Bring Your Own Device(BYOD) Security

AITP Cloud Conference

October 29, 2015

Presenter: Thomas (Tom) Gresham, IT Security Supervisor, Unified Port of San Diego

BYOD SECURITY

Presentation Contents

• Overview of BYOD

• Associated Risks

• Physical Security & Mitigation

• Malicious Code & Mitigation

• Insider Threat & Mitigation

• Ancillary Concerns

• Q & A

BYOD SECURITY

BYOD Overview

History of mobile device use in the workplace

1990s - In the 1990s, businesses and government agencies first used mobile devices such as pagers and flip phones to improve voice communication and basic text messaging while employees were away from the desk.

Response time for information requests is near real-time through email and text services as employees travel or work from home.

Image courtesy of Motorola

BYOD SECURITY

BYOD Overview

According to a 2014 study conducted by the Pew Research Center, “58% of American adults now own a smartphone of some kind, up from 35% in the spring of 2011.”

Image Courtesy of Pew Research Center

BYOD SECURITY

BYOD Overview

Mobile Device Benefits

•Communication – Mobile devices, particularly smartphones, allow for the real-time communication of data outside of the traditional office setting. Response time for information requests is near real-time through email and text services as employees travel or work from home.

•Remote Management – Smartphone applications have been developed to reach back to organization databases providing interfaces similar to those traditionally found on desktop computers. These apps allow users to not only generate reports within agency databases but also manipulate systems controlling functions such as financial transactions, manage IT systems and can even tie into physical access controls such as gates, door and HVAC systems.

BYOD SECURITY

BYOD Overview

Mobile Device Costs

1.Equipment Costs – According to the Wall Street Journal, the average cost of an iPhone as of February 2015 was $687.

2.Ongoing Costs – Monthly plans often reach upwards of $100/month depending on data plan.

3.In-House Assets – A traditional mobile device management (MDM) infrastructure, licensing and training may be needed.

BYOD SECURITY

BYOD Overview

Blackberry Enterprise Infrastructure

Managing an in-house infrastructure, such as a Blackberry Enterprise Server (BES) farm, requires hardware, licensing and staff training.

Image Courtesy of Research In Motion (RIM) Inc.

BYOD SECURITY

BYOD Overview

The adoption of BYOD

As a cost saving measure, companies began to leverage employee owned smartphones to access their corporate network. In 2009, Intel began officially allowing non-IT issued devices to access secure company email, calendar and documents in 2009. This practice is known as Bring Your Own Device (BYOD).

BYOD Benefits:

1. Organization savings on equipment and ongoing voice/data plans

2. Empowers employees with choice in the hardware platform

3. Employees do not need to carry two mobile devices at work

BYOD SECURITY

Associated Risks

Many organizations are adopting the Bring Your Own Device (BYOD) approach as a cost-savings measure, however, the risks introduced by such programs are serious and can be costly if programs are not implemented correctly. Mobile devices increase an organization’s attack surface. While many security risks exist, three areas stand out as critical to any mobile device program including BYOD.

• Physical Security

• Malicious Code

• Insider Threat

BYOD SECURITY

Risk – Physical Security

Loss & Theft

By nature, mobile devices are of a smaller form factor than laptops, thus they are more prone to loss or theft.

According to a 2014 study by Consumer Reports, “More than 3.1 million smartphones were stolen just in America during 2013.” The report also revealed that 34% of individuals did not even have a simple 4-digit passcode protecting their information.

Image courtesy of Consumer Reports

BYOD SECURITY

Risk – Physical Security

Unauthorized Disclosure – While the loss of a mobile device incurs a financial loss, sensitive information contained within may be compromised.

The employee’s organization is now exposed to potential liability as sensitive information may be disclosed in an unauthorized manner.

The National Institute of Standards and Technology (NIST) highlights the risk of the physical environment within special publication 800-124. “It is assumed that mobile devices will be acquired by malicious parties who will attempt to recover sensitive data either directly from the devices themselves or indirectly by using the devices to access the organization’s remote resources.”

BYOD SECURITY

Risk Mitigation – Physical Security

• Security Awareness Training – Proper training on the handling of mobile devices is essential for all personnel who intend to use either organizational assets or personal assets in a BYOD setting.

• Technical Controls can reduce risk through mandatory settings via an MDM architecture.

• PIN Codes

• Device Encryption (physical, file or virtual)

• Remote Data Wiping

• Geofencing

• Data & Application Backups

BYOD SECURITY

Risk – Mobile Device Malware

Malware, originally thought to only target desktop computers has evolved rapidly in response to the growing popularity of mobile technology. According to a study

• Threat Actors: Identifying the motivation for creating malware for smart devices is paramount to have a better understanding of its behavior and can be used to develop targeted detection strategies. Such goals include: identify theft, fraud, spamming, espionage, data theft and sabotage.

• Attack Vector: Malware creators can use a variety of techniques to distribute malicious applications and infect devices, from self-propagation mechanisms based on vulnerabilities and misconfigurations, to simply tricking the user into installing it by means of social engineering techniques.

• Privilege Elevation: Once the malicious code is installed on the device, it often needs to acquire enough privileges to carry out its goals. This is automatic in many cases, as the user might already have granted them to the app, whereas in other cases technical vulnerabilities and/or misconfigurations are exploited.

Image courtesy of 3SC World

BYOD SECURITY

Risk – Mobile Device Malware

The anti-virus company, Sophos, indicated in 2014, an estimated 2000 Android malware samples were discovered daily.

Image courtesy of Sophos Inc.

BYOD SECURITY

Risk – Mobile Device Malware

G Data Software AG released a study that indicates a large spike in malware samples targeting Android devices. Between 2012 and 2013, the number of distinct malware samples nearly tripled.

Image courtesy of Kaspersky Lab

According to Kaspersky Lab, the most frequently detected threats on Android devices can be broken down into three main groups: SMS Trojans, adware, and exploits to gain root access.

Image courtesy of G Data Software AG

BYOD SECURITY

Risk – Mobile Device Malware

Mobile Device Malware – Often, these attacks are targeting stored credentials and using them to facilitate access to more sensitive data as users are increasingly embedding authentication credentials into their devices such as banking site login and password information.• WireLurker – In 2014, Palto Alto Networks discovered the

malware. WireLurker monitors any iOS device connected via USB with an infected OS X computer. WireLurker is capable of stealing a variety of information from the mobile devices it infects and regularly requests updates from the attackers command and control server.

• Masque Attack – In July 2014, FireEye mobile security researchers have discovered that an iOS app installed using enterprise/ad-hoc provisioning could replace another genuine app installed through the App Store. The attacker can steal user's banking credentials by replacing an authentic banking app with malware that has an identical name. The malware can even access the original app's local data, which wasn't removed when the original app was replaced.

Image courtesy of TechFerb

Image courtesy of Apple France

BYOD SECURITY

Risk – Mobile Device Malware

Recent News – According to Macworld, in September of 2015, Apple pulled several iOS apps from the App Store after security researchers discovered malware in some of the store’s top apps.

It’s unclear just how many apps were infected with malicious code. Palo Alto Networks, the security firm that discovered the breach, estimates 39 apps were affected. Most of the apps are hugely popular in China, like messaging app WeChat, Uber rival Didi Kuaidi, train ticket app Railway 12306, business card scanner CamCard, and stock trading service Tonghuashun. A Chinese security company is pinning the number of infected apps at 300+.

“To protect our customers, we’ve removed the apps from the App Store that we know have been created with this counterfeit software,” Apple spokeswoman Christine Monaghan told the New York Times.

Consequences of Malware – An infected app might prompt a user to re-enter a user ID and password in a phishing attempt. It might ask for iCloud details. The malware is capable of accessing a user’s clipboard, which has dire ramifications for people who use password managers.

BYOD SECURITY

Risk Mitigation – Mobile Device Malware

Security Policy & Training – Training users on security awareness can assist in the prevention of malware infections. Policy can reinforce user behavior through punitive actions.

Technical Controls

• Sandboxing can also be used to isolate the damage of malware installed on the user-controlled portion of a BYOD device.

• Network Access Control (NAC) allows a BYOD device to be assessed prior to connection.

• Data Loss Prevention (DLP) can be implemented through Virtual Private Network (VPN) technology

• Further protection may be added through MDM such as the hardening of a device with security configuration settings that leverage application black lists or disable the capability for users to install software all together.

• A whitelist is a list of discrete entities, such as hosts, email addresses, network port numbers, runtime processes, or applications that are authorized to be present or active on a system according to a well-defined baseline.

• A blacklist is a list of discrete entities that have been previously determined to be associated with malicious activity.

BYOD SECURITY

Risk – Insider Threat

Mobile devices can also facilitate threats from employees and insiders.

Data Exfiltration

•Removable Memory – Exfiltration of sensitive data can be accomplished through smartphone misuse by copying large amounts of sensitive information to the device’s secure digital (SD) memory card, or by using the device to transmit data to external accounts.

•Tethering – Synchronizing mobile devices to desktops can also be used to exfiltrate data if other countermeasures are absent such as the disabling of USB ports on organizational desktop computers.

These activities can be used surreptitiously by circumventing monitoring technologies such as data loss prevention (DLP) or classification marking detection as these controls are most often deployed only at network perimeters.

Image courtesy of GovInfo Security

BYOD SECURITY

Risk – Insider Threat

Jailbreaking – The intentional modification of the iOS operating system, usually via specialized software on a connected PC/Mac, letting an iPhone or iPad run “uncontrolled" apps and features.

Risks associated with Jailbreaking

•Jailbreaking disables the "sandboxing" feature of iOS, a key part of the operating system's security architecture. Apps now have access to perform elevated functions on the iOS and other apps.

•Jailbreaking allows the installation of unapproved apps, i.e. those that have not been reviewed for publishing on the App Store

•According to Apple, jailbreaking as a violation of the warranty agreement.

Image courtesy of imore.com

BYOD SECURITY

Risk – Insider Threat

Data Interception / Eavesdropping

•A determined and capable malicious insider can leverage off-the-shelf applications to compromise a mobile device to silently monitor conversations, intercept text messages, email, physically track a device and even take photos via the camera while remaining undetected.

•With a BYOD program, this particular threat poses a greater risk as the personal computing space of a mobile device may be less protected. An insider can easily install such as application on a phone if the phone was physically accessible.

Spy on Calls Read SMS Messages Access Address Book

Listen to Live Calls Read MMS Messages Access Calendar

Record Calls Send Fake SMS Messages Access Notes

Call Logs Record Facetime Video Read Emails

Listen to Phone Surroundings Spy on App Passwords View and Track GPS

Record Phone Surroundings Take Pictures Hide from App List

Spy Applications

BYOD SECURITY

Risk Mitigation – Insider Threat

1. MDM – MDM mitigates against insider threats by performing configurations via device policies. Such hardware policies can disable high risk functions such as downloading of restricted applications, removing required passcode screens, wiping jailbroken phones, etc.

2. USB Lockdown – Disabling or limiting USB connections to desktop computers can prevent the exfiltration of data through synchronizing activities.

3. Continuous Auditing – Automatic reporting through MDM or Security Information and Event Management (SIEM) systems can provide oversight on otherwise surreptitious activities

WARNING – Unless an MDM can manage the personal operating space of a BYOD device, interception or other harmful software may be installed.

BYOD SECURITY

Ancillary ConcernsLegal Liability – Employers will assume legal, security, reputational, and other business-related risks when their employees use a device for both personal and work-related purposes.

If the employer becomes involved in litigation or an investigation, certain employees may be required to turn over a personal device if it contains relevant data. If this happens, to what extent are the personal contents of the device available for others to see?

Employers must consider business interests when creating a BYOD policy. These can overlap with legal obligations, or they may be completely separate.

Image courtesy of the State of California

Privacy Concerns – What if an employee uses a mobile health app to monitor a medical condition? How private are personal email accounts, messages, photos, calendars, etc.?

Employers must clearly articulate expectations of privacy in any BYOD policy and agreement that is understood and accepted by the participating employee.

BYOD SECURITY

Final Recommendations

1. Build a well-defined BYOD Policy

• Define the governing regulations for the protection of data, e.g. HIPPA, CJI, PCI DSS.

• What security measures are needed (passcode protection, jailbroken/rooted devices, anti-malware apps, encryption, device restrictions, iCloud backup). What apps are forbidden? IP scanning, data sharing, spy apps?

• Is there an Acceptable Usage Policy for employee devices with corporate data? What data is collected from employees’ devices? What personal data is never collected?

2. Choose an MDM platform wisely

• Monitor the private-side “health” of BYOD devices.

• Implement app whitelisting on the organization-side and blacklist on the private-side.

• Ensure sandboxing of organization data limits interaction with private data.

3. Implement insider threat countermeasures

• Lock-down USB synchronization.

• Review audit logs, reports and implement a multi-tier app approval workflow.

Questions?

Thank You