Life as a security professional seems to be full of good news and bad news scenarios. For example, today, your budget was just cut again… The good news is that the employees are more than willing to help out by using their own equipment. While on the surface this may sound like a good idea it can be full of issues. This presentation will go over the basics of Consumerization, why it is happening, and what can be done to mitigate the potential issues. It will also touch on some strategies that we might see in the future… Michael F. Angelo, CRISC, is currently the Chief Security Architect for NetIQ and is the Chair of the ISSA Inter-National webinar committee. He is a technical advisor to the US Department of Commerce and is the chair of the team working on security export controls. You can read his blog at http://community.netiq.com/blogs/security_webb/default.aspx

1. Consumerization
ISSA, January 13th 2011
Michael F. Angelo
Chief Security Architect
NetIQ Corporation
blog: http://community.netiq.com/blogs/

2. Agenda
What is Consumerization?
Motivation
How does it impact you?
What can you do about it?
Future
2 © 2011 NetIQ Corporation. All rights reserved.

3. What is Consumerization?
Leveraging technology, that was
originally directed at the consumer,
for business purposes.
3 © 2011 NetIQ Corporation. All rights reserved.

4. Two Aspects
 Use of consumer based services
(facilities) for work
−Not going to cover
 Use of consumer oriented equipment and
software for work (IT)
−Going to cover
4 © 2011 NetIQ Corporation. All rights reserved.

5. Motivation (Corporate)
 Exit the:
−hardware inventory and repair business
−phone / pager business
−Internet business
 Improve productivity
 Improve employee satisfaction
5 © 2011 NetIQ Corporation. All rights reserved.

6. Motivation (Employee)
 Familiarity with O/S, Software, and
Hardware
−Can’t do the job with a Pentium
II, 512MB, and 30GB
−Can’t get information with IE6
−Need features of updated applications.
6 © 2011 NetIQ Corporation. All rights reserved.

7. Does it Happen???
Smart phones/
Mice Keyboards Monitors WiFi Cards Phones/PDAs
Laptops
The trend has been accelerating, as the base cost of
the technology has decreased and employee
experience has increased.
In addition the ever shrinking corporate budget is
acting as an accelerant to the trend.
7 © 2011 NetIQ Corporation. All rights reserved.

8. Does it Happen???
 Corporate Stance
−Secretive
−Ignored
−Unofficially Supported
−Officially Supported
−Subsidized
8 © 2011 NetIQ Corporation. All rights reserved.

9. Does it Happen?
“Security is always a tradeoff, and security decisions
are often made for non-security reasons. In this
case, the right decision is to sacrifice security for
convenience and flexibility. Corporations want their
employees to be able to work from anywhere, and
they‟re going to have loosened control over the tools
they allow in order to get it.”
-- Bruce Schneier
9 © 2011 NetIQ Corporation. All rights reserved.

10. What is the Impact?
 Information Blending
 Software Licensing
 Legislative Issues
10 © 2011 NetIQ Corporation. All rights reserved.

11. What is the Impact?
 Information Leakage
−Family & friends
−Device Loss
−Virus
−Personal email – Spear Fishing
 Increased Exposure to Threats
−Surfing at Home <> Surfing at Work
−Torrents
11 © 2011 NetIQ Corporation. All rights reserved.

12. What is the Impact?
 Acceptable use policies
− How to apply to personal machines?
 Out processing of individuals
− How do you know organizational data is removed from
the employee machine?
− Software
− PST files
− Passwords / wireless / VPN Access
− Residual data
− Employee / corporate backups
12 © 2011 NetIQ Corporation. All rights reserved.

13. What is the Impact?
„23 percent of the largest
organizations surveyed have
experienced a serious breach or
incident because of a personal
device on the corporate network.‟
− RSA Study
13 © 2011 NetIQ Corporation. All rights reserved.

14. What is the Impact?
 What is your current state?
−Is it already there?
 Decide if you will allow Consumerization
−Don’t wait for it to happen and then rush to
formulate policy and procedures
−Decision must explicitly include all possible
components
−Decision must be extended as new technology
becomes available
14 © 2011 NetIQ Corporation. All rights reserved.

15. Action today - Define Policies
 Balance :
− Corporate vs. Employee Accommodations
− Corporate vs. Employee vs. Customer Exposures
 Corporate:
− Must comply with laws
− Must maintain fiduciary responsibility
− Must not expose corporate assets
− At a minimum should address
− Employee responsibility
− Acceptable use
− Protection of assets
15 © 2011 NetIQ Corporation. All rights reserved.

16. Action today – Identify Infrastructure to Extend
 Current Tools will work, but do you want to use all of
them?
− Policy Compliance Tools
− Configuration Enforcement Tools
− Security Audit Tools
− Security Vulnerability Updates
− Performance Audit Tools
16 © 2011 NetIQ Corporation. All rights reserved.

17. Action today - Incident response plan
Remember:
Even with Policies, Procedures, and Tools accidents can
happen… Need incident response plan.
17 © 2011 NetIQ Corporation. All rights reserved.

18. Additional Ideas
 Security 101:
− Keep secret stuff separate from non–secret stuff
− Keep corporate stuff separate from personal stuff
 Create Virtual Containers for Corporate Work.
− Provides compartmentalized facility
− Re-boot to access corporate environment
18 © 2011 NetIQ Corporation. All rights reserved.

19. Action today - Native OS or VM on USB
Encrypted OS Partition
Boot Partition
Operating System
Applications and Files
Boot Loader
− Boots OS directly from device
− Host provides mouse, keyboard, RAM
− Encryption can protect information if device is lost
− Limited to OS on device
19 © 2011 NetIQ Corporation. All rights reserved.

20. Action tomorrow - Native OS / VM on USB + TPM
Encrypted OS Partition
Boot Partition
Operating System
Secure Boot Loader
Applications and Files
− Provides a mechanism to generate and measure system
characteristics upon which a security decision can be made.
− TPM is in almost all commercial grade computers
− For more info see: the Trusted Computing Group
www.trustedcomputinggroup.org
20 © 2011 NetIQ Corporation. All rights reserved.

21. To Continue the Conversation
Please See:
Twitter: @mfa007 or @NetIQ
For mine, and NetIQ, Security Blogs see: http://bit.ly/11BhzC

22. Image Credits
http://www.flickr.com/photos/sanfranannie/3695457758/lightbox
http://www.flickr.com/photos/themuuj/3787043200/lightbox/
http://www.flickr.com/photos/nekonoir/2231873666/lightbox/
http://www.flickr.com/photos/scarpagialla/488834555/lightbox/
http://www.flickr.com/photos/schatz/484932511/lightbox/
22 © 2011 NetIQ Corporation. All rights reserved.