoring, enrollment/de-provisioning, quarantine, application lifecycle Policy acceptable use policy, security, access control, password policy, patch management, incident response, business continuity Technology NAC, MDM, MAM, firewalls, IDS/IPS, A/V 28

29 CONCLUSIONS Mobile devices keep us informed and productive. They also have transformed into full-blown computers. As enterprises and employees begin to store critical data on mobile devices, security is vital and fundamental to our overall IT security posture. BYOD does not have to mean Bring Your Own Disaster 29

30 QUESTIONS? CONTACT US Sign up for next month s webinar 30