Remote 2014 Monitoring & Control. Securing Mobile Devices November 7 th 2014

Transcription

1 Remote 2014 Monitoring & Control Securing Mobile Devices November 7 th 2014

2 Purpose / Agenda Ken Lewis, CISSP Director of Cross Domain Security Solutions for Tresys Technology Systems Security Engineer Securing Mobile Devices What does security mean to you? Mobile Platforms What customers want Security Available today Demonstration BLUF Security must be built in at every layer Security and functionality are no longer a tradeoff Secure mobility is a reality Informal, please interrupt me as needed for questions

3 Qualifications Leading contributor to open source Security Enhanced Linux (SELinux) Operating System (OS) security provider and evaluator Secure processing system developer International standards contributor Cybersecurity engineering Company Secure Architecture, Design & Development Engineer security components for OEMs

4 The Internet of Things is Changing Our World And the threat vectors keep multiplying

5 Mobile Devices are Pretty Handy Roaming, field work, data collection Wireless system reporting & auditing Multiple apps & concurrent connections: Control system monitoring and reporting Supply chain Business systems Personal / Business Enterprise app stores trusted, automatic updates Mobile device management central & scalable Mobile office is the future always connected

6 What does secure mean to you Encryption in transit or at rest Containers, Isolation Access Controls Security Technical Implementation Guide (STIG) application or locked down Obscure, Classified, Proprietary, N2K, Privacy Separately Managed Virus Scanning Malware detection & remediation Attestation, Trusted Boot Good enough for me!

7 Dr. No & Mobile Device Security A real, big concern Needs to be stronger than desktop security Mobile Device Management (MDM) security is limited Perception of being difficult or costly Our CISO

8 Mobile Security: Foremost Platforms Closed/Proprietary Platforms Apple ios Microsoft Windows Phone Blackberry Samsung Knox Open Linux Platform (with SELinux) Google Android

9 9 Key Customer Demands Highly secure, yet flexible and affordable Security controls vary by market and customer. What is sufficiently secure for one customer will be overkill (and thus overpriced) for another We need to own it Carriers and Enterprises want control over their devices, including image keys, MDM integration, policy settings, and branding We want to customize it One size will not fit all, and carriers and integrators want to be able to add/remove features and controls to satisfy their customers It has to be easy to deploy and manage Has to integrate into existing IT processes and be managed by standard MDM products It has to support my applications Devices are useless without the right applications, and those applications constantly change. It has to be straightforward and painless to load new or updated applications

10 What has Changed? SELinux / SE for Android Mandatory Access Controls Security Level Indicators Compartments Configurable Device Lockdowns Configurable Monitor Service Policy Integrated Apps Layered Security Virtual Private Network (VPN) Data-at-Rest (DAR) Encryption Mobile Device Management (MDM) Integration

11 Interface Controls (managed with policy)

12 Ubiquitous Built in to over 100 Android devices Many vendor and form factor choices

13 Other Applications of Mobile Security Known good secure nodes throughout your network architecture are a realization Secure, Manageable, Remote, Resilient, Affordable, Small, Low Latency, Custom functions, etc. Cross Domain Solution (CDS) Security Technology Known Good Network Validation Nodes reducing the attack vector M2M source & destination validation while communication is parsed validated and formatted Mobile OS security is the foundation The future is The next big thing is Mobile Security

14 Mobile Device Security Take-Away: Secured from the kernel up, affordable secure mobile devices are available that can be used for business and process control systems with minimal risk and minimal effort

15 Demonstration Ken Lewis Nexus 10 Tablet with SE for Android enabled Precise configuration control Multiple Persona (Personal & Business) Layered control of hardware & OS features Personal vs. Business application separation