Mobile Workforce: Secure Wireless Access to Government Applications and Information

2008 NYS Cyber Security ConferencePresented by

Sean T Murray, NYSTECJohn Mounteer, NYSTEC

2

    

Overview

• Overview of Wireless Data Network Technology• Overview of Mobile Devices• Organizational Risks Associated With Mobile

Computing• Data in Transit Encryption Options• Security of Data on the Mobile Device• User Identity and Access Management• Remote Administration of Mobile Devices• NYSTEC’s Top Ten Things Government Agencies

Should Consider When Deploying Wireless Access to Agency Data

3

    

Part One

Overview of Wireless Data Network Technology

4

    

Wireless Network Access

5

    

Wireless 101 (part 1)

• Wave characteristics– Wavelength - The distance traveled in one cycle in meters,

centimeters, etc.– Frequency - The number of cycles repeated during a unit of time

(usually 1 second) is the frequency, usually expressed as hertz (cycles per second).

• Wavelength and frequency are inversely proportional.• As frequency increases, potential data throughput increases, but signal

propagation decreases. Typically 2 Ghz and up are used for data apps.– Amplitude – Maximum displacement of the wave from zero– Phase - The phase of a wave is the amount by which the cycle has

progressed from a specified origin, usually expressed in degrees of a circle, and relative to that of some other wave. For example, two waves having crests 1/4 cycle apart are said to be 90° “out of phase.”

– Reflection – Refraction

6

    

Wireless 101 (part 2)

• Spectral efficiency – The amount of data (bits per second) carried on one hertz (cycle

per second) of bandwidth; varies with encoding (modulation) techniques.

• Licensed versus Unlicensed– Licensed frequencies generally have exclusive use and in general

allow for much higher transmit power than unlicensed frequencies.• For example. maximum transmit power allowed for AM radio is 50

thousand watts, for a WiFi access point is1watt.• Minimum receive power is also important, determined by a number of

factors such as encoding/decoding scheme and hardware, antennas. Can be as low as 1 pico-watt (trillionth of a watt)

– The new 4.9Ghz Public Safety band is an exception in that it is shared among Public Safety entities and has maximum transmit power closer to many unlicensed band.

7

    

Wireless Data: What’s Important?

• Range

• Throughput

• Cost

• Security

8

    

Wireless Broadband Data

• Broadband Wireless Data:– Any wireless communication with transmission rates greater

than 256 kbps

– No single technology will become dominant or ubiquitous; they all meet unique user requirements in a wirelessly connected world.

– The best wireless solutions (systems) may involve a combination of technologies to allow increased mobility (and ultimately seamless roaming)

9

    

Three Categories of Wireless Data - Range

• Wide Area (miles)– Cellular– GSM – AT&T and T-Mobile

• GPRS

• EDGE

• 3G (UMTS/HSDPA)

– CDMA – Verizon and Sprint• RTT 1x

• EVDO

• EVDO rev (x)

• Local Area (feet) – WiFi– 802.11a/b/g/n

• Personal Area – Bluetooth

10

    

Range & Throughput - Cellular

StandardMax

DownloadMbps

Max UploadMbps

RangeTypical Download

Mbps

CDMA RTT 1x 0.31 0.15 ~18 mi 0.125

CDMA EV-DO Rev. 0 2.5 0.15 ~18 mi 0.75

CDMA EV-DO Rev. A 3.1 1.8 ~18 mi

CDMA EV-DO Rev. B 4.9 1.8 ~18 mi

GSM GPRS Class 10 0.09 0.04 ~16 mi 0.014

GSM EDGE type 2 0.47 0.47 ~16 mi 0.034

GSM EDGE Evolution

1.89 0.94 ~16 mi

11

    

Range & Throughput - WiFi

StandardMax

DownloadMbps

Max UploadMbps

RangeTypical Download

Mbps

WiFi: 802.11a 54 54

WiFi: 802.11b 11 11~30

meters2

WiFi: 802.11g 54 54~30

meters10

WiFi: 802.11n 200 200~50

meters40

12

    

Range & Throughput - Bluetooth

StandardMax Downlink

MbpsMax Uplink

KbpsRange

Bluetooth 1.1 1 125 Class 1 - 100mW – 100 metersClass 2 – 2.5mW – 10 meters

Class 3 – 1mW – 1 meterBluetooth 2.0+EDR 3 375

13

    

Cost of Wireless Data

• Wide Area (miles) – Cellular– Phone or cellular modem purchase cost or free – Monthly Recurring Charge – $20-$50 or per byte

• Local Area (feet) – WiFi– Built into phone, PDA or laptop– Usage free, per use, or monthly subscription– T-Mobile DayPass – 9.99 for 24 hrs– 19.99 to 39.99 monthly depending on plan

• Personal Area – Bluetooth– Device purchase price

14

    

Over the Air Security of Wireless Data

• Wide Area (miles) – Cellular– Security built into cellular wireless over the air portion – encryption, spread

spectrum/frequency hopping (always on, no end user choice)– Very expensive to impersonate base station to create Man in the Middle

Attack (MITM)

• Local Area (feet) – WiFi– Security built into WiFi over the air portion - encryption (sometimes)

• WEP Wireless Equivalency Protocol. Static key, sniffed• WPA, WPA2 Wireless Protected Access, stronger encryption, dynamic keys

– Man in the Middle (MITM) attack more likely with WiFi because hardware is cheap, easy to impersonate an access point

• Personal Area – Bluetooth– PIN and Encryption – Frequency Hopping Spread Spectrum (FSHH) changes over 79 channels in

a “pseudo-random” pattern 1600 times per second. Devices must be synchronized with hop pattern

15

    

WiFi - Man in the Middle Attack

16

    

Wireless Data – on the Horizon

• Wide Area (miles) – WiMax– Sprint and Clearwire– Compete with cellular data services, voice?

• Personal Area – – Near Field Radio (NFR)

• Similar to RFID built into cell phones for payment

– Ultrawideband (UWB) features part of Bluetooth 3.0?• FCC authorizes the unlicensed use of UWB in 3.1–10.6 GHz.

17

    

Broadband Wireless Technologies

Technology & Standard

Current Operators

Upgrade Path

Frequency Range &

Duplexing

Channel Bandwidth

Peak Sector Data

Rate

Average Data Rate

UMTS

TD-CDMA

Release 5.0+ 3GPP

T-Mobile

Woosh

Orange

NYC DoITT

Rel. 6+, 7

HSDPA HSUPA MIMO

700, 800 1900-1920 2000, 2100 2500-2700 3400-3600

TDD

5, 10, 20 MHz Down: 8 Mbps (31.8 Mbps, R7)

Up: 1.8 Mbps

Down: 1.2 Mbps (8 Mbps DL, R7)

Up: 500 Kbps

UMTS

WCDMA

Release 5.0 3GPP

AT&T

NTT DoCoMo

Vodaphone

HSDPA HSUPA MIMO

824-894

830-885

1710-1880

1850-1990

1920-2170, FDD

2 X 5 MHz Down: 3.6 (14) Mbps

Up: 384 Kbps

800 Kbps (Downlink)

CDMA2000

1xEV-DO Rev A 3GPP2

Verizon

Sprint Nextel

Alltel

Rev B. Bundling Multiple Chans. (1.25 & 5 MHz)

450-500

824-894

1850-1990

700, FDD

2 X 1.25 MHz Down: 3.1 (4.9) Mbps

Up: 1.8 Mbps

800 Kbps (Downlink)

802.11a/b

IEEE

(WiFi)

42+ Nets Municipal or Public Safety

Meshing Standard (802.11s)

2400

4900-licensed

1, 5, 10, 20 MHz

Down/Up: 10 Mbps

1.2 Mbps (Downlink—Mobile)

802.16-2001

802.16d (2004)

802.16e (2005)

IEEE (WiMAX)

Clearwire

Sprint Nextel (07)

MIMO3GPP Internetworking

10-66 GHz (a)

2-11 GHz (d)

<3.5 GHz (e)

TDD

1.25, 5, 7, 8.25, 10, 20 MHz

Down: 75 (d) 46 (e) Mbps

Up: 7 Mbps

TBD

Sprint: 2-4 Mbps Down

18

    

18

Radio Waves and Safety What Are the Risks?

“It was found that users who spend more than an hour a day talking on a mobile phone have a close to one-third higher risk of developing a rare form of brain tumor. Most frequently, the cancers were found on the side of the head that the user held the phone up to.” International Journal of Oncology, February 2003;22(2):399-407

"There is currently insufficient scientific basis for concluding either that wireless communication technologies are safe or that they pose a risk to millions of users.... FCC radio frequency radiation guidelines are based on protection from acute injury from thermal effects of RFR exposure and may not be protective against any non-thermal effects of chronic exposures."U.S. Food and Drug Administration, February 2000

NYSTEC has been studying this issue with the US Air Force at Rome Labs

19

    

19

Radio Waves and Safety What Are the Risks?

Subject before testing

20

    

NYSTEC TOP SECRET 20

Radio Waves and Safety What Are the Risks?

Subject aftertesting

Effect was not permanent

21

    

Part Two

Overview of Mobile Devices

22

    

PDA

• The traditional stand-alone PDA is being supplanted by new smartphone-style PDAs:– Stand-alone PDA sales fell

43.5% from 2006 to 2007 (Wikipedia).

– Approximately 4 million PDAs are sold per year.

• WiFi, Bluetooth, Infrared radio options (no Wide Area – Cellular voice or data option)

23

    

Smartphone

• Smartphones combine a full-featured mobile phone with personal computer-like functionality (and processing power):– Users can make phone

calls, run applications, and access, store, and manipulate data.

– Data storage devices (i.e. memory cards) that work with smartphones are approaching 8 GB capacity.

• Cellular voice and data, WiFi, Bluetooth, GPS radios

24

    

Smartphones and PDAs

• Current smartphones and Personal Digital Assistants (PDAs) have as much processing power and memory as laptops had a few years ago!

• Year 1992 - IBM Thinkpad 700C– 25Mhz CPU– 4Mb RAM– 120MB HD

• Year 2007 - Samsung Blackjack 2– 260Mhz CPU– 128MB RAM– 256 MB ROM

25

    

Smartphone: What is it?

• There is no agreement in the industry about what a smartphone actually is and definitions have changed over time (silicon.com).

• Most smartphones support full featured e-mail capabilities with the functionality of a complete personal organizer.

• Other functionality might include:– an additional interface such as a miniature QWERTY keyboard, a

touch screen or a D-pad, – a built-in camera, – contact management, – built-in GPS navigation hardware and software, – the ability to read business documents in a variety of formats such

as PDF and Microsoft Office, – media software for playing music, browsing photos and viewing

video clips, – internet browsers.

26

    

Smartphones and PDAs

• Mobile devices may improve productivity and efficiency—but they also introduce new risks:– Confidential corporate and personal data can be lost when

mobile devices are misplaced or stolen– Other risks include malware infections, spam, and hacking

of mobile devices

27

    

Operating Systems

• The most common Operating Systems (OS’s) used on smartphones are:– Symbian OS from Symbian Ltd. (65% Market Share Sales

Q4 2007) (Nokia)– Windows Mobile from Microsoft (12% Market Share Sales

Q4 2007) (Samsung, Motorola, Carrier branded – Verizon)– RIM (Research in Motion) BlackBerry operating system

(11% Market Share Sales Q4 2007) (Blackberry)– iPhone OS from Apple Inc. (7% Market Share Sales Q4

2007) (Apple iPhone)– Linux operating system (5% Market Share Sales Q4 2007)

(Motorola)– Palm OS developed by PalmSource (now a subsidiary of

ACCESS) (Treo). Source: Canalys

28

    

Operating Systems Security

• Typical– Device Lock– SIM card Lock (GSM)

• Symbian OS– “Platform Security” covers

• OS and drivers

• User interface

• Applications (must be “signed”)

– Third party Apps enhance security (e.g. DataViz RoadSync to allow MS Exchange server central management

Source: Canalys

29

    

Operating Systems Security (cont.)

• Windows Mobile 6– Can be managed with Exchange server

• Device timeout

• Password length and complexity

• Allow or disallow attachments, and size limits

• Remote wipe

– Built –in storage card encryption– Supports security certificates (SSL)

Source: Canalys

30

    

Operating Systems Security (cont.)

• Blackberry OS– Started as enterprise solution– End to End encryption standard when using Blackberry

Enterprise Server– Lotus Notes encryption support– FIPS 140-2 validation for embedded encryption technology.– Meet the Department of Defense requirements for S/MIME

(Secure/Multipurpose Internet Mail Extensions) and PKI (Public Key Infrastructure).

– Remote management of security features, passwords, data wipe

Source: Canalys

31

    

Part Three

Organizational Risks Associated With Mobile Computing

32

    

Mobile Devices are Easy Targets!

• PDAs and Smartphones are small and easy to lose:– 24% of US business professionals experienced loss or theft of at

least one PDA (Pepperdine)

• In recent years Smartphones have gone from embedded CPU-specific microcode to full featured multi-services Operating Systems

• Users are not as wary as they are using PCs and laptops• There are many network-borne infections and exploits:

– There have been hundreds of mobile viruses and worms since June 2004. Infection vectors include Bluetooth, MMS (SMS), OS API’s, OS vulnerabilities, email

– Mobile users frequently install unknown code

33

    

Mobile Devices Present Unique Challenges

• Windows laptop security programs may not run “as-is” on stripped down Windows Mobile 5.0 for Pocket PC and Windows Mobile 6 Classic

• Wireless creates new data network attack opportunities…– Many PDAs and Smartphones have 3+ wireless services (cellular,

Wi-Fi, Bluetooth)• The default security mechanisms in mobile devices are turned

off (for ease of use)• Many users use these devices without the knowledge of IT

Departments– Forward email and/or store calendar information (synch with PC

using products like BitPIM)– Use as an external storage device

• http://www.flexispy.com (“Download FlexiSPY spyphone software directly onto a mobile phone and receive copies of SMS, Call Logs, Emails, Locations and listen to conversations within minutes of purchase” )

34

    

Organizational Risk

• Theft of organizational data off the device. This can lead to non-compliance issues-- HIPAA, State Disclosure Laws (for example, NYS Information and Security Breach Notification Act, CSCIC Policies, Federal Policies )

• Theft of data when the device is transmitting/ receiving data

• Loss of organizational data off the device. Think of the cost (i.e., amount of time it would take to replace the data) if the data is lost or corrupted. This data includes phone book and calendar information.

35

    

Organizational Risk

• The device is extending the organizational network, when the device interacts with the corporate infrastructure: – End point on the network (wireless LAN, VPN)– Synching with a PC (cabled or Bluetooth)– Accessing corporate applications– Accessing corporate email servers – Acting as a VPN end point

This can pose several risks to the organizational infrastructure:– Malware– Network Compromise– Password compromise

• SMS phishing attacks seen in August 2004• Email, VPN, Internet facing applications

36

    

Part Four

Encryption Options

37

    

Securing Data in Transit

• Just like other data networks, mobile data needs to be secured during transmission

• Even if the device’s data is encrypted “over-the-air” (OTR), it may not be encrypted end-to-end

• Flaws have been found in GSM and CDMA authentication and encryption algorithms and carriers may not implement all controls

• As with wired networks, there are various alternatives for securing mobile data in transit:– Using Secure Socket Layer (SSL) protocol over a secure Web

connection– Using Virtual Private Network (VPN) solutions– Using end-to-end secure mail protocols like S/MIME, PGP– Using SMS/MMS filters to block unsolicited spam, phishing

38

    

SSL VPNs

• SSL VPNs are a good option for mobile devices that have a browser to support them.

• SSL VPNs are fairly open solutions, requiring less configuration and management on the client side, but more configuration on the server side.

• SSL VPNs support multiple modes of operation:– Basic Browser access– Port forwarding– Client-based tunneling

• The mode of operation has an impact on the client dependencies and applications (must ensure that the chosen mode supports your target applications)

39

    

Mobile VPNs

• Mobile VPNs extend data protection by encrypting traffic between the mobile device and a VPN gateway at the edge of the LAN.

• Mobile VPNs are more proprietary solutions that require installation and management on the mobile device.

• Smartphones and vehicle-mounted laptops roam among WLANs and/or cellular network “dead spots” that often cause breaks in IPSEC tunnel connectivity

• Smartphones may also “go to sleep” that would interrupt IPSEC and SSL based VPN sessions

• To stay connected, mobile VPNs rely on client software and specialized VPN gateways:– Create a “persistent session” that will spoof client-server

connectivity in order to hold a session open during loss of signal, etc.

40

    

Built-in Mobile VPNs

• Many mobile Operating Systems include VPN clients:– Palm OS 6: PPTP supplied with Wi-Fi card– Windows Mobile 5.0: PPTP, L2TP over IPsec– Blackberry: proprietary OTA encryption

• Concerns:– Traffic (processing) overhead– Compatibility with existing agency VPN– Inter-network roaming

41

    

Part Five

Security of Data on the Mobile Device

42

    

Protect Data at Rest

• Encryption is the most effective (only?) way to protect data stored on the mobile device

• Many laptop encryption vendors offer solutions for mobile Operating Systems.

• Encryption should extend to the files on the storage media used in the mobile device

• Encryption solutions should be flexible and include support for standard encryption algorithms (for example AES) with 128 bit, 192 bit, and 256 bit encryption keys.

• There is a relationship between the strength of the encryption key and power consumption…– The more powerful the key, the more it reduces battery life

43

    

Recommendations for Mobile Data Device Data Encryption

• Will need to ensure that the data encryption method chosen meets security policies, but does not over tax CPU, memory and battery resources

• Want to select the minimum encryption necessary to comply with the security policy and the sensitivity of the data (See NIST SP 800-57)

• Use solutions that encrypt “in place” rather than containers that require the user to save files in folders (which creates an opportunity for abuse and user error)

• Certified products that conform to FIPS 140-2 requirements ensure that data protection meets robust federal requirements

• Access Control and key management are essential for encryption to be effective

44

    

Part Six

User Identity and Access Management

45

    

Access Control: Is It Used?

• Access Control issues– Access to data on device– Access to applications and data on back-end systems– Access to carrier network (device access). This cannot be

relied upon to authenticate user.– Allow/prohibit features or applications on the device

• Many mobile device Operating Systems include access control mechanisms…– But they need to be enabled (and often are not)– May be inconvenient for the user– May not be enforced by the organization

• Access control must be used in conjunction with encryption to protect data on the device.

46

    

Common Access Controls

• Some common mobile device access controls:– Power-on PIN– Auto-lock/Interactivity Timeout– Keypad lock– SIM card lock

47

    

Recommendations: Access Controls

• Use stronger, more convenient authentication technologies (like biometrics, smart cards, tokens). BlackBerry and Windows CE have smartcard readers available.

• Establish policies and enforce them using 3rd party Central Management and Enforcement tools

• Define and provide a process for mobile password reset that is convenient and safe for road warriors

48

    

Part Seven

Remote Administration of Mobile Devices

49

    

Centralized Management

• Why Centralized Management?– Reduces complexity and cost (of managing multiple devices)– Ensures that all mobile devices contain the same versions of

the same software– Allows for centralized software distribution and control (e.g.

can remove unauthorized software applications)

50

    

Essential Functions of a Mobile Security Central Management System

• The Central Management System should provide (at a minimum):– Ability to centralize provisioning of settings and policies– Ability to install the mobile security applications on the

mobile devices– Ability to push software patch updates, security and pattern

file updates to the mobile devices– Ability to lock mobile security settings on the devices (to

prevent users from changing them)

51

    

Part Eight

NYSTEC’s Top Ten Things Government Agencies Should Consider When

Deploying Wireless Access to Agency Data

52

    

Top Ten List

1. Develop and enforce mobile device policies. Stop Ad Hoc use of mobile devices to store data and train staff on risk of these devices

2. Consider adding centralized management tools (Can help enable and manage all other items on this list)

3. Develop and maintain an inventory of mobile devices used by your employees (specific make, model, OS)

4. If the sensitivity of the data require it, encrypt data stored on mobile devices, including the removable media in the devices

5. Enable and enforce mobile device access control mechanisms

53

    

Top Ten List (Cont.)

6. Use VPNs to ensure security of data in transit

7. If you are using a service for email, messaging or other service, know where this data is stored and ensure correct SLA’s are in place to secure those locations

8. Start with conventional network defenses. Know what devices are connecting to your WLAN, VPN, etc.

9. Add device defenses like mobile firewalls, limiting what applications can run on the device, and/or using specific mobile antivirus software on mobile devices

10. If the data is important, ensure that it is being backed-up

54

    

Examples of Mobile Device SecurityVendors

• This is a list to show the diversity of solutions being offered today. No recommendation of any of these solutions is implied:

– BlackBerry- has device management, OTA encryption, device encryption, rules on what programs can be loaded and executed, remote wipe

– Sprint,-- offers device management (Nokia Intellisync) and encryption, firewall, mobile VPN and anti-virus

– Kapersky– remote data wipe (using SMS, anti-theft component, anti-malware and a built-in firewall)

– Utimaco SafeGuard PDA Enterprise– Management, encryption at rest, authentication

– AirScanner (www.airscanner.com) --firewall, encryption, anti-malware– Aiko http://www.aikosolutions.com/ --device encryption– F-Secure Mobile Security www.f-secure.com --firewall, anti-malware– PointSec Mobile (www.checkpoint.com) -- Encryption– Norton SmartPhone Security (www.symantec.com) Antivirus, Firewall , SMS

Antispam

55

    

Wrap-Up

• Questions??