1

Mobile Applications – a blessing or a curse?

Tom KingA presentation to: Mobile and Smart Device Security Conference 201130th November 2011

www.3i.comV1.0

2

The Dodo

3

The Ostrich

4

Agenda

Mobilising enterprise applications and data – what 3i has done

Top mobile application risks

Creating secure mobile application markets for corporate users

5

Mobilising enterprise applications and data – 3i’s approach

2000

Deliver applications and data to untrusted devices (Citrix)

Deliver email and calendar to mobile devices (Blackberry)

2005 Deliver applications and data to corporate laptops (SSL

VPN)

2010

Deliver email, calendar, browser-based applications to iPhone, iPad, Android (Good Technology)

6

Mobile application risks – mobile devices are (mostly) for consumers

“The user's going to pick dancing pigs over security every time”

Bruce Schneier – “Secrets and Lies”

Image: sfllaw

7

Mobile application risks – take an ipad..

• Risk = threat x vulnerability x asset value

• Applications and data on mobile devices – can present significant risk

• Threat = high (thieves love iPads)

• Vulnerability = high (iPads are not secured by default)

• Asset value (data) = might be high (people prone to store sensitive data on their beloved devices)

• Doing stuff with iPad – may be high risk!

Image: Matt Buchanan

8

Mobile application risks – don’t sweat on the small(er) risks

• Malware– “malware will not be a major risk on platforms such as

Apple’s iPhone and iPad and RIM’s Blackberry and Playbook” (John Pescatore, Gartner, November 2011)

– Pescatore didn’t mention Android!

• Wifi attacks– Ensure devices use the mature standard – WPA2

Enterprise

• Targetted trojans– Relatively rare at this point.. One to watch?

• Bluetooth attacks– Some hype, little evidence of severe attacks

– “Bluetooth billboard”

• Shoulder-surfing & telescopic cameras– It’s nothing new – it’s not just smartphones which are

vulnerable.

Image: Bruger:Glenn

9

Mobile application risks – do manage the big risks

• Lost/ stolen device– What data are your users storing on mobile devices?

– How is that data protected?

– Remember the risk equation!

• Recycled device containing proprietary data– Corporates (generally) geared up to secure disposal of

PC’s and servers

– Mobile devices often owned by users, not IT!

• Legitimate applications leaking data– No appstore is 100% safe

– Apple/ Google/ RIM can’t vet all apps exhaustively

Image: Tom Burke

10

Legitimate applications leaking data? (this one doesn’t)

• The top free game on many platforms.. Angry Birds

• It’s not malicious in any way – other things are far more invasive!

• When you install, you accept it can:

• “Modify/ delete USB storage content”– “allows and application to write to USB storage”

• “Read phone status and ID”– “Applications written with this feature can determine the

phone number and serial number of this phone, whether a call is active, the number that call is connected to etc.”

• “Full Internet access”– “Allows an application to create network sockets”. (In

English lets the app connect to anywhere on the Internet that the app might choose)”

• “Your location”– “..determine an approximate phone location.. Malicious

applications can use this to determine approximately where you are”

• Other apps may request other things!

• Your messages– “Allows application to receive and process SMS messages.

Malicious applications may monitor your messages or delete them without showing them to you.”

• Your personal data– “Allows an application to read all of the contact data stored

on your device. Malicious applications can use this to send your data to other people.”

• Hardware controls – take pictures/ videos

• The list goes on (and on)

• So, a “legitimate” “Dancing Pigs” app could..– Tell the bad guys my phone number, where I am, who I’m

phoning, steal my SMS messages, read data from my SD card, steal my contacts then wipe them etc. etc.

11

Secure mobile applications for corporate users

• Some considerations– Needs to work offline or online only?

– Sensitivity of data?

– Working assumption – devices will be lost – what does that mean?

– Ease of use?

• Online only– Browser-based application

– Keep data and processing on the server

– Technical controls can help (SSL, strong authentication etc.)

• Offline and online– Build your own app

– Distribution and support?

– Application needs to manage its own security

– Access to the application?

– Data at rest?

– Data in transit?

12

The Eagle

Image: Chuck Abbe

13

Thank you

For further information visit our website www.3i.com