More Related Content Similar to How Aetna Mitigated 701 Malware Infections on Mobile Devices (20) How Aetna Mitigated 701 Malware Infections on Mobile Devices1. © 2017 Aetna Inc.
Strategy and
Tactics for Securing
Mobile Devices
in Financial Organizations
2. © 2017 Aetna Inc.
Quick Housekeeping
• There will be time for Q&A at the end
• Ask questions using the GTW chat pane
• The webinar is being recorded
• All attendees will receive a copy of the slides/recording
Join the discussion #MobileThreatDefense
3. © 2017 Aetna Inc.
Meet Your Speaker
Brian Heemsoth
Director of Software & Mobile Security
Aetna
4. © 2017 Aetna Inc.
Mobile Threat Landscape
Physical
Malware
Vulnerabilities
Network
5. © 2017 Aetna Inc.
Physical Threats
Addressed by MDM, MAM & Containerization PlatformsPhysical
Malware
Vulnerabilities
Network
6. © 2017 Aetna Inc.
Malware
Got 200+ devices? You probably have malware!Physical
Malware
Vulnerabilities
Network
iOS Malware
Pegasus | Malicious Profiles |
AceDeceiver | YiSpecter | XcodeGhost
Android Malware
Quadrooter | Stagefright |
Hummingbad | Accessibility Clickjacking
Targeted Malware
Exaspy, Ransomware,
Repackaged Apps
Annoying
Malware
Adware
1 in 5 of your devices
allow installation from
third-party app stores
Third-party
stores are
72xmore likely to
deliver malware
Malware as a Percentage
of Downloaded Apps
Google Play Store
Samsung
Amazon
Aptoid
0.06% (1 in 1600 apps)
0.11% (1 in 900 apps)
0.77% (1 in 130 apps)
4.41% (1 in 23 apps)
7. © 2017 Aetna Inc.
Malware
Got 200+ devices? You probably have malware!Physical
Malware
Vulnerabilities
Network
Man in the Middle
WifigatePineapple
arpspoofdnsspoof
SSL stripping
SSL decryption
Content manipulation
92%
of users click on
“Continue”
compromising their
Exchange identity
(username and password)
Source: Skycure Threat Intelligence
32.5 PERCENT
of executive devices
were exposed to
network attack
within a quarter
8. © 2017 Aetna Inc.
Vulnerabilities
Organized & directed effort from hackersPhysical
Malware
Vulnerabilities
Network do not have latest OS version installed
33% of Devices with
Stored Sensitive Info
Do you know which of your
devices are upgradable?
- Without relying on Apple or Google?
- How much risk can be averted by simply updating?
?
?
?
9. © 2017 Aetna Inc.
Pain Points in Regulated Industries
• Data accessed outside corporate firewalls
− Greater use of mobile devices
− Flexible working hours and locations
• Accessing regulated data on unmanaged
devices
− Agents/Doctors manage their own devices
− Better access to customer data means better
service in the field
• New regulations
NEWS ITEM:
New York State
Imposes New
Cybersecurity
Regulation for
Financial Services
New requirements:
1. Employ a CISO
2. Annual reports
10. © 2017 Aetna Inc.
Customer Data at Risk
Source: Skycure Source: Skycure
1 in 5 organizations
suffered a mobile security breach
8%
of all healthcare
breaches came
from mobile
devices
16%
of all financial
breaches came
from mobile
devices
11. © 2017 Aetna Inc.
Mobility @ Aetna
• Approximately 10k mobile devices
− 60% BYOD; 40% corporate-owned/managed
− Phones, tablets, iPods
• Use cases:
− Mobile productivity (email, calendar)
− Chat/collaboration
− Enterprise managed third-party applications
− Internally developed employee applications
• Established MDM & MAM Platforms
12. © 2017 Aetna Inc.
Aetna: Key Risk Factors
Compromise of
data in
containerized
applications by
“screen scraping”
iOS/Android
malware
Compromised
Aetna
Credentials &
Data
(malicious
networks)
Malware
on BYOD &
Corporate
Devices
Unpatched OS
Vulnerabilities
Device
Currency
Pegasus
AceDeceiver
SVPENG
13. © 2017 Aetna Inc.
Aetna’s Solution
• Implemented Skycure Mobile Threat Platform
• Deployed to all BYOD & Corporate Devices
• Mandated compliance dates
• Integrated monitoring into Security Operations Center
• Phase 2: Integration into MDM platforms to allow for
proactive management of access to Aetna resources from
impacted devices (in progress)
14. Title of Presentation DD/MM/YYYY© 2017 Skycure Inc. 14
9,314 Devices
53,612,964 Network Tests Performed
523,143 Access Points
53,458 Networks
9,724 Active Users
4,097,982 Apps Scanned
15. Title of Presentation DD/MM/YYYY© 2017 Skycure Inc. 15
24 High criticality malware infections
mitigated
460 Instances of credentials/data
protected on high risk networks
701 Total malware infections mitigated
23.97 High risk vulnerabilities addressed
per-device
16. © 2017 Aetna Inc.
Risk Visibility
The Foundation to addressing risk is having Visibility
Source: Screenshots from the Skycure platform at Aetna
17. © 2017 Aetna Inc.
Malware Security 3,365,558 Android Apps Scanned
Source: Screenshots from the Skycure platform at Aetna
Installed from unknown third party application store
Since implementation 14 critical severity malicious Android applications have been identified.
Unauthorized system setting modification,
process manipulation, audio recording
18. © 2017 Aetna Inc.
Network Security
30,105,599
Networks Tests Performed on
34,918
Networks, Accessed From
319,338
Access Points
3,607 devices connected to a network which posed a threat (6.4% of the
networks). These network threats include secure traffic description, content
manipulation, suspicious/fake hotspots, and unknown threats (suspicious
network behavior).
Skycure automatically opens a VPN and adds another layer of encryption when applicable.
Source: Screenshots from the Skycure platform at Aetna
61%
39%
39% of Aetna’s devices
were exposed to
network threats
32685
2233
Safe Networks
Threatning Networks
September 2, 2016
3,607 of 9,304 devices were exposed (39%)
19. © 2017 Aetna Inc.
Network Incidents Map
The above map shows the distribution of tests that concluded with network threats according to the
geolocation associated with the network.
Source: Skycure
20. © 2017 Aetna Inc.
Vulnerabilities
1,941 devices are running an operating system with high risk. We use CVSS - open
standard for scoring vulnerabilities. You can see the reasoning for each of those in
the system.
Most of Aetna’s devices are iOS, which is
usually better when it comes to security
updates. However, we still see many of
them running OS versions with major
known vulnerabilities
Source: Screenshots from the Skycure platform at Aetna
21. © 2017 Aetna Inc.
Total & Overall Risk Trends
While we are managing to maintain less than 10 devices at risk at
any given time, we are also constantly improving the overall risk by
decreasing the total number of medium risk devices. In the
following graph you can see that decrease (Medium-risk devices are
marked with Orange).
We constantly collect device risk and at the peak time (April 3rd)
we had 9 devices at high risk – Currently we have 0 devices with
high risk, as we are constantly addressing these.
Source: Screenshots from the Skycure platform at Aetna
23. © 2017 Aetna Inc.
New York Life Testimonial
Steve Johnson
Head of Data Protection & Cybersecurity Services
Enterprise Technology Group
"Our people need access to data and other corporate
resources on mobile devices, but we are mindful of the need
to protect our systems, especially regulated data," said
Johnson.
"Our agents can securely access a client’s information before a meeting,
which allows them to make smarter policy recommendations,"
Johnson explained.
24. © 2017 Aetna Inc.
Skycure Mobile Threat Defense
• Always ON
protection
• Whole device,
all vectors
• No “Sideloading”
Seamless
experience
Privacy
Minimal
footprint
• Advanced security
• Risk-based mgmnt
• Automation and
integration
Security
Visibility
IT Satisfaction
PUBLIC
APP
CLOUD
SERVER
• Crowd-sourced
• Threat aggregation
from third parties
• Skycure research
1 Million+ Global
Threats Identified
https://maps.skycu
re.com
THREAT
INTELLIGENCE
25. © 2017 Aetna Inc.
Skycure – High Level Overview
Leading Product & ResearchCustomers
#1 Mobile Threat Defense SolutionStrategic Partners
CONSUMER GOODS RETAIL
MANUFACTURING TECHNOLOGY
FORTUNE 50
PHARMACEUTICAL
COMPANY
250+TV channelsFORTUNE 100
HEALTHCARE
COMPANY
FORTUNE 500
FINANCIAL SERVICES
COMPANIES
Editor's Notes Before I give the solution overview, let me quickly walk you through who Skycure is. We are the leader in Mobile Threat Defense with more Fortune 500 companies as customers than all the other players combined. Given our strength in research, we have been featured in all leading print, digital, and broadcasting media including more than 250 radio and TV channels including the super prestigious NBC’ The TODAY show.
We partner with all major EMM market leaders and security VARs.
Lastly, Skycure technology constantly gets rated as the #1 Mobile Threat Defense solution by analysts and evaluators.