Research

It seems like a lifetime ago. June of 1999. Actually it was more than XX1’s lifetime ago. The Boss and I still lived in Northern Virginia. I was close to the top of the world. I started a software company, we raised a bunch of VC money, and the Internet Revolution was booming. The lease on my crappy 1996 Pathfinder was up, and I wanted some spiffy new wheels. Given my unadulterated arrogance at that time in my life, I’m surprised I didn’t go buy a 911, since that’s always been my dream car. But in a fit of logic, I figured there was plenty of time for fancy cars and planes once we took the company public. But I did want something a bit sportier than a truck, so I bought a 1999 Acura TL. It had 225 horses, lots of leather, and cool rims. In fact, I still feel pretty good about it almost 13 years later. I’m still driving my trusty TL. Well, I guess the term driving is relative. I drive about 7,500 miles a year. Maybe. With three kids, we don’t take trips in the TL any more, so basically I use it to go to/from Starbucks and the airport. At almost 100,000 miles, it’s starting to show its age. It’s all dented up from some scrapes with my garage (thanks Grandma!) and countless nights spent in an airport parking lot. But I can’t complain – it’s been a great car. But the TL is at the end of the road and my spidey sense is tingling. That model is notorious for transmission failures. So far I’ve been lucky, but I fear my luck is about to run out. The car just doesn’t feel right, which means it’s probably time for a pre-emptive strike to refresh my wheels. What to buy? I’m not a car guy, but my super-ego (the proverbial devil on my shoulder) looks longingly at a 911 Carrera Convertible. That’s sweet. Or maybe a BMW or Lexus gunship. A man of my stature, at least in my own mind, deserves some hot wheels like that. Then my practical side kicks in (the angel on my other shoulder) and notes that I frequently need to put the 3 kids in the car, and the kids aren’t getting smaller. No SmartCar for me. I also want something that gets decent gas mileage, since it’s clear that gas prices aren’t coming down anytime soon. But it’s so boring and lame to be practical, says the Devil on my shoulder. We know how that ended up for Pinto in Animal House, but what will happen with me? I can’t really pull off the sports car right now, so maybe I should get an ass kicking truck. One of those huge trucks with the Yosemite Sam mud flaps and a gun rack. It will come in handy when I need to cart all that mulch from Home Depot back to my house. Oh right, I don’t cart mulch. My landscaper does that. Again, the practical side kicks in – reminding me that folks needing to make obvious statements about their a badassitude usually have major self-esteem problems. What happened to me? Years ago, this decision would have been easy. I’d get the sports car or the truck and not think twice. Until I got my gas bill or had to tie one of the kids to the roof to get anywhere. But that’s not the way I’m going. I’m (in all likelihood) going to get a Prius V. Really. A hybrid station wagon, and I’ll probably get the wood paneling stickers, just to make the full transformation into Clark Griswold. Though if I tied Grandma to the roof, I wouldn’t be too popular in my house. Even better, the Prius will make a great starter car when XX1 starts to drive 4-5 years from now. That will work out great, as by then it’ll be time for my mid-life crisis and the 911 convertible… -Mike Photo credits: “porsche 911 hot wheels” originally uploaded by Guillermo Vasquez Heavy Research We’re back at work on a variety of blog series. Here is the research currently underway. Remember you can get our Heavy Feed via RSS, where you can access all our content in its unabridged glory. Defending iOS Data Introduction iOS Security and Data Protection Data Flow on iOS Protecting Data on Unmanaged Devices Secure File Apps for Unmanaged Devices Watching the Watchers (Privileged User Management) Access to the Keys (to the Kingdom) Understanding and Selecting DSP Data and Event Collection Incite 4 U Assuming the worst is not new: It’s pretty funny that our pals at Dark Reading are now talking about Security’s New Reality: Assuming the Worst – meaning you need to assume compromise and act accordingly. Duh. Gosh, I’ve been talking about Reacting Faster since early 2007 (I actually checked and the term first appeared on Security Incite in December of 2006. Praise the Google.), and it’s not like I have been the only one, but it is pretty cool to see everyone else jumping on the you’re screwed bandwagon. I was talking to a freelance writer Monday, and she asked what kind of skills I thought people getting into security need to work on, and I said forensics. Obviously there are a lot of fundamentals that need to be in place to understand how to figure out something is wrong, but it’s clear that capable incident responders will be in high demand for a long time. And even incapable incident responders will be busy, as companies in the middle of coping with breaches can’t afford to be too picky. – MR Password Manager Kinda-fail: Elcomsoft conducted a security review of 17 different personal password managers, examining their encryption and key management. The full report (PDF) contains most of the interesting information. The problem is that the report is not very well written. The attacks they discuss all depend on having physical access to the device, or being able to gain access to the device backups – a power-station hack on

To finish our discussion of securing data on unmanaged devices, let’s focus on three categories of apps designed for secure file access: Sandboxed file browsers and mobile file gateways While messaging apps generally do a good job of handling email, they don’t necessarily link into file servers or integrate into enterprise encryption. Secure file management apps skip messaging and focus on access to enterprise file repositories. They support the following core features: Use of either iOS Data Protection or their own embedded encryption. A secure connection to the file repository (which may require a VPN for remote access to internal sources). Support for the iOS document viewer to view supported document types (iWork, Microsoft Office, PDF, etc.). Authentication and authorization to enable or restrict access on a per-user, per-device basis. Ability to restrict or allow “Open In…” to control file movement to other apps. There are a few different flavors. Most require server components or plugins to repositories like Microsoft SharePoint. If the tool doesn’t isolate documents by restricting the “Open In…” feature, it is not suitable for enterprise use. Sandboxed file browser: These allow connections to enterprise file shares using standard connections and store the downloaded documents in an encrypted container. Most use Data Protection rather than to their own encryption scheme. They are usually read-only, although some support annotation of PDF files. Sandboxed cloud file browser: Instead of relying on direct network connections to enterprise file stores, these apps access cloud storage repositories and are specific to their cloud service. Mobile file management gateway: This is a more refined extension of the sandboxed file browser. Rather than allowing access directly to file repositories, mobile devices connect to the gateway using a sandboxed app and are then given access to files through the gateway. These support more granular policies, monitoring, and directory integration. They often also support multiple mobile platforms (yes, there is a world outside Apple). Document management system extensions: These are similar to a mobile file management gateway, but instead of a separate server they run as plugins to an existing document management system. Users connect directly to the document management system (such as SharePoint) via the extension/plugin, which might be centrally managed. Some of these tools support commenting and annotating files (usually restricted to PDFs) but we know expanded document editing is on the roadmap. Sandboxed mobile file encryption apps Mobile computing is one of the big drivers of cloud computing, and cloud storage is, in turn, expanding use of encryption. Encryption apps extend on the sandboxed file browser by integrating with enterprise encryption. They expand on the file browser by: Maintaining file and document isolation in the sandbox. Transparently decrypting files accessed by the app (when integrated into an enterprise encryption scheme and key management server). Accepting files from other apps via “Open In…” and keeping them encrypted in private storage, then enabling protected access to such files. Support for connections to common cloud storage platforms such as Box.net and Dropbox. The big division in this category is between apps designed to open files passed to them by other applications, such as encrypted mail attachments, versus those that integrate directly into cloud storage or other file browsers. Some tools also support decryption of password protected files versus those managed using centralized enterprise keys. When integrated with enterprise key management, the entire process of accessing encrypted files on iOS is completely transparent to the user. They go into the app, which connects to the file store, and files are stored within the app’s secure data store and decrypted as needed. The documents can then be restricted so they are only usable within the app, as with our other sandboxing examples. Some apps also support encryption of files from other apps. This actually provides more protection than normal desktop encryption because it’s far easier to isolate documents and keep them within the app. Mobile Enterprise Digital Rights Management The next option for handling files securely on unmanaged devices expands on encryption into Digital Rights Management. EDRM provides more granular controls that travel with the documents, getting closer to information-centric security. The easiest way to distinguish between an encryption app and EDRM on iOS is: An encrypted document opened in a sandbox may be isolated in that app, but isn’t generally protected when accessed on other systems which also have access (such as a laptop or desktop). Protection is binary, like a lockbox – controlling only who can access the file. We rely on the sandbox app for additional controls, such as restricting movement into other apps – usually on an all-or-nothing basis). An EDRM protected document stays encrypted, but can only be opened by applications that respect the more granular controls applied to the file (including compatible mobile apps). This allows a wide range of control – including who can open the file, who can edit it, who can forward it via email, which devices can access it, and even time limits for access. Encryption is for trusted users and environments, while EDRM also supports untrusted environments. In the mobile space EDRM is better for protecting files you want to share externally and still protect – while encryption is generally only suitable for internal use, or securely transmitting documents, but unable to restrict what they can do once they have it. EDRM is very oriented towards office documents, while encryption is better for arbitrary files. Mobile EDRM requires a server or service to manage the keys. The rights themselves are embedded in the documents. There are a variety of potential deployment models, including: Mobile file gateway File server/SharePoint integration Email client integration Email server integration Microsoft Office integration To simplify this a bit: documents can either be manually protected when you create them in Office or email them, when you upload them to an EDRM-enabled file gateway/storage platform, or automatically when you save them into a protected directory or email them to a certain destination. The documents can only be read using the vendor’s proprietary solution (app), which enforces all the

There are a whole spectrum of options available for securing enterprise data on iOS, depending on how much you want to manage the device and the data. ‘Spectrum’ isn’t quite the right word, though, because these options aren’t on a linear continuum – instead they fall into three major buckets: Options for unmanaged devices Options for partially managed devices Options for fully managed devices Here’s how we define these categories: Unmanaged devices are fully in the control of the end user. No enterprise polices are enforced, and the user can install anything and otherwise use the device as they please. Partially managed devices use a configuration profile or Exchange ActiveSync policies to manage certain settings, but the user is otherwise still in control of the device. The device is the user’s, but they agreed to some level of corporate management. They can install arbitrary applications and change most settings. Typical policies require them to use a strong passcode and enable remote wipe by the enterprise. They may also need to use an on-demand VPN for at least some network traffic (e.g., to the enterprise mail server and intranet web services), but the user’s other traffic goes unmonitored through whatever network connection they are currently using. Fully managed devices also use a configuration profile, but are effectively enterprise-owned. The enterprise controls what apps can be installed, enforces an always-on VPN that the user can’t disable, and has the ability to monitor and manage all traffic to and from the device. Some options fall into multiple categories, so we will start with the least protected and work our way up the hierarchy. We will indicate which options carry forward and will work in the higher (tighter) buckets. Note: This series is focused exclusively on data security. We will not discuss mobile device management in general, or the myriad of other device management options! With that reminder, let’s start with a brief discussion of your data protection options for the first bucket: Unmanaged Devices Unmanaged devices are completely under the user’s control, and the enterprise is unable to enforce any device polices. This means no configuration profiles and no Exchange ActiveSync policies to enforce device settings such as passcode requirements. User managed security with written policies Under this model you don’t restrict data or devices in any way, but institute written policies requiring users to protect data on the devices themselves. It isn’t the most secure option, but we are nothing if not comprehensive. Basic policies should include the following: Require Passcode: After n minutes Simple Passcode: OFF Erase Data: ON Additionally we highly recommend you enable some form of remote wipe – either the free Find My iPhone, Exchange ActiveSync, or a third-party app. These settings enable data protection and offer the highest level of device security possible without additional tools, but they aren’t generally sufficient for an enterprise or anything other than the smallest businesses. We will discuss policies in more detail later, but make sure the user signs a mobile device policy saying they agree to these settings, then help them get the device configured. But, if you are reading this paper, this is not a good option for you. No access to enterprise data While it might seem obvious, your first choice is to completely exclude iOS devices. Depending on how your environment is set up, this might actually be difficult. There are a few key areas you need to check, to ensure an iOS device won’t slip through: Email server: if you support IMAP/POP or even Microsoft Exchange mailboxes, if the user knows the right server settings and you haven’t implemented any preventative controls, they will be able to access email from their iPhone or iPad. There are numerous ways to prevent this (too many to cover in this post), but as a rule of thumb if the device can access the server, and you don’t have per-device restrictions, there is usually nothing to prevent them from getting email on the iDevice. File servers: like email servers, if you allow the device to connect to the corporate network and have open file shares, the user can access the content. There are plenty of file access clients in the App Store capable of accessing most server types. If you rely on username and password protection (as opposed to network credentials) then the user can fetch content to their device. Remote access: iOS includes decent support for a variety of VPNs. Unless you use certificate or other device restrictions, and especially if your VPN is based on a standard like IPSec, there is nothing to prevent the end user from configuring the VPN on their device. Don’t assume users won’t figure out how to VPN in, even if you don’t provide direct support. To put this in perspective, in the Securosis environment we allow extensive use of iOS. We didn’t have to configure anything special to support iOS devices – we simply had to not configure anything to block them. Email access with server-side data loss prevention (DLP) With this option you allow users access to their enterprise email, but you enforce content-based restrictions using DLP to filter messages and attachments before they reach the devices. Most DLP tools filter at the mail gateway (MTA) – not at the mail server (e.g., Exchange). Unless your DLP tool offers explicit support for filtering based on content and device, you won’t be able to use this option. If your DLP tool is sufficiently flexible, though, you can use the DLP tool to prevent sensitive content from going to the device, while allowing normal communications. You can either build this off existing DLP policies or create completely new device-specific ones. Sandboxed messaging app / walled garden One of the more popular options today is to install a sandboxed app for messaging and file access, to isolate and control enterprise data. These apps do not use the iOS mail client, and handle all enterprise emails and attachments internally. They also typically manage calendars and contacts, and some include access to intranet web pages. The app may use iOS Data Protection, implement its own

I want to announce a couple webcasts I’ll be on this week regarding tokenization: one will focus on the grey areas of compliance with tokenization, and the other will offer buyers a list of key evaluation criteria. The first will be Tuesday March 20th, Selecting a Tokenization Solution – a Tokenization Buyer’s Guide. This is the last of a three-part series, and I will focus on all the questions you need to ask vendors. As with most security technologies, there are plenty of little ‘gotchas’ to look out for, and pricing options that are not always apparent. There will be a ton of content – some covered in the research paper, some completely new. On Thursday March 22nd, it will be What the Task Force Did Not Say, focusing on critical compliance issues which the PCI Council’s Tokenization Guidelines skirted. I will highlight key issues left dangling by the council, as well as specific areas merchants need to consider when using tokenization for PCI scope reduction. I will include advice on how to comply and address the most common questions I get from merchants considering tokenization. And bring your questions – we’ll leave time for your specific inquires about the official Guidance or the white paper. Share:

Sorry, folks, I wrote the Summary yesterday and got so caught up in CU beating UNLV for our first NCAA Tournament win in 15 years that I forgot to actually post this. Rich here. I’m going to pull a Rothman this week and go a little personal. I have not only been a competitive athlete my entire life, but most of you have probably noticed that I have a somewhat competitive and achievement-oriented personality overall. Life may not be a video game, but I’m sure going to grab as many power ups as I can just in case. From a certain perspective it’s selfish, because it’s all about what I can achieve, but for me it has always been more about exploring and challenging myself than beating others. I don’t mind losing as long as I played a good game. But I despise losing or doing poorly because I failed to perform. I have tempered a bit with age, but I’m still a competitive SOB. Almost always against the unrealistic goals I set for myself. But earlier this week that all went out the window. My daughter turned 3 recently, which meant it was time for her to move up to the next swimming class. Phoenix is loaded with pools and open water, and childhood drownings are a big problem. We started her in swimming lessons when she was a little over a year old, and for the past 18+ months I have dutifully taken her (and later our younger daughter) to the insanely chlorinated pool where I jumped in, carried her around, and sang all the kiddie songs while she tried to drown herself when I wasn’t looking. Until they’re 3, the parents are in the water with the kids. I really don’t want to think too much about why that pool has more chlorine in it than a chemical weapons plant. I was a bit nervous this past week as I took her in for her first class where she wouldn’t have me in the water with her. You know how kids get attached to patterns, and this was certainly a big break. I dropped her off with the instructor and sat on the other side of the pool in the parent’s seats. Holy crap did she kick ass. Aside from listening better to the instructor than she ever does to me (annoying), it took all of 15 minutes for them to get her to jump in, roll over, and float on her back without help. I assumed I’d be bored out of my mind while she crawled along the edge of the pool for 30 minutes, but I sat there and couldn’t stop watching. Nearly 2 years of training (and play) came together all at once. She probably won’t be in that class very long. And I figure by the time she’s 8 she will easily destroy my pathetic swim times. When the kids pass major milestones they announce it to the entire school at the end of class and hand them ribbons for the achievements. Riley walked away with 3 that night. And as I tried to avoid tearing up, I realized those 3 ribbons meant more to me than nearly anything I have achieved in my own life. For someone who is kind of an antisocial, competitive a-hole… that was entirely unexpected. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian’s Token Buyer’s Guide, next week. Rich quoted in the New York Times on protecting tax documents. A small quote from Rich on Anonymous hacking Panda security. Favorite Securosis Posts Adrian Lane: Defending Enterprise Data on iOS: Introduction. This is starting out to be a very good series. Mike Rothman: Mr. Market Says Security is Winning. Love being a contrarian, and Rich goes contrary to most convention (read echo chamber) thinking in this post… Mike’s Watching the Watchers post. Start of a new series on Privileged User Management, which is warming up. Other Securosis Posts Defending Enterprise Data on iOS: Introduction. Defending iOS Data: iOS Security and Data Protection. Data Flow on iOS. Incite 3/14/2012: My Kind of People. Mr. Market Says Security Is Winning. Favorite Outside Posts Adrian Lane: Let’s look these gift horses in the mouth. The “ungrateful bastard” who wrote this and I agree on many things, this one included. But where I keep my mouth shut and simply accept what I get, Jack does the right thing and points to where we need to be. Mike Rothman: My Networking Beliefs. As an old networking guy, I definitely appreciate this post by Greg Ferro. Lots of truth in here. Rich: Mozilla knew of Pwn2Own bug before CanSecWest. This is really funny, in a terribly geeky way. Research Reports and Presentations Network-Based Malware Detection: Filling the Gaps of AV. Tokenization Guidance Analysis: Jan 2012. Applied Network Security Analysis: Moving from Data to Information. Tokenization Guidance. Security Management 2.0: Time to Replace Your SIEM? Fact-Based Network Security: Metrics and the Pursuit of Prioritization. Tokenization vs. Encryption: Options for Compliance. Top News and Posts Patch Windows NOW!!! Major wormable vulnerability out. BBC attacked by Iran? How MAPP may help bad guys (due to lazy vendors). TSA Pre-Check lets you travel like it’s the year 2000. Talk about the ultimate proof that it’s all security theater. Someone leaked proof of concept code for the Microsoft RDP vulnerability. Windows Azure Outage. Blog Comment of the Week Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Rory and Dre (they both contributed so much), in response to Defending iOS Data: iOS Security and Data Protection . @dre so it sounds like we’re talking about the difference between practical and theoretical here. I’d agree that theoretically iPad2/3/iPhone 4S are vulnerable to a DFU mode exploit if one is found but that currently there is no publicly available DFU mode exploit for iOS 5 running on an A5 based device (iPad 2/iPhone 4S) and that current publicly available jailbreaks can’t be done from a locked/powered off device. @ Rory: Yes, but the EMF and Dkey keys are

Continuing our series on iOS data security, we need to take some time to understand how data moves onto and around iOS devices before delving into security and management options. Data on iOS devices falls into one of a few categories, each with different data protection properties. For this discussion we assume that Data Protection is enabled, because otherwise iOS provides no real data security. Emails and email attachments. Calendars, contacts, and other non-email user information. Application data When the iOS Mail app downloads mail, message contents and attachments are stored securely and encrypted using Data Protection (under the user’s passphrase). If the user doesn’t set a passcode, the data is stored along with all the rest of user data, and only encrypted with the device key. Reports from forensics firms indicate that Data Protection on an iPad 2 or iPhone 4S (or later, we presume) running iOS 5 cannot currently be cracked, by other than brute force. Data Protection on earlier devices can be cracked. Assuming the user properly uses Data Protection, mail attachments viewed with the built-in viewer app are also safe. But once a user uses “Open In…”, the document/file is moved into the target application’s storage sandbox, and may thus be exposed. When a user downloads an email and an attachment, and views them in the Mail app, both are encrypted twice (once by the underlying FDE and once by Dat Protection). But when the user opens the document with Pages to edit it, a copy stored in the Pages store, which does not use Data Protection – and the data can be exposed. This workflow is specific to email – calendars, contacts, photos, and other system-accessible user information is not similarly protected, and is generally recoverable by a reasonably sophisticated attacker who has physical possession of the device. Data in these apps is also available system-wide to any application. It is a special class of iOS data using a shared store, unlike third-party app data. Other (third party) application data may or may not utilize Data Protection – this is up to the app developer – and is always sandboxed in the application’s private store. Data in each application’s local store is encrypted with the user’s passcode. This data may include whatever the programmer chooses – which means some data may be exposed, although documents are nearly always protected when Data Protection is enabled. The programmer can also restrict what other apps a given document is allowed to open in, although this is generally an all or nothing affair. If Data Protection isn’t enabled, all data is protected only with the device’s default hardware encryption. But sandboxing stil prevents apps from accessing each other’s data. The only exception is files stored in a shared service like Dropbox. Apps which access dropbox still store their local copies in their own private document stores, but other apps can access the same data from the online service to retrieve their own (private) copies. So application data (files) may be exposed despite Data Protection if the app supports “Open In…”. Otherwise data in applications is well protected. If a network storage service is used, the data is still protected and isolated within the app, but becomes accessible to other compatible apps once it is stored on a server. This isn’t really a fault of iOS, but this possibility needs to be considered when looking at the big picture. Especially if a document is opened in a Data Protection enabled app (where it’s secure), but then saved to a storage service that allows insecure apps to access it and store unencrypted copies. Thus iOS provides both protected and unprotected data flows. A protected data flow places content in a Data Protection encrypted container and only allows it to move to other encrypted containers (apps). An unprotected flow allows data to move into unencrypted apps. Some kinds of data (iOS system calendars, contacts, photos, etc.) cannot be protected and are always exposed. On top of this, some apps use their own internal encryption, which isn’t tied to the device hardware or the user’s passcode. Depending on implementation, this could be more or less secure than using the Data Protection APIs. The key, from a security perspective, is to understand how enterprise data moves onto the device (what app pulls it in), whether that app uses Data Protection or some other form of encryption, and what other apps that data can move into. If the data ever moves into an app that doesn’t encrypt, it is exposed. I can already see I will need some diagrams for the paper! But no time for that now – I need to get to work on the next post, where we start digging into data security options… Share:

We are happy to announce a new series, where for the first time we will research and document the issues around privileged user management (PUM). It may not sound as exciting as cloud anything, or iOS data protection, but it’s something you overlook at your own risk. Because administrators (those privileged users) have the keys to your kingdom. A sysadmin with malicious intent can cause a very bad day for you and your organization. And no, this isn’t just another recycled attempt to bring the insider threat back into vogue – much to the chagrin of the DLP vendors, who drove their first wave of growth based on the nebulous insider threat. First of all, privileged users (P-users) don’t necessarily need to be insiders. And most insiders have limited access and authorization entitlements, while administrators can basically giving themselves access to do whatever they want. That old privilege escalation thing. That’s why we are calling this series Watching the Watchers – because if not properly managed, administrators are Above the Law. Business Imperatives Changing Privileges We live in a brave new world of technology. What used to be within your site, in your data center, or running on your big iron, now may or may not be in any or all of those places. Even if your stuff runs in your data center you might not know exactly where and it may not be in your control. It may or may not be running on an operating system you understand. You may or may not control the pipes that lead to that data. And you certainly can’t tell business users and/or business partners that they need to go back to the old model, where you had visibility from the bare metal all the way to the data layer. Times have changed. Even better, you might not even know who is responsible for managing those specific systems. With layers of virtualization abstracting pretty much all physical networks, storage, and servers, there are many different folks responsible for managing the pieces of what we call an application. Even the term ‘application’ is really a misnomer – applications can be almost anything, processing anywhere, accessing data from anywhere, and presenting information to anyone, anywhere. Times sure have changed. So let’s start by defining what a privileged user is. Privileged User: Anyone with admin (or root) access to a device. Based on that definition, every user is a privileged user to some device. That’s a bit broad, so we’ll restrict our discussion (and this research) to users who manage critical devices – running applications, hosting databases, or pushing packets to the places they need to be. Sure, it’s problematic if the P-user in charge of the receptionist’s device (the receptionist) is compromised. But it’s much more serious if someone who can administer the device hosting your customer database gets owned. Let’s get a bit more specific about the business drivers and the impact on privileged users: Reduce Cost – Virtualization/Cloud: Many organizations are under dramatic pressure to continue reducing costs wherever possible. That means embracing technologies like virtualization to make better use of physical hardware, and cloud computing to make better use of data center real estate. The impact of this driver is scale. Now you have a lot more things to manage and they can be spun up and torn down at the click of a button or via script. Throw in the unbounded number of instances that can be run in the public cloud, and the only thing you can be sure of is a massive change management headache. Reduce Cost – Outsource: While data centers are virtualizing, organizations are contracting with (lower) cost management to do their (alleged) commodity work. You know, like managing databases and email. All kidding aside, it’s common to see third parties manage wide swaths of an organizations’ IT infrastructure – providing nameless, faceless folks (perhaps on the other end of a SAML link) with access to critical stuff. Agility – New Apps: If you think about a typical web app, it’s more ‘assembled’ nowadays than built from the ground up. And parts may be yours, they could be pieces you got from someone else, or they might include data from somewhere else, integrated into your environment via a foreign API. It’s hard to know what an application is nowadays. And if we don’t know what it is it’s generally difficult to manage. Yes, there are more business drivers, but you get the picture. Anyone with access to manage a device that runs something important (or is a component of something important) is a privileged user, and the change management issues inherent in this escalating complexity requires that administrators continue to become more efficient and leveraged. Which can result in errors, shortcuts, and general violation of good operational practices. Now let’s look at some specific threats these privileged users present. P-User Risk Assessment Yeah, we’re old school. We still like to assess risk, or at least run through a quick mental exercise to figure out how many ways we can get killed. So let’s do that with this explosion of devices managed by privileged users. Of course this isn’t an exhaustive list – more a back of the envelope exercise to uncover some of the biggest threats to our environment if these privileged users are compromised. And while we are at it, let’s define a new term, PUPwnage, for a compromised privileged user. Just rolls off the tongue, right? Compromised devices: This one is obvious. If a privileged user is compromised (PUPwned), the attackers gain access to any device they manage, and then the fun begins. Data leakage: PUPwnage can result in any and all data being stolen from the devices they control. Create accounts: PUPwnage allows attackers to create both user and admin accounts on devices, and to pivot through the environment, moving from one compromised device to another – stealing data thefts as they march along. Pollute applications and/or data: PUPwnage also results in application attacks, such as changing code to break functionality, creating backdoor access, deleting or changing data, or otherwise breaking your applications.

Before we delve into management options we need time to understand the iOS security and data protection models. These are the controls built into the platform – many utilized in the various enterprise options we will discuss in this series. We are focused on data but will also cover iOS security basics, as they play an important role in data security, and for those of you who aren’t familiar with the specifics. The short version is that iOS is quite secure – far more secure than a general-purpose computer. The downside is that Apple supports only limited third-party security management options. Note: We are only discussing iOS 5 or later (as of this writing 5.1 is the current version of the iOS operating system – for iPhone, iPad, and iPod touch). We do not recommend supporting previous versions of the OS. Device and OS Security No computing device is ever completely secure, but iOS has an excellent track record. There has never been any widespread remote attack or malware used against (non-jailbroken) iOS devices, although we have seen proof of concept attacks and plenty of reported vulnerabilities. This is thanks to a series of anti-exploitation features built into the OS, some of which are tied to the hardware. Devices may be vulnerable to local exploitation if the attacker has physical access (using the same techniques as jailbreakers). This is increasingly difficult on newer iOS devices (the iPhone 4S and iPad 2, and later), and basic precautions can protect data even if you lose physical control. Let’s quickly review the built-in security controls. Operating System Hardening Five key features of iOS are designed to minimize the chances of successful exploitation, even if there is an unpatched vulnerability on the device: Data Execution Protection (DEP): DEP is an operating system security feature that marks memory locations as non-executable, which is then enforced by the CPU itself. This reduces the opportunity for successful memory corruption attacks. Address Space Layout Randomization (ASLR): ASLR randomizes the memory locations of system components to make it extremely difficult for an attacker to complete exploitation and run their own code, even if they do find and take advantage of a vulnerability. Randomizing the locations of system components makes it difficult for attackers to know exactly where to hook their code, in order to take over the system. Code Signing: All applications on iOS must be cryptographically signed. Better yet, they must be signed using an official Apple digital certificate,or an official enterprise certificate installed on the device for custom enterprise applications – more on this later. This prevents unsigned code from running on the device, including exploit code. Apple only signs applications sold through the App Store, minimizing the danger of malicious apps. Sandboxing: All applications are highly compartmentalized from each other, with no central document/file store. Applications can’t influence each other’s behavior or access shared data unless both applications explicitly allow and support such communication. The App Store: For consumers, only applications distributed by Apple through the App Store can be installed on iOS. Enterprises can develop and distribute custom applications, but this uses a model similar to the App Store, and such applications only work on devices with the corresponding enterprise digital certificate installed. All App Store apps undergo code review by Apple – this isn’t perfect but dramatically reduces the chance of malicious applications ending up on a device. There are, of course, techniques to circumvent DEP and ASLR, but it is extremely difficult to circumvent a proper implementation of them working together. Throw in code signing and additional software and hardware security beyond the scope of our discussion, and iOS is very difficult to exploit. Again, it isn’t impossible, and we have seen exploits (especially local attacks such as tethered jailbreaks), but their rarity, in light of the popularity of these devices, makes clear that these security controls work well enough to thwart widespread attacks. Specifically, we have yet to see any malware spread among un-jailbroken iPhones or iPads. Security Features In addition to its inherent security controls, iOS also includes some basic security features that users can either configure themselves or employers can manage through policies: Device PIN or Passcode: The most basic security for any device, iOS supports either a simple 4-digit PIN or full (longer) alphanumeric passphrases. Either way, they tie into the data protection and device wipe features. Passcode Wipe: When a PIN or passphrase is set, if the code is entered incorrectly enough many times the device erases all user data (this is tied to encryption features discussed in the next section). Remote Wipe: iOS supports remote wipe commands via Find My iPhone and through Exchange ActiveSync. Of course the device must be accessible across the Internet to execute the wipe remotely. Geolocation: The device’s physical location can be tracked using location services, which are part of Find My iPhone and can be incorporated into third-party applications. VPN and on-demand VPN: Virtual private networks can be activated manually or automatically when the device accesses any network service. (Not all VPNs support on-demand connection and this is VPN-provider specific). Configuration Profiles: Many of the security features, especially those used in enterprise environments, can be managed using profiles installed on the device. These include options far beyond those available to consumers configuring iOS personally, such as restricting which applications and activities the user can access on the phone or tablet. These are the core features we will build on as we start discussing enterprise management options. But iOS also includes data protection features that are the cornerstone of most iOS data security strategies. Data Protection Although it was nearly impossible to protect data on early iPhones, modern devices use a combination of hardware and software to provide data security: Hardware Encryption: The iPhone 3GS and later, and all iPads, support built-in hardware encryption. All user data can be automatically encrypted in hardware at all times. This is used primarily for wiping the device, rather than to stop attacks. Rather than slowly erasing the entire flash storage, wiping works by immediately destroying the encryption key, which makes user data

The numbers alone don’t tell the story. In 2011 Apple sold 315 million iOS devices (62 million in the fourth quarter alone). There are over 100 million iCloud users – using a service less than a year old. And these numbers are for Apple alone – never mind all the other mobile devices. Apple calls this the dawn of the “post-PC era”, and with numbers like those it’s hard to argue. Even Microsoft is in the midst of what is shaping up to be the largest change in their platform strategy since Windows, in an attempt to address this market. These devices aren’t confined to the home. Survey after survey shows growing enterprise adoption of iOS, including major migrations off RIM BlackBerry and other business-centric smartphones – even aside from the tidal wave called iPad. The phrase “the consumerization of IT” appeared before the release of the iPhone, but no other vendor is doing as much to drive the adoption of consumer technologies into the enterprise as Apple. In years past we in IT security served as the gatekeepers of new technologies in the enterprise. As much as we like to say we’re the last to find out about new tools and toys, mobility is one area where we have held tight control by limiting access to the network. But in the post-PC consumerization world we are losing our ability to stop the adoption of consumer technologies, even when they don’t support all our enterprise needs. In a recent session at the RSA Security Conference I asked a group of 150 operational security professionals how many were under pressure to support non-BlackBerry devices. Nearly every hand in the room went up, almost universally to support iOS, and only a relatively small percentage had technical capabilities or policies in place to manage this transition. And while there was some concern about the impact of these devices on the network, the universal concern was the safety of data. The question is no longer if or when to allow these devices, but how to support non-PC computing platforms while safely protecting enterprise data. To stay focused, this series will lay out options for protecting enterprise data on iOS, rather than talking about the myriad of other issues around mobile device management. Why iOS and Not Android Of course Apple isn’t single-handedly driving the consumerization of IT concept, but the numbers above (and a quick glance around the office) show that the company from Cupertino is clearly a major force. They have done more to alter the landscape of the smartphone and tablet markets than any other single provider. And, not coincidentally, we are asked more about securing iOS for the enterprise than any other platform. Until recently BlackBerry was the dominant platform – largely because it was designed specifically to address enterprise needs. As a result most organizations are comfortable securing these tools. Some organizations also supported Microsoft and perhaps Palm, but one of those companies no longer exists and the other completely tossed out its platform to start fresh. The real activity is with iOS and Google’s Android. But for a variety of reasons enterprises face more pressure to support iOS. Android-based tablets are not yet competitive or in wide use, and the fractured nature of Android phones and software versions makes it far easier to justify restricting those devices. From a security perspective, iOS is also a stronger platform. While nothing is invulnerable, there is essentially no iOS malware and few known security breaches. The software ties strongly to the hardware and current versions are very difficult to hack. Android, by its more open nature, represents a greater security risk – as demonstrated by ongoing malware issues (still lower than PC levels, but much higher than iOS). The main problem is that Apple provides limited tools for enterprise management of iOS. There is no ability to run background security applications, so we need to rely on policy management and a spectrum of security architectures. We will focus on iOS because: You already know how to manage BlackBerry. Android isn’t mature or safe enough for us to endorse for enterprise use, and the fractured operating system levels make strategic management difficult. Windows Mobile is not in widespread use and the Metro tablet platform is still in development. Clients tell us they are under pressure to support iOS more than other platforms – especially the iPad. Most of the options we will discuss also apply to other platforms – especially the latest version of Android (Ice Cream Sandwich, which isn’t widely available). Information-Centric Security We are focusing on data for this series, so we will take an information-centric approach. We won’t talk about network management or device restrictions that aren’t relevant to protecting data. But we will discuss managing the data even before it hits the device. Previously I wrote the following principles of information-centric security: Information (data) must be self describing and defending. Policies and controls must account for business context. Information must be protected as it moves from structured to unstructured, in and out of applications, and changing business contexts. Policies must work consistently through the different defensive layers and technologies we implement. These sound a bit like the usual analyst mumbo-jumbo, but we do actually have the technologies to implement much of this today. In terms of managing data for mobility and iOS we can hit every one of those points except movement between structured and unstructured data. Through the rest of this series we will show how to manage what data ends up on devices, how to protect it once it’s there, and how to build and manage policies to enable users without violating risk tolerances. To do this we will present a spectrum of options designed to satisfy different organizational needs; all of which are supported by existing products (some of which you probably already have). Before we dig into the management options we need to spend a little time understanding how iOS works… which will be the next post. And yes, this is the opening to a new

Like everyone else, I have a bunch of jobs. There is the day job and then my job at home. Well, it’s not really a job, it’s more a responsibility – to be a good husband and to teach my kids to be properly functioning adults. As most of you know, I take the parenting responsibility very seriously. I am constantly stressing hard work and best effort. Making the point constantly to my kids that the only thing they can truly control is their own effort. But ultimately I am flawed, like everyone else, and I worry my flaws will be passed on to my kids. We get each kid’s schoolwork back on Thursday. Usually they do very well but sometimes they blow a test or quiz. The Boss spends a lot of time going through their mistakes to make sure they don’t make the same ones again. I peruse the papers and try to celebrate the good scores on the math quiz or the spelling test. But it’s hard. I’m on to the next thing already. What’s next on the list? No time to celebrate – too much to do. That’s how I’m wired. But all the accomplishments and all the tasks checked off the task list pale in comparison to trying to teach the kids to be good people. To be nice and supportive and good friends. To be empathetic about other folks’ challenges, and to appreciate the charmed life they lead. Part of that process is sending them to sleepaway camp each summer. There they need to function as part of a group, without the Boss and me to tell them exactly what to do. Before we know it they’ll be out in the nasty, unforgiving world, so we hope they can learn some important lessons in a safe environment before it’s real. Another aspect of their real life training is to show that everyone has their own challenges, and they can choose to make every situation either better or worse. USA Network recently aired a show called NFL Characters Unite, which provided a great opportunity to teach the kids about the importance of empathy and being kind. The show takes some NFL heavy hitters (Hines Ward, Jimmy Graham, Tony Gonzalez, and Tony Dungy) and tells their stories of suffering racism, bullying, and abandonment. A 6’5” and 250 lb guy, being bullied? Amazingly enough, yes. It showed how these guys overcame those challenges, and showed them each mentoring a kid in a similar position. The show was really awesome. Not because it humanized the players, which it did. But it (hopefully) taught my kids a few things. First the impact of being unkind. They could see how bullying and meanness impact a kid. I also hope they learned not to judge a book by its cover. You’d never think NFL stars could be bullied or suffer racism. These guys are invincible, right? Not so much. The kids shouldn’t draw conclusions, but instead get to know folks and make up their own minds. Finally, perhaps they can appreciate how lucky they are to have a supportive family. Maybe, just maybe, when they get into a situation where they can choose to be kind or unkind, they’ll choose correctly. We hope they will reject peer pressure to go for the quick laugh, and stand up for someone who may not be able to stand up for themselves. Ultimately, in 10 years, when all our kids are loose on the world, I can only hope they’ll be kind people. The kind of people I’ll be proud to know. –Mike Photo credits: “In the end, only kindness matters” originally uploaded by SweetOnVeg Lazy Deal Analysis: Dell goes SuperSonic(WALL) Dell made news a year ago shelling out big bucks for SecureWorks, and now they are at it again, spending a reported $1-1.5 billion to acquire SonicWALL from the clutches of private equity. We actually like this deal – not only because it reinforces that Mr. Market Says Security Is Winning. But additionally, SonicWALL’s traditional business in the mid-market is a good fit with Dell’s distribution engine, and dovetails nicely with the SecureWorks services offering. But this deal is all about IBM and HP envy. Do you think it will be long before Dell formally moves all their security stuff into a separate business unit? They want to compete with the big boys, and large enterprise wants security from their major IT providers. Both SecureWorks (via the VeriSign MSS deal) and SonicWALL (with its SuperMassive NGFW) have increasingly focused on the enterprise. We expect Dell to continue investing in services folks to wrap the integration layer around the products and services. We have been hearing speculation about Dell acquiring Fortinet, but this deal seems like a much better option. It’s much cheaper, provides functionally comparable technology, and brings on less infrastructure to worry about integrating – especially at the enterprise level. And don’t forget about the biggest winners here: Thoma Bravo, the private equity fund that took SonicWALL private about 18 months ago for $717 million. Perhaps doubling in that time period is a huge win. But as Rich said in Mr. Market: the bankers always win. Incite 4 U Leaving an Anonymous Trail of Bits: We all talk about how as a good guy you need to always be right, while the bad guys only need to be right once. It turns out that no one can be wrong, ever, as our buddies at Threatpost detail by showing how some Anons left a trail, and the FBI (and other law enforcement folks) are getting much better at following such trails. Sabu forgot to Tor a few times and got bagged. Rob G talked a bit about it. And finally Nigel Perry talks a bit about how Sabu turning turncoat was obvious, in hindsight anyway – given his attempts to get his buddies to do bad stuff. I recently saw the movie Drive, and the bad guy says to the good guy that he can walk away, but he’ll always be looking over his shoulder. I guess that’s a universal truth