Scott Totzke - PowerPoint PPT Presentation

Loading...

PPT – Scott Totzke PowerPoint presentation | free to view - id: 121b61-ZjFhM



Loading


The Adobe Flash plugin is needed to view this content

Get the plugin now

View by Category
About This Presentation
Title:

Scott Totzke

Description:

How To Avoid Being The Next Headline. What Is Security? ... Travelling (trains, taxis, buses etc.) Waiting (Airports, train stations. Doctors, Dentists etc. ... – PowerPoint PPT presentation

Number of Views:84
Avg rating:3.0/5.0
Slides: 42
Provided by: Dunca45
Category:

less

Write a Comment
User Comments (0)
Transcript and Presenter's Notes

Title: Scott Totzke


1
(No Transcript)
2
Secure Mobile DataHow To Avoid Being The Next
Headline
Scott Totzke
Vice President, Global Security, Research in
Motion
3
What Is Security?
  • By its nature, security is the sum of its parts
  • Security is only as good as its weakest link
  • Security needs to touch all aspects of products
  • It is an attribute of a system that must be
    built in
  • Cannot be an after thought in the product
    process
  • Security is more than encryption
  • Security is about letting the good guys in and
    keeping the bad guys out
  • Threats can come from unexpected vectors
  • New security systems for protecting IT
    infrastructure
  • What about the Air Conditioning Systems

4
Security Versus Usability
  • Security is always at tension with usability
  • Flexible approaches to security are required in
    the real world
  • Administrators set the level of security
  • Balance tradeoffs for usability
  • There is no One Size Fits All approach to
    security for any system

5
The Value Of Mobile Data
38
94
average increase in team efficiency
of users improved their ability to manage their
Inbox
93
63 min
of users converted down-time into productive time
average down-time recovered daily 250 hrs
annually
238
average ROI solutions turn profit in lt 5 mos.
6
Benefits Of Mobile Computing
  • Soft Benefits
  • Efficiency
  • Effectiveness
  • Employee satisfaction
  • Hard Benefits
  • Reduced staff requirements
  • Reduced hardware costs
  • Lower remote connectivity costs
  • Reduced costs for mobile voice

7
The Value Of Mobile Data
  • Different values and risks for government
  • Support missions within government
  • Public Safety
  • Emergency Preparedness
  • Public Health
  • Defense
  • Economy
  • BlackBerry is the one tool that lets me be more
    responsive to my constituents

8
Mobility In The Pubic SectorUK Government
Breakdown
  • 51 of Local Governments are undertaking some
    form of mobile working
  • 37 of Local Governments are planning to
    introduce some form of mobile working
  • 12 of Local Governments are were yet to be
    convinced

2006 Project NOMAD Survey
9
The Importance Of Security
10
The Importance Of Security
11
The Importance Of Security
12
The Importance Of Security
13
The Importance Of Security
14
The Realities Of Providing Mobile Access To Your
Network
  • What does mobility mean you?
  • Your corporate network spans the globe with
    access from unknown private IP addresses
  • Users your data were from every corner of the
    world
  • Small, mobile computers provide full access to
    your network
  • Confidential information is sent to terminals on
    insecure networks - Email, calendar,
    intranet, databases
  • Users expect to be connected anytime, anyplace,
    anywhere
  • These devices are outside your firewall

15
Smartphone security
  • Similar risks and threats as laptops, but
  • Must manage resources more efficiently
  • Battery life, Network capacity
  • Processor power, storage
  • User Experience / Expectations are different
  • These are personal computers
  • They go everywhere and they will be lost, stolen
    and left behind
  • Significant amounts of sensitive data
  • Always connected, instant access to everything
  • These devices will become targets for attackers
  • Mobile malware, remote network attacks

16
Key Security Features
  • Customers need standards-based
  • solutions that offer
  • Transport and local data encryption
  • Robust application development support
  • IT management and administration tools
  • Malware protection/containment
  • Centralized device management
  • Remote lock / remote data wipe
  • Remote lock and wipe capabilities
  • Desktop security paradigms
  • S/MIME, PGP, SSL, TLS

17
Key Security Features
  • Customers need standards-based
  • solutions that offer
  • Multiple authentication mechanisms
  • Users
  • Applications
  • Built-in firewalls
  • Detailed logging capabilities
  • Tools to enable regulatory compliance
  • Service reliability and availability
  • Security certification and assurance
  • User education and awareness

18
What is a vulnerability?
  • More commonly, we call them software
  • defects, bugs, or issues
  • Software defects are unavoidable in complex
    systems
  • The relationships between mobile customer,
    handset, carrier network, service, and corporate
    network form a very complex system

19
The threat of mobile malware
6000
Number of malware incidents reported by CERT in
2006
83
Number of mobile operators affected by malware in
2006
McAfee Report - 3GSM - February 2007
20
The threat of mobile malware
  • More than 200 variants of mobile
  • malware today
  • Handset attacks Skulls that disable Symbian
    handsets
  • Service/system attacks RedBrowser that sends
    high-value SMS messages on J2ME handsets
  • New attacks growing exponentially year over
    year increasing customer awareness and concern

21
The risks of mobile malware
  • For enterprises and end users
  • Data leakage / loss
  • Denial of service
  • For carriers and service providers
  • Relationships between handsets and networks can
    be exploited
  • Disrupt service to a geographic area
  • Interrupt an entire service/network
  • Impact multiple users, regardless of handset
    vendor
  • These attacks will become more sophisticated over
    time

22
How Do You Prevent Malware In Smartphones?
  • Anti-Virus software typically consists of two
    parts
  • Detection
  • Containment
  • Detection is hard
  • Requires big database
  • Storage space is still precious
  • Requires constant updates to remain useful
  • Or back end connectivity
  • What if you are out of coverage?
  • Or cannot turn on your radio?
  • Fundamentally, how do you know ahead of time that
    something is malicious?
  • Halting problem in Computer Science
  • Containment is easy
  • Shut down all methods to step outside a process
  • Application policies and controls

23
Software Configuration Policy
  • Allow the CEO to download games and let the
    Administrator sleep at night
  • Contain and Control malware
  • Permissions controllable by administrator and
    user
  • Most secure setting enforced
  • Specify Applications as Required, Optional, or
    Disallowed
  • Create allowed lists and/or restricted lists
  • Required applications cannot be removed by the
    user and can be automatically pushed over the air

24
Authentication In The Mobile World
  • It must be an effective method
  • The method must be appropriate for the situation

25
Authentication Goals
  • Is the user allowed to use the device?
  • Device authentication
  • Is the user allowed to talk to my network?
  • Network authentication
  • Is the user allowed to access my service?
  • Service authentication

26
Device Authentication
  • Passwords
  • Most common approach
  • Need ability to centrally manage
  • Establish for use
  • Force use
  • Complexity
  • Timeouts
  • What if the user forgets their password?
  • Usability concerns
  • Understand user experience

27
Device Authentication
But how do you make it easy?
28
Device Authentication
  • One alternative is multi-factor authentication
  • Something you know (Password, PIN, etc.)
  • Something you have (Smart card, RSA token, etc.)
  • Something you are (Fingerprint, Iris, etc.)

29
Can You Push Vendors To Deliver Practical
Solutions That Work
  • How do you use a physical token with a mobile
    device?
  • Make it wireless!
  • Proximity Smart Card Reader
  • IT Controlled
  • Extensible by 3rd parties
  • Why Wireless?
  • Adds another dimension to the multi-factor
    authentication formula
  • Presence

30
Starting Points For Securing Your Mobile
Deployment
  • Develop A Mobile Security Policy
  • Look at your existing policies today
  • Desktop/laptop policy
  • Internet/Acceptable use policy
  • Enforce The Use of Passwords
  • Understand the user experience on the device
  • Small keyboard (QWERTY, SureType, T9, Virtual)
  • Frequency and difficulty entering passwords
  • Do alternate authentication mechanisms make
    sense?
  • Require Encryption For All Data
  • Data at rest as important as data in transit
  • Cornerstone for protecting information outside of
    your network

31
Starting Points For Securing Your Mobile
Deployment
  • Develop An Application Policy
  • Standard/approved applications only
  • Reduce support costs
  • Manage Risks
  • Contains malware risks and other data leaks
  • Instant Messaging?
  • Social Networking?
  • Establish Auditing Requirements/Controls
  • SMS
  • MMS
  • Phone Logs
  • Develop Procurement Guidelines
  • Certified Products/Vendors
  • Leverage Existing Certification Framework
  • CAPS, Common Criteria, FIPS
  • Education and Awareness!!

32
(No Transcript)
33
(No Transcript)
34
Bill McCluggage
Director, Delivery Innovation DivisionCIO NI
Civil Service
35
IA08 June 2008
Blackberry The User Experience
How to avoid being the next headline
Delivery of better public services through
improving our capacity and providing staff with
the necessary technology and facilities
36
The Landscape
  • A Federated Organisation
  • 11 Departments
  • 6 IT Organisations
  • 18,500 IT users
  • 1500 Blackberry Devices

37
  • Productivity Benefits
  • Travelling (trains, taxis, buses etc.)
  • Waiting (Airports, train stations. Doctors,
    Dentists etc.)
  • Meetings (Before, after and during)
  • Conferences (lulls, breaks and sessions of no
    interest)
  • First thing and last thing (before setting off
    and before switching off)
  • Hotels
  • The list is extensive but can be summarised as
    follows
  • Whenever youre out of the office and have a mind
    to check your e-mail

38
Workflow Efficiency Benefits Significantly
Increases the efficiency of the teams back at
base. (30) BlackBerry Immediacy Benefits The
immediacy of response to urgent e-mails is of
paramount importance.
39
(No Transcript)
40
  • SECURITY
  • 6 character Alphanumeric Password (Possibly
    about to change)
  • Forced password change after 90 days
  • 5 Invalid Password attempts wipes handheld
  • AES 256 bit encryption of data
  • Device timeouts (10 minutes) when inactive
    (re-enter password)
  • Device switches off on holstering (re-enter
    password)
  • No Bluetooth??
  • Very tight Security Policy implementation

41
An extremely valuable business tool which has
improved the productivity of our increasingly
mobile workforce
About PowerShow.com