Enterprise Ready. Sean Yarger. Sr. Manager, Mobility and Identity. Making Android Enterprise Ready 1

Transcription

1 Making Enterprise Ready Sean Yarger Sr. Manager, Mobility and Identity Making Android Enterprise Ready 1

2 Enterprise Benefits of Android Java-based, get up and running with ease Open source, no license or royalties Choice of distribution mechanisms Inter-application and inter-process architectures for unified applications (enhanced UX) Low cost of entry Embeds better Others? 2

3 Consumer 69.7% 20.9% 3

4 Enterprise ~77% 4

5 Security Concerns: Fragmentation 5

6 OS Fragmentation Version Codename Distribution 2.2 Froyo 1.10% Gingerbread % 3.2 Honeycomb 0.10% Ice Cream Sandwich % 4.1.x Jelly Bean 34.40% 4.2.x 18.10% % 4.4 KitKat 5.30% 6

7 Device Fragmentation Source: OpenSignal 7

8 Device Fragmentation Source: OpenSignal ,800+ Android Manufacturers Distinct Android Devices 8

9 Android Screen Real Estate Source: OpenSignal 9

10 ios Screen Real Estate Source: OpenSignal 10

11 Fragmentation Manufacturers fall behind Google s reference release due to their own changes Carriers can take months or even years to update the OS on their offered devices Vulnerabilities get left unpatched on older versions To COPE or not to COPE? 11

12 Security Concerns: Marketplaces 12

13 Android 13

14 Apple 14

15 Marketplaces Android is a truly open OS Curation is based mainly on categorization Security is loose or non-existent Google Play is the king of malware Users don t pay attention to app permissions Vulnerabilities can cause actual performance issues and data loss -- not just minor inconveniences 15

16 Security Concerns: Malware 16

17 17

18 Mobile Threats Mobile Threats: Malicious Code by Platform, 2013 Source: Symantec Platform Android Symbian Windows Number of Threats Percent of Threats 97% 2% 2% ios 0 0% Android remains the platform of choice for malware authors 18

19 Mobile Malware Average Number of Variant Per Family Average Number of Variant Per Family :38 1:57 Creation of new mobile malware slowed as malware authors focused on improving existing malware Average number of variants per family in 2012 was 1:38 Increased to 1:57 in

20 Mobile Users at Risk 38 % 50 % Of smartphone users have experienced mobile cybercrime in past 12 months Don t use basic precautions such as passwords, security software or back up files for their mobile device Source: 2013 Norton Report 20

21 Mobile Security IQ DELETE SUSPICIOUS S FROM PEOPLE THEY DON T KNOW HAVE AT LEAST A BASIC FREE ANTIVIRUS SOLUTION AVOID STORING SENSITIVE FILES ONLINE 90% 72% 78% 56% 48% 33% Source: 2013 Norton Report 21

22 Mobile: A Dangerous Mix 1. Prevalence of mobile devices 2. Maturing of mobile malware 3. Mixing of work and personal information on devices 4. User s lack of smart smartphone risk awareness 22

23 Mitigating Mobile Attacks Device Management Identity & Access Control Device Security Remotely wipe devices in case of theft or loss, control password policies Update devices with applications as needed without physical access Provide strong authentication and authorization for access to enterprise applications and resources Ensure safe access to enterprise resources from right devices with right postures Guard mobile device against malware Prevent the device from becoming a vulnerability Application Management Secure data in corporate applications regardless of device ownership Secure File Sharing Enable encrypted file sharing to ensure security as users share information 23

24 Mitigation: Device Management 24

25 Why MDM [Alone] Doesn t Solve the Problem MDM being used to solve broader mobile challenges can bring unplanned challenges Diminished user privacy Managing personal devices = more overhead Cannot take targeted remediation; whole device or nothing All or nothing policies (ex: block Airdrop & icloud) User experience is impacted Making Android Enterprise SYMANTEC VISION

26 Mitigation: Identity & Access Control 26

27 Identity & Access Control Extend enterprise directories to Mobile (via SAML) Integrate CAs where applicable (devices, , WiFi) Per-app VPNs 2FA We want to prove the user is who they say they are, and then give them access to business resources. 27

28 Mitigation: Device Security 28

29 Advice About Android Threats An automated system for generating intelligence about mobile applications Security Identifying malware and goodware (trusted apps) Greyware Risks / Potentially Unwanted Apps (PUAs) Identifying privacy risks and annoyances (e.g. aggressive advertisements) in apps Performance Identifying how apps impact battery life and use cellular data 29

30 Scale 3 million+ Android apps 10 thousand new apps processed every 24 hours 200+ app stores crawled continuously 2 hundred thousand malicious apps identified 1.5 million apps identified with greyware/pua risks 30

31 Android Threats - Ratings Security Ratings Score >= 100 Score >= 75 Score >= 50 Score >= 1 Score <= -1 Score <= -25 Score <= -75 Score <=- 100 Known Good (Trusted App) High-Confidence Good (Trusted App) Medium-Confidence Good Low-Confidence Good Low-Confidence Bad Medium-Confidence Bad High-Confidence Bad Known Bad Greyware Ratings (potentially unwanted app behaviors) Performance Ratings 31

32 Sample Ratings (Example #1) com.rovio.angrybirds v Security Rating Score +80 (Trusted App) Application First Seen: Popularity: Millions of downloads Signer (Publisher) First Seen: Popularity: Millions of downloads SHA256: 89EE8ADD E609D Greyware Risks Exports IMEI to Exports device info to Exports settings info to data.flurry.com Displays ads in the app (AdMob, Burstly, InMobi) Collects location coordinates (InMobi) Performance Rating Foreground Background Cellular Bandwidth Usage 50 (Moderate Usage) 18 (Low Usage) 50 (Average) 32

33 Sample Ratings (Example #2) com.tcn_app_newstype v1.1 Security Rating Score +10 (Low-Confidence Good) Application First Seen: Popularity: 100s of downloads Signer (Publisher) First Seen: Popularity: 100s of downloads SHA256: C2701E8F35F1F Greyware Risks Exports call logs to Exports contacts to Exports location to Can export phone number Can export IMEI Performance Rating Foreground Background Cellular Bandwidth Usage 20 (Low Usage) 50 (Medium Usage) 70 (Higher than Average) 33

34 Sample Ratings (Example #3) net.oking.newcommon v1.0 Security Rating Score -110 (High-Confidence Malware) Application First Seen: Popularity: 50, ,000 Signer (Publisher) Attributes First Seen: Popularity: 50, ,000 Uses an exploit Uses premium services SHA256: 8476A358C3EB393E86AB Greyware Risks Sends SMS messages Exports settings info to androids-market.ru Exports SMS message history Performance Rating N/A 34

35 Mitigation: Application Management 35

36 Containerization and Wrapping Containerization Done in one of three ways: 1. Encrypted Sandbox 2. Hypervisor 3. Wrapping App Wrapping Isolates and encrypts Per app container Allows/disallows OS or app access in/out of the container Most require code edits Important! Solution re-signs app w/out code change No rooting or jailbreaking required Integrated access control 36

37 Containerization and Wrapping Containerization Done in one of three ways: 1. Encrypted Sandbox 2. Hypervisor 3. Wrapping App Wrapping Authentication Required (SSO) Allow Local Storage Offline Access Run on rooted? Copy/paste Restrict network 37

38 Android App Stores 38

39 Apple 39

40 Enterprise App Store 40

41 Mitigation: Secure File Sharing 41

42 Share Files Securely Anytime, Anywhere 42

43 Secure File Sharing (no really) Encryption Management Secure Authentication SAML support provides strong, certificate-based authentication Single Sign-On (SSO) avoids having separate login credentials Multiblind Key Encryption (MBKE) Companies manage their own keys 43

44 Device Management Identity & Access Control Device Security Application Management Secure File Sharing 44