Haciendo Inteligente mi movilidad

Haciendo Inteligente
mi movilidad
Ing. Miguel Angel Aranguren Romero
CISA, CISM, CGEIT, CRISC Cobit Foundations Certificate
CISSP OSCP ITIL 3 Fo ndations Certificate
CISSP, OSCP ITIL v3 Foundations Certificate
Introduccion
The planet is getting more Instrumented, Interconnected, and Intelligent
250 million
Almost 250 million Smartphones
were sold world‐wide in 2010, surpassing laptop sales.
3
90%
Nearly 90% of innovation in automobiles is related to software and electronics systems.
1 trillion
Soon, there will be 1 trillion connected devices in the world, constituting an “internet of things.”
Mobile Threat is Real
Mobile Threat is Real
The use of smartphones, either company liable or employee liable, for business is being quickly adopted by corporate
Worldwide Business Use Smartphone Shipments, 2006–
2014
ƒ
Blackberry was the primary mobile device used in the enterprise, but availability of smartphones with consumer appeal (iOS
with consumer appeal (iOS and and
Android) is changing the game.
ƒ
Employees are asking organizations for support for a variety of mobile devices, including those owned by individuals
including those owned by individuals.
ƒ
Improvement in hardware performance, feature set, and network bandwidth are expanding use cases beyond email.
ƒ
Benefits to enterprise
Increased employee productivity
Improved client service
Reduced cost on device ownership and communication plan (for employee
communication plan (for employee owned devices)
2010 ‐ 2014 CAGR = 24.9%
180
160
140
(M)
120
100
80
60
0
40
20
0
2006
2007
2008
2009
2010
2011
2012
2013
2014
Sources: “Worldwide
Sources: Worldwide Business Use Smartphone 2010 –
Business Use Smartphone 2010 2014 Forecast and 2014 Forecast and
Analysis,” IDC, September 2010.
Las bondades de la
tecnologia movil
Mobility solutions enable organizations to improve information access, enhance productivity and provide better client service
Mobile devices bring enterprises Requirements
great benefits:
ƒ Allow employees to access business information anywhere, anytime
ƒ Improve worker effectiveness and productivity through better connectivity ƒ Provide mobile work locations for employees
Provide mobile work locations for employees
ƒ Increase business communication and collaboration
ƒ Improve responsiveness to clients’ needs
ƒ Reduce telecommunication and network ownership costs
7
LLas dificultades
difi lt d en lal
implementacion efectiva
y el control
Mobile devices used by workforce is a top concern of IT executives due to the challenges with device management and security
“Select five of the top challenges you will face over the next six months.”
Sources: “Executive Spotlight: Top Priorities for Security and Risk Leaders, 1H 2011” Forrester, April 2011
ƒ
Support for a variety of mobile device platforms, most of which have immature security functionality.
ƒ
Balance between non‐ownership of the devices and control on the devices that is needed to protect business data
ƒ
Mobile devices are prone to loss and theft, Mobile
devices are prone to loss and theft
thus are becoming the weakest link in the path of storing/processing business data.
ƒ
No effective process to certify and provision mobile applications
mobile applications
ƒ
Mix of business and personal information on the same device
ƒ
Mobile devices are always on and connected, so are more vulnerable to network attacks. l
bl t
t
k tt k
ƒ
Malware threats are becoming more prevalent.
Mobile Security Threat Landscape Loss and Theft
Loss and Theft
Malware
• Malware existed in various forms (viruses, worms, Trojans, spyware) has been constantly increasing.
• A survey of consumer users found that one out of every three users has ever lost a mobile device.
• A study of SANS.org estimated a 12% infection rate.
• Approximately 2 million smartphones were stolen in the U.S. in 2008.
• No platform is immune. Symbian and WinMo holds lion’s share of malware with Android leading new malware development
Malware threats, WW, 2004 – 2009
Communication
Communication • Bluetooth is a main exploited vector because a device in a discoverable mode can be easily discovered and lured to accept a malicious connection request. • “Man
Man in the middle
in the middle” attacks have been demonstrated to attacks have been demonstrated to
be possible with several platforms using Wi‐Fi links.
• Reported 3GS encryption weakness
• Phishing or pharming attacks can leverage multiple channels: email, SMS, MSS, and voice
10
• Over 56,000 mobile devices were left in the back seats of the city of London taxi cabs during the 6 month period between 2008 and 2009.
• The major benefits of mobile devices (size and portability) unfortunately come with the big risk of losing sensitive data y
g
g
that has to be accepted but can be mitigated.
OS vulnerability based attacks
y
• Mobile OS vulnerabilities increased significantly in 2010. Exploits of vulnerabilities are also on the rise.
• Always on and connected, mobile device is a prime target for hit‐and‐run network‐based attacks and exploiting zero‐day vulnerabilities.
u e ab t es.
• Published techniques to “jailbreak” or “root” mobile devices allow h k t
hackers to get t
administrative access Mobile device malware is a frequently mentioned topic on media ti
dt i
di
“RIM Warns Update Has Spyware”
http://online.wsj.com/article/SB12482717241
7172239.html
Dark Side Arises for Phone Apps
http://online.wsj.com/article/SB10001424052
748703340904575284532175834088.html?m
od=WSJ_hps_MIDDLEForthNews
SANS study: One in five mobile devices running malware
i
l
http://www.infoworld.com/t/malware/sans‐
study‐one‐in‐five‐mobile‐devices‐running‐
malware‐997
11
Smartphones cause the most security concerns among IT executives, as 44% of users purchase their own devices
“How
How concerned is your firm about the level of security or IT risk concerned is your firm about the level of security or IT risk
in adopting the following technologies or technology initiatives?”
“Which
Which of the following statements describes the of the following statements describes the
primary smartphone you use for work?”
Growth in number of known malware modifications (2004 –
2009)
Sources: “Understanding Information Worker Smartphone Usage,” Forrester, November 2009 and Kapersky Lab
Perspectiva de
auditoria y seguridad
Enterprises must have a clear strategy to securely incorporate mobile devices to the business environment
•
Who will be responsible for mobile security management?
¾
Current IT security team responsible for desktop/laptop management and security (advantages: use of the same admin/support structure, applicability of similar concepts)
¾ Outsourcing to a managed service provider (advantages: leverage industry‐level mobile security expertise, cost reduction) •
What platforms are to be supported?
¾ Blackberry, Windows Mobile, Symbian, iOS, Andriod, …
Blackberry Windows Mobile Symbian iOS Andriod
•
What business data will be allowed to be stored and processed on the devices?
¾ Email / contact / calendar only
¾ Business applications (e.g., corporate applications for CRM)
Business applications (e g corporate applications for CRM)
¾ Full intranet access
ƒ Extending best practices for desktop/laptop to mobile devices
¾ Registration and inventory of devices ¾ Efficient install/configure of security applications on devices
¾ Automatic update of security patches, polices, and settings ¾ Reporting of enforcement status
¾ Employee education
With proliferation of mobile devices, applications, and vulnerabilities, hackers are switching their focus to mobile
Malware threats, WW, 2004 – 2009
ƒ The first well‐known malware, Cabir, appeared in 2004. After that, malware existed in various forms (viruses, worms, Trojans, spyware) has been constantly increasing during the past few years.
ƒ No platform is immune. Symbian and Windows Mobile holds lion’s share of malware with Android leading new malware development due to its popularity and open software distribution
software distribution.
ƒ Malware spreads through multiple channels used by mobile devices: 3G/4G, Wi‐Fi, Bluetooth, wired connection to PC. Source: “Mobile Device Security” , ABI Research, 1Q 2010
Sou
ce
ob e e ce Secu ty ,
esea c , Q 0 0
15
Total Mobile Operating System Total
Mobile Operating System
Vulnerabilities, 2006 – 2010
ƒ Mobile OS vulnerabilities increased significantly in 2010. Exploits of vulnerabilities are also on the rise.
ƒ Many earlier vulnerabilities shared software components used by both mobile devices and desktops, but there are now exploits designed to function on various mobile platforms.
ƒ Mobile devices represent opportunities for sophisticated, targeted attacks today. With more financial transactions performed on mobile devices, an associated increase in malware attacks is expected.
Source: “IBM X‐Force 2010 Trend and Risk Report” , IBM Security Solutions, March 2011
March 2011
Threats can occur in various places along the paths that mobile devices traverse to get applications or data
App Store
Wi‐Fi device
Mobile device
Telco service provider
Interne
t
Mobile device • Threat targets
¾
Credentials to access financial accounts
financial
accounts
¾
Business information
¾
Phone call charges
¾
Device itself
(Bluetooth enabled) Mobile device
Web site
Corporate VPN Gateway
Corporate intranet
: The place where threats can happen The “Loss and Theft” threat
Th t
Threat
•
•
•
•
Mobile device is lost due to carelessness or is stolen by a theft.
Data on the device may also be lost when the device is lost (note the data often has a larger value than the device itself).
)
Minutes from the wireless plan may be used or additional phone call charges may incur.
Examples:
– Approximately 2 million smartphones were stolen in the U.S. in 2008.
– Over 56,000 mobile devices were left in the back seats of the city of London taxi cabs during the 6 month period between 2008 and 2009.
Vulnerability Vulnerability
ƒ The two major benefits of mobile devices, small size and high portability, unfortunately are also the major reasons they are easily lost or stolen.
ƒ The
The frequent use of mobile devices (compared to other carry
frequent use of mobile devices (compared to other carry‐on
on items such items such
as keys) is another reason of high loss possibility.
ƒ Access to device is not protected by a password. Phone calls can be placed by anyone possessing the phone.
ƒ Data on the device is not appropriately protected.
Counter the “Loss
Counter the Loss and Theft
and Theft” threat
threat
Methodology
•
•
•
Protect the device from unauthorized use.
Protect
the device from unauthorized use
Make the device useless once it is lost or stolen.
Remove the data on the device.
Techniques h i
•
Use a strong password to access the device.
•
Use GPS to locate the device.
•
Lock the device remotely.
•
Wipe data on the device remotely (if available, backup data first and restore data later).
•
Keep important data on the device encrypted and protected with p p
yp
p
password.
•
De‐activate the phone number or wireless service temporarily. The “Malware” threat
Threat
•
Malware exist in several forms:
Malware exist in several forms:
– Virus / Worms: a self‐replication software that can spread quickly from device to device through app download, email, Bluetooth, MMS, etc. Examples: Cabir, Commonwarrior, Locknut, Frontal.
– Trojan Horse: an application that appear to a valid program but contains code to make unknown use of the device. Example: Rebbrowser.
– Spyware: an application hides itself to monitor the activities on the device such as SMS, email, phone calls. Example: Flexispy, Acllano, Mopofeli
•
Malware could cause loss of personal or confidential data, additional service charge (e.g. by sending Malware
could cause loss of personal or confidential data, additional service charge (e.g. by sending
premium SMS), and even worse, making device unusable.
Vulnerability
ƒ Many mobile platforms are not designed to be secure. OS security holes are continuously discovered.
Many mobile platforms are not designed to be secure OS security holes are continuously discovered
ƒ The current extremely open mobile software distribution mechanism and the lack of capabilities to perform code review from platform vendors give hackers a heaven to create and spread malware. ƒ When
When downloading an application, most users do not pay attention to what parts of the device the application downloading an application most users do not pay attention to what parts of the device the application
will have access to. Applications can get more privileges than it needs to.
ƒ Many users open email/MSS attachments without caution. 19
Counter the “Malware”
Counter the Malware threat
threat
Methodology
•
•
•
Download applications only from trusted sources.
pp
y
Identify malware once it comes into the device and remove it before it causes any damage.
Stop spreading malware.
Techniques •
Get all business applications certified and only install and run certified applications.
•
Do not open unknown attachment/files.
•
Run anti‐malware software to detect malware in real time and scan the entire device periodically.
•
Be knowledgeable about the malware being spread and remove the applications that are suspicious to contain malware.
•
Employee devices are checked against company’s anti‐malware policies before being allowed to access corporate network.
20
The “Spam” threat
Threat
•
•
•
A unsolicited text message
A
unsolicited text message sent to a mobile device from a known or unknown phone sent to a mobile device from a known or unknown phone
number, usually for a commercial advertisement purpose. Spam can take the forms of IM, SMS, MMS, email, or phone calls. Some scary facts:
– There are 4 million spam text messages generated every day.
There are 4 million spam text messages generated every day
– In 2010, 30% of text messages in AP are spam.
Unlike in the case of email, a recipient may be charged for each text message received, so spam is not only annoying but costs money. Wireless service providers also waste a significant amount of bandwidth transmitting spam.
i ifi t
t f b d idth t
itti
Vulnerability
ƒ Extensive use of text messages on mobile devices helps grows the volume of spam. g
p g
p
A wireless plan including unlimited text messages encourages a spammer. ƒ Spam can be sent to any random number or numbers from any online yellow book (unlike for email, a correct email address must be used).
ƒ There is no centralized entity to filter out spam. It is not always easy to tell spam from a normal text message.
21
Counter the “Spam”
Counter the Spam threat
threat
Methodology
•
•
•
Restrict the capability of text messaging.
Restrict
the capability of text messaging
Protect your phone number from being used by a spammer.
Block a spam text message.
Techniques h i
•
Wireless service provider imposes limits on the number of text messages that can be sent out within a short period of time.
•
Use an alias address rather than using the mobile phone number as a text message address. Only messages sent to the alias are delivered; messages sent to the phone number are discarded. •
Use anti‐spam feature on the device to define a blacklist to block spam messages. In an corporate environment, email spam can be filtered by the corporate mail server. •
Report spam to the wireless service provider.
22
The “Phishing” threat
Threat
•
•
•
Phishing is an email or an SMS text message (SMiShing) sent from a fraudster to trick a user to access a faked web site, send a text message, or make a phone call to reveal personal information (e.g., SSN) or financial information (e.g., bank account id/pwd, credit card number).
Examples: – Email “Dear customer, we are conducting annual account verification. Please logon to your account at Bank of xxx, N.A. to verify your account within 7 days. Otherwise your account will be temporarily locked. Thank you.” – Text: “Congratulations! You have got a big prize. Please call 1‐800‐xxx‐xxxx immediately to claim your award.” Phishing can cause serious financial loss.
Vulnerability
ƒ Many users do not verify the source of the email or text message, and tend to immediately click on a web link included in an email/text. ƒ The small screen size of mobile devices make some protection features used on PC (web address bars, green warning light, etc.) not available for mobile devices. URLs may not show full domain names on mobile devices. ƒ Most web sites do not use site authentication techniques to prove their authenticity to users.
23
Counter the “Phishing”
Counter the Phishing threat
threat
Methodology
•
•
•
Block a phishing email or text message.
Enable a user to recognize a fraudent web site or phone number.
Make stolen account information (id/pwd) useless to the fraudster.
Techniques Techniques
•
Use anti‐spam feature to block an email or text message coming from an unknown source.
•
Do not ever click on an URL contained in an email or text message. Instead, start g
,
the browser and enter the URL directly to access the web site.
•
Financial institutes should use site authentication techniques to let users know they are communicating with a genuine web site.
•
Use two
Use
two‐factor
factor authentication to authenticate users. Even if a user
authentication to authenticate users Even if a user’ss id/pwd is id/pwd is
stolen, a fraudster won’t be able to log on without a 2nd authentication factor (OTP, device characteristics, biometrics, etc.). •
Once you know you have entered your id/pwd on a phishing site, log on to the genuine site and change your password immediately
genuine site and change your password immediately.
•
Report the phishing site to the company that owns the genuine web site.
24
The “Bluetooth & Wi‐Fi” threat
Threat
•
Bluetooth and Wi
and Wi‐FI
FI are not threats themselves but very effective communication are not threats themselves but very effective communication
channels/mechanisms to increase the connectivity of mobile devices within a certain range. However, Bluetooth and Wi‐Fi can be easily exploited to infect a mobile device with malware or compromize the data transmitted. A mobile device may be lured to accept a Bluetooth connection request from another infected/malicious device A hacker can use his laptop/server to
connection request from another infected/malicious device. A hacker can use his laptop/server to pretend to be a valid Wi‐Fi “hot spot” to be connected by mobile devices so a “Man‐in‐the‐
Middle” attack can be played to intercept and compromize all the data sent from/to the devices.
•
Examples of Bluebooth based security attacks: BlueJacking, BlueBugging, Bluetooth DoS attacks.
Vulnerability
ƒ Many users leave their mobile devices in a “discoverable” mode, allowing other Bluetooth enabled devices to find them and make connections.
ƒ A user often accepts a connection request without any trust relationship established with the other communicating device
relationship established with the other communicating device. ƒ A user tries to connect to a Wi‐Fi network available in a public area without knowledge of its genuineness.
25
Counter the “Bluetooth
Counter the Bluetooth & Wi
& Wi‐Fi”
Fi threat
threat
Methodology
•
•
•
Do not expose your mobile device to other (infected/malicious) devices.
p
y
(
/
)
Accept a connection request with some degree of trust established first.
Block uninvited connections.
Techniques Techniques
•
Do not ‘auto‐connect’ to any Bluetooth device or Wi‐Fi network.
•
Switch the device’s Bluetooth to a “non‐discoverable” mode to disable other Bluetooth connections entirely, especially in a public place. •
Define “trusted devices” that can exchange data without asking for permissions.
•
Be alert to the Wi‐Fi hot spot that your mobile device is trying to connect to or turn off the Wi‐Fi capability in a public space. p
y
p
p
•
Run a firewall to filter incoming connection requests from unknown devices. •
Do not transmit personal information or business critical information over a untrusted Wi‐Fi network.
26
Mejores Practicas
Choosing the right mobile security solution that can sustain changes of device technology, use cases, and threat landscape
•
A client ‐
A
client ‐ server/cloud solution architecture that can effectively support server/cloud solution architecture that can effectively support
platform and feature expansion ¾ A server or cloud service controls and manages policies and settings for various security features. The server is fully independent of the mobile platforms and provides easy to use admin interface.
y
p
p
p
y
¾ The client installed on the device communicates with the server/cloud to obtain policies and execute functions locally. Some security functions or data may even be offloaded to the server/cloud. The client should be built so it can be easily ported to a new platform. ¾ EEach platform provides some security features. The client should either leverage the platform h l f
id
i f
Th li
h ld i h l
h l f
specific functions (wherever available) or include platform agnostic capabilities. ¾ Ideally all the security features can be invoked from one client, so the client needs to be flexible to incorporate new capabilities to counter new threats.
•
Features need to be easy to use and require little user intervention.
•
Report and analysis capabilities should enable policy and regulation compliance.
compliance
•
Efficient solution roll‐out and management is critical to large enterprise deployment.
Where there is a threat, there is a way to counter it… Threat management
Identity threat
Analyze threat
Counter threat
Monitor threat
Find out the essence of the threat (what, when, where)
Figure out why the threat can happen and what vulnerabilities are l
biliti
exploited
Use technology and best practice to combat the th t
threat Evaluate the countering ff i
effectiveness Threats
•
•
•
•
•
Best Practices
Loss and Theft Malware
Spam
Phishing
Bluetooth & Wi‐Fi
ƒ Strong password
Technology
ƒ Open files from known sources
ƒ Encryption
yp
ƒ Authentication
ƒ Download certified applications
ƒ Lock / wipe
ƒ Disable Bluetooth
ƒ Firewall
ƒ …
ƒ Anti‐spam
ƒ Malware detection
ƒ …
Enterprises must embrace mobility to reap the benefits, but also must have a clear strategy to address mobile security requirements
• Extend the current workplace IT security control to mobile devices
Extend the current workplace IT security control to mobile devices
¾ Corporations have worked hard over the years to develop a corporate security policy to ensure traditional end point devices (desktop, laptop) are protected from threats and vulnerabilities, and now have to extend the policy to mobile devices (smartphone, tablet).
• Recognize
Recognize unique characteristics of mobile phones in considering security unique characteristics of mobile phones in considering security
measures
¾ Proliferation of different Smartphone platforms (not just Windows)
¾ High portability leading to a much higher chance of loss/theft (no physical lock)
¾ No ownership/control on the devices No ownership/control on the devices
• Choose a security solution that can sustain changes of device technologies and security threats
¾Smart device technology advances extremely quickly and
¾Smart
device technology advances extremely quickly and new mobile security threats are evolving mobile security threats are evolving
fast, so the chosen mobile security solution must be flexible to be compatible with growing technology and capable of incorporating new techniques to counter new threats.
ƒ Education is so important as technology Education is so important as technology
¾Education for employees to use mobile devices in a smart and secure way is even more important because employees have bigger control on the devices and may access corporate sensitive data using unapproved applications from unsupported devices.
Propuesta metodologica
de revision
Mobile security technology can help counter the threats …
threats
•
•
•
•
•
•
•
•
•
•
•
Run anti‐malware software to detect malware in real time and scan the device periodically.
R
Run a firewall to filter incoming connection requests from unknown devices.
fi
ll t filt i
i
ti
t f
k
d i
Use ani‐spam to block spam messages, voice call, and email.
Encrypt personal or business data stored and transmitted.
Locate and lock a lost/stolen device remotely.
Locate and
lock a lost/stolen device remotely.
Wipe data on a lost/stolen device remotely.
Periodically backup device data so restore is possible. Use site authentication and/or two‐factor user authentication to increase the trustworthiness between a user and a web site to prevent phishing.
Manage and certify applications and remove suspicious/malicious applications automatically.
Integrate mobile security technology with the corporate VPN gateway so
Integrate mobile security technology with the corporate VPN gateway so device security posture becomes dependency for corporate resource access. Incorporate mobile security into the end point security management program of the organization
But mobile security best practices are equally important
•
•
•
•
•
•
•
•
•
•
Install the latest platform and security patches
Use a stronger password to access the device.
Set up a timeout to lock the device when it is not used.
Do not open or run unsolicited multimedia messages and attachments
coming from unknown sources.
Do not download unknown third party applications at will. unknown third party applications at will
Do not click on an URL contained in an email or text message. Instead, start the browser and enter the URL directly to access the web site.
Do not download content from dubious or unknown web sites.
download content from dubious or unknown web sites
Disable Bluetooth when it is not used. Set Bluetooth in a undiscoverable mode. Turn off the automatic Wi‐FI connection, especially in a public area.
Reduce the amount of confidential or business data stored on the mobile device.
Propuesta metodologica
SSL VPN for Mobile
GPS Locate
Antivirus
Parental Controls
Firewall
App Control/Removal
Anti‐spam
Security Event Reporting
Lock/Wipe Backup/Restore
Lock/Wipe, Backup/Restore
Device Registration Reporting
Device Registration Reporting
Advanced MDM
Cloud‐based
Conclusiones y
reflexiones finales
Conclusiones y reflexiones finales
Embracing mobile devices such as smart phones or tablets in the workplace enables organizations to improve information access enhance employee productivity and provide better
access, enhance employee productivity, and provide better client service, but also present significant challenges in device and security management. The security threats to mobile devices have evolved to all the threats applicable to desktops plus new ones unqiue to mobile devices due to the natures of high portability divesity
mobile devices due to the natures of high portability, divesity of platforms, and mixed device ownership. Organizaiton need to have a clear strategy and a capable solution to address evolving mobile security requirements
address evolving mobile security requirements.
. GRACIAS!!!
Ing. Miguel Angel Aranguren
Ing
Miguel Angel Aranguren Romero
CISA, CISM, CGEIT, CRISC Cobit Foundations Certificate
CISSP, OSCP ITIL v3 Foundations Certificate
marangur@co.ibm.com
Miguel aranguren@gmail com
Miguel.aranguren@gmail.com
Miguel.aranguren@isaca.org.co