1. 1
Mobile Applications – a blessing or a curse?
Tom King
A presentation to: Mobile and Smart Device Security
Conference 2011
30th November 2011
www.3i.com
V1.0

2. 2
The Dodo

3. 3
The Ostrich

4. 4
Agenda
Mobilising enterprise applications and data – what 3i has done
Top mobile application risks
Creating secure mobile application markets for corporate users

5. Mobilising enterprise applications and data – 3i’s approach
5
2000
Deliver applications and data to untrusted devices (Citrix)
Deliver email and calendar to mobile devices
(Blackberry)
2005
Deliver applications and data to corporate laptops (SSL
VPN)
2010
Deliver email, calendar, browser-based applications to
iPhone, iPad, Android (Good Technology)

6. 6
Mobile application risks – mobile devices are (mostly) for
consumers
“The user's going to pick dancing pigs over
security every time”
Bruce Schneier – “Secrets and Lies”
Image: sfllaw

7. Mobile application risks – take an ipad..
• Risk = threat x vulnerability x asset value
• Applications and data on mobile devices – can
present significant risk
• Threat = high (thieves love iPads)
• Vulnerability = high (iPads are not secured by
default)
• Asset value (data) = might be high (people prone
to store sensitive data on their beloved devices)
• Doing stuff with iPad – may be high risk!
7
Image: Matt Buchanan

8. Mobile application risks – don’t sweat on the small(er) risks
• Malware
– “malware will not be a major risk on platforms such as
Apple’s iPhone and iPad and RIM’s Blackberry and
Playbook” (John Pescatore, Gartner, November 2011)
– Pescatore didn’t mention Android!
• Wifi attacks
– Ensure devices use the mature standard – WPA2
Enterprise
• Targetted trojans
– Relatively rare at this point.. One to watch?
• Bluetooth attacks
– Some hype, little evidence of severe attacks
– “Bluetooth billboard”
• Shoulder-surfing & telescopic cameras
– It’s nothing new – it’s not just smartphones which are
vulnerable.
8
Image: Bruger:Glenn

9. Mobile application risks – do manage the big risks
• Lost/ stolen device
– What data are your users storing on mobile devices?
– How is that data protected?
– Remember the risk equation!
• Recycled device containing proprietary data
– Corporates (generally) geared up to secure disposal of
PC’s and servers
– Mobile devices often owned by users, not IT!
• Legitimate applications leaking data
– No appstore is 100% safe
– Apple/ Google/ RIM can’t vet all apps exhaustively
9
Image: Tom Burke

10. Legitimate applications leaking data? (this one doesn’t)
• The top free game on many platforms.. Angry Birds
• It’s not malicious in any way – other things are far
more invasive!
• When you install, you accept it can:
• “Modify/ delete USB storage content”
– “allows and application to write to USB storage”
• “Read phone status and ID”
– “Applications written with this feature can determine the
phone number and serial number of this phone, whether a
call is active, the number that call is connected to etc.”
• “Full Internet access”
– “Allows an application to create network sockets”. (In
English lets the app connect to anywhere on the Internet
that the app might choose)”
• “Your location”
– “..determine an approximate phone location.. Malicious
applications can use this to determine approximately where
you are”
10
• Other apps may request other things!
• Your messages
– “Allows application to receive and process SMS messages.
Malicious applications may monitor your messages or
delete them without showing them to you.”
• Your personal data
– “Allows an application to read all of the contact data stored
on your device. Malicious applications can use this to send
your data to other people.”
• Hardware controls – take pictures/ videos
• The list goes on (and on)
• So, a “legitimate” “Dancing Pigs” app could..
– Tell the bad guys my phone number, where I am, who I’m
phoning, steal my SMS messages, read data from my SD
card, steal my contacts then wipe them etc. etc.

11. Secure mobile applications for corporate users
• Some considerations
– Needs to work offline or online only?
– Sensitivity of data?
– Working assumption – devices will be lost – what does
that mean?
– Ease of use?
• Online only
– Browser-based application
– Keep data and processing on the server
– Technical controls can help (SSL, strong authentication
etc.)
• Offline and online
– Build your own app
– Distribution and support?
– Application needs to manage its own security
– Access to the application?
– Data at rest?
– Data in transit?
11

12. 12
The Eagle
Image: Chuck Abbe

13. 13
Thank you
For further information visit our website www.3i.com