mobile device security -...

1

Mobile Device Security

Shayne Champion, CISSP, CISA, GSEC, ABCP Program Manager, TVA GO Cyber Security

“There is no question that mobile security will eventually equal – if not surpass – PC security as a threat to IT departments.”Denise Culver, Heavy Reading Mobile Networks Insider

2

Agenda

Define Mobile Device Security

o Similarities

o Differences

Things you Should be Doing

3

Mobile Device vs. Computers:SIMILARITIES

4

Electronic device

Accept data

Perform prescribed mathematical and logical operations

High speed

Display the results

5

NEWS FLASH:

Mobile Devices

ARE Computers!!!

Sources: http://nordhaus.econ.yale.edu/prog_030402_all.pdf http://www.anandtech.com/show/4215/apple-ipad-2-benchmarked-dualcore-cortex-a9-powervr-sgx-543mp2/2http://www.slashgear.com/ipad-2-benchmarks-blast-competition-show-less-than-1ghz-processor-speed-13139678/

…and we can do something about that, can’t we?

6

Same Kind of Different…

Same kind of security controls you *should* use anyway:

EncryptionNetwork Access Control (NAC)Data Loss Protection (DLP)Anti-Virus (AV) / MalwareInventory ManagementControlled Admin PrivilegesPort & Service Management

7

Similarity: Order of Magnitude

Risk from an Open Systems Interconnection (OSI) perspective:

Most risk shifting to applications

Lower-level layers becoming relativelymore ‘tame’

Source: http://www.sans.org/top-cyber-security-risks/trends.php

Network

OS Transport

OS Libraries

Applications

8

Application Vulnerabilities

Native to many mobile OS (smart phone & tablet)Mobile Device Management (MDM)

Default Permissions may be invasivee.g., Apple log file stores all visited geo-locations

Open Web Application Security Consortium (OWASP)https://www.owasp.org/index.php/Mobile

Source: http://en.wikipedia.org/wiki/Mobile_device_management

“Application security is the next big trend in penetration testing… which means it’s already the big trend for hackers.”Joe McCray, Strategic Security LLC

9

Define: Metadata

Metadata : Data that defines or describes another piece of data.

Some examples of metadata include:File creation date and timeThe address or geographic location where the file was createdYour name, organization’s name, and computer’s name / Internet Protocol (IP) addressThe names of any contributors to the document or their commentsType of camera & its settings when the photo was takenMake, model, and service provider of your smart phone

Source: http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201204_en.pdf

10

Metadata Solutions

Metadata Tools:

Document Inspector : http://preview.tinyurl.com/3996c2a

EXIF Metadata Explanation: http://preview.tinyurl.com/775mbxc

Free Metadata Extraction Tool: http://meta-extractor.sourceforge.netor http://preview.tinyurl.com/aueb4

Disabling Geo-location for Smartphone Camerashttp://preview.tinyurl.com/3v4xznm

Source: http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201204_en.pdf

11

Mobile Device vs. Computers:DIFFERENCES

12

Risk Remediation

Mobile Device risks are the same as many of the risks we already face everyday. For example…

Source: http://www.youtube.com/watch?v=I4_qg22Onak&feature=related

13

Difference 1 : Platform(s) Support

Source: http://www.sans.org; SANS Mobility / BYOD Security Survey March 2012

14

Difference 2 : Bring Your Own Device (BYOD)

Source: http://www.sans.org; SANS Mobility / BYOD Security Survey March 2012 http://www.networkworld.com/news/2012/041712-byod-258264.html?page=3

How do you handle user-owned devices?

ApplicationsData OwnershipEncryption

NetworkWorld BYOD Survey:65.3% necessary tools not in place46.2% increased end user productivity5.7% said it lead to breech, while 66.7% said no 47.2% increased end users' ability to work from home

SANS Survey:

15

Difference 3 : Short Messaging Service (SMS)

SMS: Also known as text messages

Common Vulnerabilities:

1) SMS of Death2) Midnight Raid Business Card Attack3) SMS Tokens4) Smishing Attacks

Source: http://www.infosecisland.com/blogview/12656-The-SMS-of-Death-Mobile-Phone-Attack-Explained.htmlhttp://www.csoonline.com/article/491200/3-simple-steps-to-hack-a-smartphone-includes-video-

16

Each platform – even within the same Operating System (OS) – have unique characteristics, default settings, and/or vulnerabilities:Personal Identification Number (PIN) settings

– Service Carrier– Like default passwords on

routers or admin accountsiPhone / iPad batteries

Scope: Android Fragmentation281+ different products850,000 daily activations300,000,000+ total devices

Sources: http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201204_en.pdfhttp://en.wikipedia.org/wiki/Comparison_of_Android_devices

Difference 4 : Hardware / Carrier

17

Difference 5 : New Vectors

Wireless File Management – A cell phone based application that sets up a web server on a Dynamic Host Configuration Protocol (DHCP) connection. The web-based file sharing allows the circumvention of many DLP controls.

Source: http://searchsecurity.techtarget.com/news/2240112288/Top-5-mobile-phone-security-threats-in-2012http://searchnetworking.techtarget.com/answer/Be-aware-of-Wi-Fi-security-to-deal-with-Firesheep-at-public-hotspots

18

Hardware / Carrier: PIN Codes

Ten numbers represent 15% of all cell phone pass codes:

1) 12342) 00003) 25804) 11115) 5555

Sources: Rooney, Ben (15 June 2011). "Once Again, 1234 Is Not A Good Password". The Wall Street Journal. http://blogs.wsj.com/tech-europe/2011/06/15/once-again-1234-is-not-a-good-password/. Retrieved 8 July 2011.

http://www.phonearena.com/news/Do-you-use-one-of-the-most-common-lock-PINs_id19533

6) 5683 (spells 'LOVE')7) 08528) 22229) 121210) 1998

Other popular choices include Year of birth & Year of graduation (social triangulation!).

Mike Jones, Symantec

19

Things You Should Be Doing

“For many professionals, the mobile phone has become a mobile office.”

Mike Jones, Symantec

20

Control Starts at the Policy

Source: http://www.sans.org; SANS Mobility / BYOD Security Survey March 2012

21

Mobile Policy Best Practices

Think from a threat controls perspective:

o Consider capabilities of mobile devices and apps in your environment

o Identify threat vectors & mitigate

o Identify non-technically enforceable controls and address with administrative policies & awareness

Assess how mobile devices are already managed

Use existing policies as a guideline

Consider how to test successful control implementation

Source: http://www.sans.org; SANS Mobility / BYOD Security Survey March 2012

22

Mobile Risk Management Tools

Source: http://www.sans.org; SANS Mobility / BYOD Security Survey March 2012

23

Protecting the Mobile Executive

Considerations for your Mobile Policy / Best Practices:

USER EDUCATION

Physical Security

Leave it at Home– Clean Loaner Devices– Prepaid Cellular devices– Blank SIM cards– * + Google Voice

Source: http://threatpost.com/en_us/slideshow/How%20to%20Avoid%20Getting%20Hacked%20While%20Traveling?page=0

Fear Public Wireless– Use Conference WAPs– Corporate VPNs

2G = No E!

Don’t Blab

24

Its About the Basics

Verizon Business 2011 Data Breach Investigations Report (DBIR)

Analysis of 2011 attacks determined that:

83% were targets of opportunity

92% were not highly difficult

95% were avoidable through simple or intermediate controls

Source: http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2011_en_xg.pdf

25

THREAT CONTROLS: 2012 SANS Mobile Device Security Summit

1) Jailbreaking & Rooting is BAD for mobile device security

2) The OWASP Mobile Top 10 is going to be just as important

3) Mobile Threats are an evolving, moving target; security teams have to be quick to adapt to new mobile technology

4) MDM solutions are a requirement for any deployment

5) Apple iOS devices are preferred over Android in the enterprise

Source: http://www.infosecisland.com/blogview/20752-Top-5-Things-Learned-at-the-SANS-Mobile-Device-Security-Conference

26

THREAT CONTROLS:2012 Top 5 Mobile Security Threats

1) Geolocation exploits2) Excessive Permissions3) Mobile Application Vulnerabilities4) Unsecure Wi-Fi5) Lost and Stolen Devices

Source: http://searchsecurity.techtarget.com/news/2240112288/Top-5-mobile-phone-security-threats-in-2012

27

Summary

Mobile Devices vs. Computerso Similarities (yes Virginia, they are computers)

o DifferencesMultiple PlatformsBYODSMSHardware / Carrier Issues (PINs, etc)Vectors: Wireless File Transfers

Things you Should be Doingo Policieso User Educationo Protect the Execso SANS Top 20 <-> Top 5 Mobile

28

Questions