RSA Conference 2011 Presentation: BYOC: Securing Untrusted, Employee-Owned Desktops

BYOC: Securing Untrusted,Employee-Owned Desktops John Whaley CTO, MokaFive Session ID: xxx-xxxx Session Classification: xxxxxxxxxxxx

Agenda What is BYOC? Techniques for BYOC BYOC Security Considerations Keys to a Successful BYOC Deployment 2

BYOC: Securing Untrusted, Employee- Owned Desktops 3

What is BYOC? BYOC = “Bring your own Computer” a.k.a. BYOPC, BYOL Three models: 1. Employer provides a stipend for the employee to purchase their laptop of choice, which will then be owned by the employee. 2. Employee chooses laptop from a list of pre-approved machines. 3. Employee is given instructions on how to connect to corporate resources, but can use any machine. 4

Why BYOC? User demand Choice computing “Executive bling” Extension of smartphones New generation – “millennials” Business demand Reduce hardware assets Part-time workers, contractors Enable work from anywhere Happy employees = productive employees Bottom line: Users are doing it, with or without IT… 5

What you can apply from this session At the end of this session, you will be able to: Understand the predominant models for BYOC and their relative strengths and weaknesses Evaluate the security of a BYOC solution Avoid common pitfalls in BYOC Plan a successful BYOC deployment 6

Users vs IT 7

Example: Citrix BYOC Program $2100 stipend (taxable) About 50% employees opt in to program 40% of those in the program chose Macs Employees often chipped in their own money to get a better machine After a three month pilot in US, rolled out globally 8

How to deliver services? Technique 1: Provide essential services via web applications Technique 2: Provide a remote desktop (VDI or TS) session Technique 3: Provide virtualized applications that run locally Technique 4: Provide managed corporate virtual machine to run locally 9

Technique 1: Port everything to the webGood: Access from any deviceBad: Takes a long time to rewrite all your apps, no offline access 10

Technique 2:Remote Desktop to VDI or TS Good: Access from many devices Bad: Requires major server infrastructure Can’t run offline Bad interactive performance 11

Technique 3:Application Virtualization Good: Can run locally, but managed centrally Bad: Not cross-platform, not very secure 12

Technique 4:Client-side Virtual Machine Good: Secure, personalized, offline access, cross- platform, local execution, easy recovery Bad: Minimum HW requirement 13

Securing the endpoint device Need to treat BYOC as an untrusted device No VPN DLP Host checker Two-factor authentication Keyloggers, screen scrapers Encryption of data-at-rest Domain join and group policies Access control, remote management of corporate data Security policy enforcement 14

Threat Models Malicious employees Malware infections Screen scrapers or keyloggers Generic viruses/worms Targeted malware Lost or stolen laptops, “borrowed” machines Targeted attacks and espionage 15

Dealing with Infected Endpoint Devices Anti-virus and anti-malware OS patch level Network quarantine Keyloggers and screen-scrapers Data loss prevention 16

Enterprise-Level Layered Security 7 Layers of Security • Anti-virus scan of host PC • Full virtual machine encapsulation • AES-256 encryption • Tamper resistance and copy protection • AD and two-factor authentication • Granular security policies • Remote kill 17

Anti-virus scan of host PC Protects against most known attacks/malware Policy enforcement: Maximum age of signature file Periodic scan frequency Automatic keyboard/screen lock until scan completes 18

Full virtual machine encapsulation Protects against non-targeted attacks Run on a separate, locked-down operating system Rejuvenate to latest golden system disk on every boot Out-of-band updates of golden system disk Device passthrough of keyboard/mouse and video card foils most keyloggers/screen scrapers Hardware support for encapsulation (VT-x, VT-d) 19

AES-256 encryption Encryption of data-at-rest protects against lost/stolen laptops Key escrow Dealing with lost/changed passwords Administrator unlock without user password Don’t forget swap space! 20

Tamper resistance and copy protection Protect against copying data to another device Tie the virtual machine to physical hardware identifiers and/or TPM HMAC of all data to detect tampering 21

AD and two-factor authentication Use RSA SecurID or other second-factor authentication Protects against lost password, lost device; limits exposure window 22

Security policies Targeting security policies by AD group Offline lease time: Maximum time a user can run without checking in Auto-kill: Self-destruct after a given time Version enforcement: Ensure users have latest security patches Peripheral restrictions: USB devices, microphone, printing, CD/DVD, etc. AD group policies: Use existing AD policy sets 23

Remote kill Can mark a device as lost or stolen Device receives a “kill pill”, securely zeroes all data and sends back confirmation Mitigates risk from a lost device or rogue employee/contractor 24

More Challenges to BYOC Supporting diverse platforms (Mac,etc.) Offline access Legal Organizational / Political 25

Supporting Diverse Platforms Mac support Data shows Macs require much less support No mature, robust management tools for OSX hosts yet Best: Provide corporate Windows environment for Mac users Windows 7 support Can provide virtual Windows XP environment for now, upgrade to Win7 once corp standardizes on it Hardware support Give minimum hardware specs for BYOPC Require support package from vendor 26

Legal Challenges Who owns the hardware? Who owns the software? Who owns the data? Mixing corporate and personal on the same device Liability concerns Software licensing What to do when someone is terminated or leaves the company? Not much different than BYO Smartphone, work-from-home One solution: Put corporate environment on separate USB or SD card Need a way to reclaim licenses, erase corporate data (“poison pill”) 27

Organizational and Political Challenges Most common: Business wants it done, but IT dragging feet Refocusing IT staff to focus on services, not hardware Education: “You are making me buy my own machine?” 28

Results Significant proportion choose Macs Increased machine usage More work on weekends and after hours Fewer support calls Users more tolerant and responsible, willing to learn Fewer lost devices Take better care because they are invested in it 29

Key Takeaways1. Focus on securing the data, not the device2. Good security practices are essential, with or without BYOC3. BYOC can save money, reduce support calls, and lead to happier users 30

http://www.mokafive.com	153
http://www.moka5.com	97
http://live.m5.local	20
http://mokafive.com	12
http://moka5.com	7
http://translate.googleusercontent.com	1

RSA Conference 2011 Presentation: BYOC: Securing Untrusted, Employee-Owned Desktops

by John Whaley on Feb 16, 2011

Accessibility

Tags

Upload Details

Usage Rights

6 Embeds 290

Statistics

RSA Conference 2011 Presentation: BYOC: Securing Untrusted, Employee-Owned Desktops — Presentation Transcript