Mobile Security. Luther Knight Mobility Management Technical Specialist, Europe IOT IBM Security April 28, 2015.

(1)

IBM Security

1

Mobile Security

Luther Knight - @lutherLDN

Mobility Management Technical Specialist, Europe IOT

IBM Security

(2)

Where I Started: Blackberry Migration  BYOD

 Bring Your Own Device (BYOD) became popular and grew over the past few years.

 Businesses were expected to adapt to the growing demands of the user.

– Network Access

– Internal Resources

– Corporate Mobile Applications

– Email, Contacts, Calendars

(3)

IBM Security

3

 Infrastructure expenses for supporting multiple,

mobile operating system platforms and devices.

 Increased risk – how do you maintain device

compliance without impacting usability?

 Security – User needs impact data loss prevention

policy



Security – Monitoring apps for malicious code

BYOD Pain Points

(4)

I Spy… A Naughty Application

large companies are doing a bad job or nothing at all to protect

their consumer applications, including Pharma and Finance

40%

50%

33%

of these companies setting zero budget for mobile security and

therefore they’re only testing half the apps they build

of these companies don’t test their apps at all

(5)

Risky Apps

53 %

100 %

 Top applications have been cracked & offered on 3

rd

party ‘App Stores’

 Offered for free but often injected with malware or malicious code

 Android users particularly at risk

(6)

The way to your data, is through your heart

 Sharing personal information

 Access privileges

– Photos

– Location Data

– Contacts

– Calendar

– Camera/Microphone



26 of the top 41

dating apps on Google Play had high

security vulnerabilities

 Poorly coded – credit card info vulnerable

 Phishing Attacks

(7)

What does IBM do?

(8)

(9)

IBM Security

9

IBM Mobile First Protect

Secure Content

Collaboration

Secure Mobile

Containers

Comprehensive

Mobile Management

Seamless

Enterprise Access

(10)

(11)

IBM Security

11

(12)

(13)

IBM Security

13

Powering Productivity

Luther Knight - @lutherLDN

Mail

Content

File Sharing

Editing

Intranet

 Wrapping data loss prevention rules around sensitive information

 Maintaining device compliance

(14)

Mobile Threat Protection - SDK integrated

M

obile

D

ev

ic

e

MobileFirst

Protect

Trusteer Mobile SDK

• Jailbroken /Rooted

• Jailbreak Hiders

• Persistent Device ID

• Malware Infection

• Geo-location

• Unpatched OS

• Unsecure Wi-Fi

• Suspicious Apps

5. Enforce Policy 4. Send Data to Server

3. Analyze risk Data 2. Code the ability to collect

data

1. Integrate Libraries within app code

• Prevent deployment of containers into Jailbroken or Rooted device

• Restrict content sharing between enterprise apps on

malware-infected devices

(15)

IBM Security

15

How it Works

IBM Mobile First Protect Console

Device Risk

Data

Risk Policy Mgmt.

& Control

Policy

Definitions

Policy

Enforcement

Inbound

_{OTA Updates}

 Define compliance rules

 Trusteer Logic always current

(16)

European Security

 European datacenters – Ireland & Germany

 Adheres to EU security standards, ISO-27001 certified and SOC-2 compliant.

 Information is transmitted over SSL3.0/TLS1.0 with certificated from DigiCert

 Data within the European data centers does not get replicated back to USA.

 Data is 256bit AES encrypted in motion and at rest (on device).

(17)

IBM Security

17

www.ibm.com/security

only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any

warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.

Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and

response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed,