Download as PDF, PPTX
Uploaded bySalvatore D'Agostino
Mobile Device Security
This document discusses securing mobile devices and the edge of networks. It defines what mobile devices include, such as cell phones, laptops, and more. It outlines various attack vectors for mobile devices, including emails, MMS, SMS, and removable storage. The document also discusses using device certificates and FIPS 201 to help authenticate and manage devices. It notes challenges in managing both device and user security and behavior. Finally, it recommends enabling security features like passwords, data encryption, and remote wiping to help secure mobile devices.
More Related Content
Mobile Device Security
- 1. Mobile Device Security Protectingthe Edge of the Network CTST 2009 Salvatore D’Agostino IDmachines LLC
- 2.
- 3. What is amobile device? • Cell phone – NFC – Bluetooth – 802.11.x – 3G, 4G • Laptop • Rugged Devices • Media Players • Automobile, Aircraft • Thumb Drives • Smart Card
- 4. Attack Vector(s) • Email – Attachments • MMS • SMS • Could be anything on thumb drive… • NIST SP-800-124
- 5. Device Identity, AnotherTake on Convergence • Devices matters as much as individuals • Need to be treated in a very similar manner – Enrollment – Registration – Issuance – Activation – Lifecycle Management
- 6. Can FIPS 201address devices? • Device certificates widely used • Provides single method of authentication: – Doors – Desktops – Devices • Network gear • Desktops and Servers • Mobile devices • Programmable Logic Controllers – Smart Grid
- 7. Device Dilemma • Needto manage device security • Need to manage behavior of people that use it – Nearly half of people consider laptop their property • Often don’t have the expertise in the operating system (embedded) • Roaming issue • Now they can connect directly to the network – Not just the email server • Many vendors
- 8. Mobile Device Applicationsand Solutions Expanding Rapidly • Out of band authentication – One Time Passwords Delivered to the Phone • Many vendors entering space – Verisign iPhone app – Battle.net mobile authenticator – Valimo – Payline – CORISECIO – Air France NFC boarding passes – A hundred more…..
- 9. Simple Things toDo • Enable PINs and Passwords – Better if tied to x.509 digital certificate • Enable hard reset and data wipe for lost devices – PIN lockout with CAC • Lojack for phones – Ability to track lost devices • Encrypt data • http://csrc.nist.gov/publications/nistbul/Jan2009 _Cell-Phones-and-PDAs.pdf