Securing Your Mobile Office

Transcription

1 Securing Your Mobile Office Copyright 2014 K2 Enterprises, LLC. Reproduction or reuse for purposes other than a K2 Enterprises training event is prohibited.

2 Karl Egnatoff Currently Living in Myrtle Beach, SC Twenty- Five Years Public Accounting & Private Industry Experience Nineteen years working with business technology BBA(Accounting) Marshall University CPA, CITP, MCP, CSE, CID Session Overview What is meant by the term Mobile Office The benefits of being connected on the go The move to Bring Your Own Device (BYOD) Security for Mobile Assets Other security considerations Connectivity Bring Your Own Storage (BYOS) and Bring Your Own Cloud (BYOC) Deploying Mobile Device Management Suites 1

3 What Is The Mobile Office A mobile office consists of Portable devices Connectivity User adoption of tools and capacities WHY IS MOBILE COMPUTING IMPORTANT? 2

4 Mobile Computing Adds Efficiency Road warriors often have long periods of time consumed by the travel process Airport waits Time spent on/in planes, trains and automobiles People that have mobile connectivity and the required business tools can use this time to: Make client contacts Read and respond to Complete administrative tasks like expense reports and timesheets Review presentation materials for sales/marketing efforts Improve Customer Relations Business professionals that are connected via mobile computing tools can respond to customers/clients: More quickly With greater resources available In conjunction with other key people in their organization From anywhere that an internet connection is available 3

5 Employee Benefit Which would you rather be on a Saturday afternoon?? A worker that, because you lack needed mobile office tools, must report to the (brick and mortar) office to complete an emergency task that has arisen A worker that uses mobile hardware and software to resolve the same issue in 15 minutes without leaving home Access To Computing Assets Available In The Physical Office Organizations are making the move to virtual computing They are deploying Software Servers and multitenant virtual desktops An increased mobile device footprint provides greater connectivity to these powerful resources Organizations that use quality cloud-based desktops improve security because the need to relocate content diminishes 4

6 WHAT IS BYOD AND HOW CAN IT HELP MY ORGANIZATION? What Is BYOD? Bring Your Own Device (BYOD) - Is a model that allows employees to utilize personally owned devices for business purposes This broadens the base of the organizations technology infrastructure without adding hardware costs Often companies will reimburse employees for monthly connectivity fees thus both sides benefit Reduces redundant devices 5

7 BYOD Examples Smartphones Tablets Ultrabooks Laptops/Notebooks Desktop Computers (What??) Flash Drives Mobile Connectivity Devices Other Peripherals BYOD Security Issues How do we control devices that our organization does not own? Since the BYOD devices are personal what keeps users from comingling personal data with company owned information? What happens if a device is lost or stolen? What can we do if an employee leaves the company? What if they leave on less than amicable terms? What rights do we have related to their device(s) and our data? 6

8 Important Considerations Related To BYOD When an organization authorizes the people it employs to use personal devices to connect to company information the following areas much be addressed: The establishment of connection and data use/storage policy Controls over devices authorized to interact with company systems Configuration tools and rules for connecting users BYOD Information In a study commissioned by Cisco and undertaken by Redshirt Research respondents reported that 64 percent of employees use personal devices to connect to business assets without consent 44 percent of the respondents state that handling BYOD issues diverts IT resources from other important (and planned) projects If proper policies are created and implemented these statistics would not be so alarming 7

9 BYOD Statistics A report published by Forbes Magazine in 2012 cited these interesting statistics: 74% of companies allow some sort of BYOD usage Less than 10% of organizations are fully aware of the devices accessing their network 81% of Employees use at least one device for business use Statistics (Continued) The survey also found that people: Store sensitive data on phones: 34% store sensitive data such as their bank account information or work passwords on their phones Work around company mobile policy: 55% admit they ve sent work or documents to their personal accounts on their phones Chose convenience: 48% have used their devices to log into an unsecure wireless network 8

10 BYOD Policies Internal controls that govern the use of company data with personally-owned devices must be established following the same criteria a business would use to secure other important assets: Assess the risk Respond appropriately by creating functional controls (policies) Implement the policies Test the controls and adjust as conditions merit BYOD Controls Many hardware devices and software applications exist that serve as controls measures over data accessed by mobile devices: Encryption tools Device and data security software Device enrollment requirements Policy enforcement configurators 9

11 Encryption All mobile devices (BYOD or company owned) that house sensitive data should be encrypted The encryption processes in use today are considered unbreakable and as such, if the device is lost or stolen the data remain secure Many users fail to turn on encryption and also fail to protect mobile devices with passwords The difference between losing an encrypted device and one with no encryption is analogous to the difference between losing a credit card and cash Device Security Software There are many strong Mobile Device Management (MDM) offerings available. These products will: Enroll devices that are authorized to connect to corporate resources Require acceptance of BYOD policies before connection is allowed Push security policies to devices Protect company data stored or accessed by mobile units Reduce the IT manpower requirement for controlling BYOD connections Wipe or remove data from items that become disassociated with the corporate connection 10

12 Device Security Software Some of the products available include: Air-Watch ZENPRISE (by Citrix) Symantec MDM MaaS360 MDM SAP MDM 3CX and many others BYOD Enrollment Organizations must lock down access to the data they own and maintain They should only grant access to users with BYOD devices that have been specifically authorized to connect The authorization process should require the BYOD user to accept terms of use Once acceptance occurs the device is Enrolled in the mobile device management schema Most of the MDM software products discussed previously have enrollment components built in 11

13 Policy Enforcement Tools Many companies use policy enforcement configuration products to create technologically enforced policy. Some of the policies that can be enforced and monitored with these offerings include: Password standards Encryption Firewalls for corporate data Data download rules and restrictions BYOD Rules And Regulations While the technology driven tools just discussed are important and helpful, it is important that your organization establishes and adheres to BYOD policies (rules and regulations) All businesses are different and so a boiler plate BYOD for every company cannot exist A number of sample policies that can serve as a starting point are, however, available 12

14 Sample Policies K2 has created a library of sample BYOD policies available You can access them at Use these as a starting point for developing and implementing your BYOD policies Connection Security No matter if the device is BYOD or company owned users must be aware of the level of security related to the internet connections they use Sensitive tasks should only be undertaken using a security connection. Sensitive tasks include: Transferring important content Logging on to secure sites like bank portals Viewing content like payroll information 13

15 Examples Of Connections Which Are Not Secure Connections in retail locations such as coffee shops and restaurants should not be trusted Logging into sites from a hotel business center or using hotel Wi-Fi can be dangerous Wi-Fi provided by transportation organizations such as airlines may be suspect So how can you connect?? -Using your mobile data plan associated with your phone or hotspot to connect is generally a secure way to go Bring Your Own What?? Companies must also be aware of Bring Your Own Storage (BYOS) Personal cloud-based storage space Bring Your Own Cloud (BYOC) Personal hardware storage devices Bring Your Own Flash Drive (BYOFD) 14

16 BYOC Because so much free (or very inexpensive) cloud storage is available many people have gigabytes of data stored in thin air Some of the most often used sites include: Dropbox Box.com SkyDrive (Microsoft) GoogleDrive BYOC Security Users often do not know what level of security is available on these sites Organizations do not wish uncontrolled versions of sensitive content to exist in storage areas to which they have no access Policies must be established to restrict the use of unauthorized cloud storage for business information 15

17 BYOS Many people routinely place a USB flash drive into a computer at work and copy files so they can work on this at home later These small drives are easily lost or stolen and are often not secured with encryption tools Companies should make policies restricting the use of portable storage devices for organization data Thwart The Rogue Flash Drive User 16

18 A New Weapon In the Fight To Secure Mobile Technology MOBILE DEVICE MANAGEMENT TOOLS What Mobile Device Management Applications Offer First off - MDM packages generally control company-owned technology and can be deployed on BYOD devices which connect to corporate resources Once deployed, an MDM product creates three types of controls These are: Configuration Governance Device Usage Limits After the Fact Tools 17

19 Configuration Governance MDM tools can govern the configuration of a mobile asset MDM administrators can set the application to force the use of data encryption, make the user create a password that locks the phone after a period of inactivity, or makes the user create a password that meets predefined length and character type criteria Simply put, it helps keep entity employees from circumventing security to add greater ease-of-use Device Usage Limits Second, administrators can set limits on the use of devices For instance, many people regularly add apps to their smartphones or tablets; these can, at the very least, impede employee productivity and, in a more disruptive scenario, can add hidden tracking tools and malicious content to units which may ultimately cause serious issues Organizations with the ability to control what types of applications are added to devices can greatly reduce the risk of data loss or damage 18

20 After The Fact Tools MDM suites usually have tools to help reduce risk that arises after a device is known to have been lost or stolen If sensitive data resides on a missing device or if the unit can connect automatically to information stored in the cloud or behind a corporate firewall, it creates a risk After-the-fact tools such as device tracking, remote device locking, and remote data removal may serve to mitigate the threat generated by the lost item Device Security Software Some of the products available include: Air-Watch XenMobile (by Citrix) Symantec MDM MaaS360 MDM MobileIron 3CX and many others 19

21 Air-Watch AirWatch was one of the earliest entrants into the MDM market space and is counted as a quality product and a segment leader by many technology and security experts AirWatch allows administrators to monitor and control mobile devices which are enrolled into an enterprises MDM program via the use a dashboard management console It also has the flexibility to allow either administrator-only enrollment, end-user enrollment, or a mixture of both Air-Watch Management Console 20

22 XenMobile XenMobile, formerly Zenprise, was purchased by Citrix and rebranded in the first quarter of It consists not only of Zenprise but also features components of the Citrix CloudGateway solution offered prior to the acquisition XenMobile, like all other quality mobile device management solutions, has strong basic functionality. It, however, has much more, including a simplified deployment process and strong administrative controls XenMobile XenMobile integrates tightly with other Citrix family components to add greater security Tools such as ShareFile can easily connect to XenMobile-controlled devices to provide an encrypted repository for sensitive corporate data The XenMobile Device Manager console has a simplified overview dashboard tab as well as an array of tabs which provide both extremely detailed information and highly granular controls over device, user, policy, and application settings. 21

23 XenMobile Device Manager Console Symantec Mobile Device Management Suite Symantec, like Citrix, acquired an MDM solution provider They rebranded the former Nukona suite, as the Symantec Mobile Device Management Suite As with the others, it possesses the important base features resident in all quality MDM tools with one notable exception it does not provide administrative control over Bluetooth The other significant differentiator is Symantec s simplified pricing model. Pricing is user-based as opposed to device-based 22

24 Symantec Management Console For Mobile Management MobileIron Advance Mobile Management Many of the product reviews of MobileIron reference its holistic view of mobile security They create a micro or more granular look at mobile security compared to some of the other MDM vendors MobileIron, like most other mobile management products, uses the Acceptable App Listing to control the apps running on enrolled devices. However, it makes the approved apps more accessible to device users via an enterprise level app storefront 23

25 MobileIron Feature List Taken From Other Products Because of the expansive nature of the MDM market, we only speak in detail about a small percentage of available mobile device management solutions Other products that have developed a good reputation in the mobile security arena include Fixmo, Good Technology, MaaS360 by Fiberlink, SAP MDM, McAfee Enterprise Mobility, and IBM Mobile Management 24

26 One Last Thing Social Networking Many people are connected social networking tools and access these via the use of mobile devices such as smartphones and tablets Everyone knows the big players in the social networking realm: Facebook Twitter LinkedIn Co-mingling personal devices, which are often automatically updating social sites, with business resources could create security risks Social Networking Users must take care to keep business content separated from data that is accessible by social networking utilities Deploying a Mobile Device Management (MDM) product will often establish successful barriers 25

27 SUMMARY Conclusions Organizations can benefit greatly by, not only adopting mobile technology, but by incorporating a BYOD policy into the mobile technology security initiative Security related to mobile computing is paramount inferior security could turn a positive resource into a weakness for the company The use of MDM suites to security mobile assets that house or connect to corporate data is quickly becoming necessary Beware of social networking application in use on mobile devices that interact with company information 26

28 THANK YOU! 27