mobile device security msit 458 - information security december 4, 2010 team magic: michael gong...
TRANSCRIPT
![Page 1: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/1.jpg)
Mobile Device SecurityMSIT 458 - Information Security
December 4, 2010
Team Magic:
Michael Gong
Jake Kreider
Chris Lugo
Kwame Osafoh-Kantanka
![Page 2: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/2.jpg)
2
Agenda• The Problem• Existing mobility solution• Developing the new solution• Explanation of solution
![Page 3: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/3.jpg)
3
Introduction
“By 2014, 90 per cent of firms will support corporate applications on personal devices”
- The Economic Times, Nov. 30th, 2010
"For many professionals, the mobile phone has become a mobile office,“
- Mike Jones, Symantec
"There is no question that mobile security will eventually equal – if not surpass – PC security as a
threat to IT departments," - Denise Culver, Heavy Reading Mobile Networks Insider
![Page 4: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/4.jpg)
4
Problem Statement
With the explosive growth of smartphones, tablets and mobile devices, companies must find a means of providing
access to their internal systems and information to their mobile workforce securely and seamlessly.
![Page 5: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/5.jpg)
5
Existing Enterprise Blackberry solution
• Microsoft Exchange 2003 • Blackberry Enterprise Server
4.1 SP7• 10,000 email boxes
• 2,000 using mobile devices
• Only company provided Blackberry devices are supported
![Page 6: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/6.jpg)
6
Key Mobile Device Security Concerns
• Confidentiality• Commercial Data
• Ex: Financial, IP, etc.
• Personal Data• Ex: Customer, Employee records, PCI,
etc.• User Personal Data
• Diplomatic cables
• Accessibility• Resource uptime• High Availability / Recoverability• Archive
Maintain device flexibility while protecting against security risks
![Page 7: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/7.jpg)
Current Needs of the Business and Solution Approach• Business users today are more
mobile than ever before and are looking to access the enterprise from multiple devices:
– Apple iOS– Android– Blackberry– Windows Mobile
• Users today are more technically skilled than before and are unfortunately able to develop “Business Managed Solutions” which may not meet the security requirements of the enterprise
– Must securely support users on the 4 identified leading mobile platforms
– Must leverage the significant existing Exchange and Blackberry investment
High Level Requirements &Solution Approach
The answer – A Mobile Device Management (MDM) Solution
![Page 8: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/8.jpg)
8
DEVELOPING THE SOLUTION
![Page 9: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/9.jpg)
9
Solution Requirements• MS Exchange
• Exchange 2003 or Exchange 2007 SP2• ActiveSync (EAS) enabled• Enterprise Certificate services / certificate based
authentication• Mobile Device support
• Support latest Mobile OS’s• Employee-provided device• Support for VPN, Wi-Fi, ActiveSync and encryption• Centralized IT management & control• Support for common file attachments
![Page 10: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/10.jpg)
10
Solution Requirements (cont’d)• Security
• All devices should be enrolled into corporate network• Provisioning of mobile devices should be secure• Security policies should be targeted to right groups/employees• Restriction of some/all mobile applications• Complex/multi-character passwords required• Updates of mobile OS required• Encryption of all forms of corporate data• Tracking and inventory of all devices• Access control over corporate email system• Sanction and disconnect modified devices or rouge device• Selective/full remote wipe of device
![Page 11: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/11.jpg)
11
MDM vendor selection/comparison
![Page 12: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/12.jpg)
12
Chosen Solution
Good Technology• Manage & Protect access to vital company information
• Without imprisoning the user or their device
• With flexibility…• Manage the entire device
OR• Manage the Good application
• Plays nice in the mobile sandbox!"Corporate policies should focus on regulating behavior, rather than
devices..."— Gartner, May 2010
![Page 13: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/13.jpg)
13
Making a Good device
![Page 14: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/14.jpg)
14
Security Architecture
![Page 15: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/15.jpg)
15
Operational Architecture
FIREWALLS
FIREWALLS
AD / LDAP Services Email Servers
Good Message Servers
Good Mobile Control
Good Mobile Access
SQL Database
Good NOC
SSL
![Page 16: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/16.jpg)
16
Cost Comparison
Good Technology Solution Capital ExpenseSoftware (2000 licenses) $140,468 -Hardware $178,801 $34,410 Maintenance - $57,775
Sub Total $319,269 $92,185
TOTAL 2 year capacity $411,454
Per Device Comparison
Blackberry Enterprise Server
Good Technology
Annual data plan service $504 $0*Annual Inclusive maintenance & support $4 $159 Total annual cost $508 $159
020
040
060
080
010
0012
0014
0016
0018
0020
00$0
$200,000
$400,000
$600,000
$800,000
$1,000,000
Annual Cost Comparisonof Mobility Run Rates
Good Technology
Blackberry ES
![Page 17: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/17.jpg)
17
Business/Legal Consequences• Financial Liability
• May be required to pay stipend for device/usage• Additionally corporate data plans apply in some instances
• Employee may be taxed for fringe benefit• Nonexempt employees create issues
• Legal Liability• Evidence of illegal activity must not go unreported• Archiving may be required
![Page 18: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/18.jpg)
18
Consequences to Privacy• While some employees will only need access to PIM-data,
many will need full device management.• In these cases, all data must be subject to review and/or
archive by the company• Email, SMS/MMS, IM, music, etc.
• All activity (applications, browser, peripheral control, etc.) must be subject to audit and control at any time.
• How to handle all of this??
![Page 19: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/19.jpg)
19
Education!• Most people will agree to any ToS without
second thoughts.• Acceptance of the restrictions rely completely
on employees’ understanding them• Rewards are worth the
risks …
![Page 20: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/20.jpg)
20
Consequences• Despite shared liability, employee-provided cell phones for
business purposes are extremely popular. • Conveniences for employee• Savings for employer
• Trend will continue
![Page 21: Mobile Device Security MSIT 458 - Information Security December 4, 2010 Team Magic: Michael Gong Jake Kreider Chris Lugo Kwame Osafoh-Kantanka](https://reader036.vdocuments.mx/reader036/viewer/2022062417/551aa99a550346856e8b4a40/html5/thumbnails/21.jpg)
21
Conclusion• Employee-owned mobile phones provide risks,
challenges.• However, benefits are great to both company and
employees.• Our provided solution, leveraging Good Technology, is the
most efficient and feasible way to implement a corporate private mobile device policy.