Instructor: Mobile vulnerabilities. 2 2
In this lesson, 3 3
we're going to start talking about mobile vulnerabilities. 4 4
Now, as you look around the workforce these days, 5 5
you cannot go within a couple of minutes 6 6
without seeing somebody on their smartphone 7 7
or on their tablet or on some other kind of mobile device, 8 8
maybe a smartwatch or something like that. 9 9
It's just, these devices are everywhere now, 10 10
and this introduces new threats and vulnerabilities 11 11
to our networks and our organizations. 12 12
So in this lesson, 13 13
we're going to cover three specific areas 14 14
associated with mobile technology. 15 15
This includes the bring your own device policies 16 16
that so many of our companies are using, 17 17
mobile platform threats and vulnerabilities, 18 18
and mobile device management 19 19
and enterprise mobility management. 20 20
First, let's talk about bring your own device. 21 21
Now, bring your own device is a policy 22 22
that allows people to, essentially, 23 23
bring their own equipment into work and use it. 24 24
Now, when you talk about bring your own device, 25 25
it can be something generic, 26 26
like mice and keyboards and headphones, 27 27
or something like a laptop or a smartphone or a tablet. 28 28
It really can be any device. 29 29
And so it's up to your organization 30 30
to define your bring your own device policy. 31 31
In the most general terms, 32 32
a bring your own device policy, or BYOD, 33 33
is any security policy set forth by a company 34 34
that allows employees to use their personal smartphones, 35 35
laptops and tablets for work 36 36
or connection to the corporate network. 37 37
So if I have my laptop, I can bring it to work, 38 38
plug it into the network and start working on it all day. 39 39
When I'm done, I can unplug it from the network, 40 40
and take it home, 41 41
and then I can plug it into my network at home 42 42
and use it for personal things or work related things. 43 43
And that's really the danger 44 44
when we start talking about bring your own device. 45 45
Now, when we think about bring your own device, 46 46
it brings a lot of challenges with us. 47 47
The first one is deperimeterization. 48 48
Now, what do I mean by this? 49 49
Well, when we talk about physical security of our network, 50 50
we're talking about the perimeter. 51 51
If my entire network is located within my office building, 52 52
it's a lot easier for me to protect 53 53
than if I allow that to go outside my office building. 54 54
So if you take your laptop 55 55
and you bring it to work and use it, 56 56
and then you take it home, 57 57
well, then we've just expanded the perimeter 58 58
of the office network to your house as well. 59 59
Even if we don't do it logically, 60 60
we have now physically done it 61 61
because there's documents stored on that device 62 62
that are now in your home. 63 63
And so if that laptop gets stolen, that can be a problem, 64 64
because we don't have the protections in place. 65 65
Another big issue we have 66 66
is unpatched and unsecure devices. 67 67
If you're going to bring your laptop in, 68 68
I don't know what the quality of that laptop is. 69 69
I don't know if you've done all your security patches, 70 70
if you have the latest antivirus, 71 71
if you have the right security protections in place. 72 72
All of those are things 73 73
that you're now bringing into my network. 74 74
And when you plug into it, 75 75
you are now bringing those vulnerabilities in with it. 76 76
And so this is something you have to think about as well. 77 77
Another concern with bring your own device 78 78
is strained infrastructure. 79 79
Now, what I mean by this is that as a company, 80 80
we're going to build our networks based on the number of users 81 81
and the number of devices we expect to run on it. 82 82
And so if I built my company expecting 50 employees 83 83
and now I have 500 employees, 84 84
and so we start saying, 85 85
"Oh, it's okay, just bring your own devices 86 86
'cause I don't have enough laptops and desktops for you. 87 87
We'll just put up a wifi access point. 88 88
You can connect to that." 89 89
Well, again, that's going to strain the infrastructure 90 90
because that's not going to be enough 91 91
to handle the increased load that we're putting on it. 92 92
So all these extra devices do increase load 93 93
and it becomes something 94 94
that can strain your infrastructure. 95 95
Another thing is forensic complications. 96 96
If you have a data breach 97 97
or you suspect that that device was involved 98 98
with something as part of your instant response, 99 99
are you going to be able to actually look at that 100 100
and go through that device? 101 101
Well, maybe or maybe not, 102 102
because it's not technically a corporate-owned device. 103 103
This is somebody's personal device. 104 104
And so if you want to look at my smartphone, 105 105
well, you're going to have to get my permission. 106 106
And if I don't want to give it to you, 107 107
you can't do the forensic investigation that you want to do. 108 108
And so this becomes another issue 109 109
that you have to deal with. 110 110
And the fifth and final thing we have to think about really 111 111
with bring your own device is what happens 112 112
when that device is lost or stolen. 113 113
Again, this kind of goes back to our deperimeterization. 114 114
If I take that device out of the office, 115 115
now I can't protect it as well. 116 116
And if I leave my smartphone in the back of a taxi cab 117 117
or somebody steals my laptop from my hotel room, 118 118
they now have access to all those files 119 119
that are part of the corporate network 120 120
that are now stored on my system. 121 121
And so these are things you have to think about 122 122
with bring your own device. 123 123
Now, the next area we want to talk about 124 124
is specific mobile platform threats and vulnerabilities 125 125
because there are specific threats 126 126
and vulnerabilities that are associated 127 127
with just using certain mobile platforms. 128 128
Now, most of the time, 129 129
you're going to be using one of two 130 130
mobile operating systems these days. 131 131
It's either going to be Android or iOS. 132 132
And so we're going to talk about both of those in this lesson. 133 133
Now when we talk about Android, 134 134
this is a Linux-based operating system 135 135
that is made by Google. 136 136
Now, the great thing about Android is it's open source, 137 137
so it's really easy for cell phone manufacturers 138 138
to be able to use it, 139 139
and they don't have to pay a licensing fee back to Google. 140 140
So this is something that is very attractive 141 141
and it makes it so it's very widely accepted. 142 142
Because of this, Android has the largest market share. 143 143
There are the most amount of devices out there 144 144
with Android on it. 145 145
And because Android is so popular across the world, 146 146
there's also a larger number of older devices out there, 147 147
because a lot of people will get a device 148 148
that might be two or three or four years old 149 149
and they'll still be using it. 150 150
Now there's no more software updates 151 151
or security patches for it, 152 152
but those older devices are still out there. 153 153
Now, one of the great things about Android 154 154
is it's open nature of the operating system. 155 155
One of the bad things about it is 156 156
it's open nature of the operating system. 157 157
A lot of people like the fact that it's open source 158 158
and that anyone can build for it, 159 159
but that also brings the vulnerabilities 160 160
that anyone can build for it, 161 161
including people who make malware. 162 162
Now, another issue that we have 163 163
is that there is a large usage 164 164
of third party apps on Android. 165 165
Now, unlike iOS devices made by Apple, 166 166
you can actually run third party apps on an Android device. 167 167
You don't have to install apps 168 168
just through Google store, 169 169
the Play Store. 170 170
Instead, you can download any file you want 171 171
from the internet and you can run that on your device. 172 172
That gives you a lot of freedom, 173 173
but it also gives you an exposure to a lot of malware. 174 174
So it's something you have to consider. 175 175
Now, on the other side, we have the Apple devices. 176 176
And if you're running iOS, you're running this on an iPhone. 177 177
In fact, it's the only place you can run iOS, 178 178
because iOS is a closed operating system. 179 179
It's made by Apple and it has to be run on iPhones. 180 180
They will not allow you to run it on any other device. 181 181
So Android can be run on pretty much anything, 182 182
but iOS has to be on an iPhone. 183 183
Now, there's a couple of issues 184 184
when you start dealing with iOS. 185 185
iOS is kind of the opposite of Android, right? 186 186
But because it is a closed operating system, 187 187
a lot of people don't like that. 188 188
And so they like iOS, 189 189
but they don't like the fact 190 190
that they're being told what they can do 191 191
with their own device. 192 192
So they do something called jailbreaking. 193 193
If you're taking your A+, 194 194
you're familiar with this term. 195 195
When you jailbreak a device, 196 196
you essentially are going to remove all of the protections 197 197
that Apple has for you and all of their restrictions. 198 198
So jailbreaking devices 199 199
are actually the largest threat vector 200 200
that's used by attackers, 201 201
because if you jailbreak the device, 202 202
you no longer have the protections and restrictions 203 203
that Apple gives you, 204 204
and that makes you more vulnerable to attack. 205 205
Just because you have an iPhone 206 206
and you haven't jailbroken it, 207 207
it doesn't mean you're safe though. 208 208
There are vulnerabilities associated with Apple devices. 209 209
In fact, a lot of hackers 210 210
go after Apple devices exclusively. 211 211
Why? 212 212
Because a lot of people who use Apple 213 213
tend to be more affluent, 214 214
they have more money, 215 215
so they're a better target to go after 216 216
because if you can get into their devices, 217 217
you can get into their bank accounts 218 218
and other things like that. 219 219
In fact, apple has a huge bounty 220 220
for any zero-day vulnerabilities. 221 221
If you can find a zero-day vulnerability for Apple, 222 222
they'll pay you $1 million, right? 223 223
And so that's something 224 224
that makes a lot of hackers go after it, 225 225
because they're trying to find ways 226 226
into that operating system. 227 227
Now when it comes to Apple devices, 228 228
there are some zero-days out there, 229 229
but generally they cost a lot of money to develop 230 230
or you can buy them from other hackers for a lot of money. 231 231
Generally, you're going to find 232 232
that these zero-day exploits 233 233
are actually used by nation state actors 234 234
and APTs, advanced persistent threats, 235 235
against these high value targets. 236 236
So when I talk about a high value target, 237 237
I don't necessarily mean somebody like me. 238 238
I'm not a high value target, 239 239
but they did use some of these zero-day exploits 240 240
against people like Jeff Bezos, the owner of Amazon, 241 241
to be able to get into his phone 242 242
and be able to get information 243 243
and be able to leak it and make him look bad publicly. 244 244
Also, they might use it to go after government officials 245 245
if they know they're using an iPhone. 246 246
And this doesn't just apply to iPhones either. 247 247
These zero-days could be made for Android, 248 248
but again, they're different operating systems, 249 249
so it would have to be a different zero-day exploit. 250 250
Now the third area of this lesson 251 251
that we want to talk about is mobile device management 252 252
and enterprise mobility management. 253 253
When I talk about MDM or mobile device management, 254 254
I'm talking about the process and supporting technologies 255 255
for tracking, controlling, 256 256
and securing the organization's mobile infrastructure. 257 257
Essentially, it's a way for us 258 258
to oversee all these mobile devices, 259 259
and this works really well 260 260
when your organization owns the devices 261 261
and issues them out to employees, 262 262
because then you can put 263 263
whatever restrictions you want on 'em, 264 264
and MDM allows you to do that. 265 265
Now, if you want to take it a step further, 266 266
you can use something known as EMM, 267 267
which is enterprise mobility management. 268 268
This is a mobile device management suite 269 269
with broader capabilities. 270 270
So it can actually do things 271 271
like identification and application management as well. 272 272
Now you might hear these terms used interchangeably 273 273
or a lot of people are still old-fashion 274 274
and will call it MDM, 275 275
even when they're talking about something that is EMM. 276 276
Either way, we're really talking about the same thing here. 277 277
We're talking about some way to manage and secure 278 278
and do patch management 279 279
and all those things we need to do for those mobile devices. 280 280
Now, as we start talking about the features 281 281
of these MDM or EMM suites, 282 282
there are a handful of them. 283 283
For instance, one of the features is 284 284
to be able to do device enrollment and authentication. 285 285
This way we can know exactly who is using that device 286 286
and who it's been issued to, 287 287
and basically use it as an asset tracking mechanism. 288 288
Another thing we can do is remotely lock and wipe devices. 289 289
So if somebody loses a device, 290 290
they can call their security team or their help desk 291 291
and they can actually go in, lock that device, 292 292
and remotely wipe that data to ensure that it's protected. 293 293
Another thing we can use these for 294 294
is to identify device locations. 295 295
Let's say I lost my phone in the back of a taxi cab. 296 296
I can call the customer service desk 297 297
and they can actually look at my phone 298 298
and its GPS coordinates and say, 299 299
"Oh, that taxi cab is on the corner of Main and First, 300 300
you should go there and get it." 301 301
Another thing you can do 302 302
is you can do patch and deployment management through these. 303 303
So if you have a patch or a software update 304 304
that needs to be pushed out, 305 305
you can do that through these mobile device management, 306 306
and that way you can make sure 307 307
that everybody's got the latest and greatest security 308 308
to make sure that they are going to be using a device 309 309
that is secure 310 310
and keeping your confidential information secure. 311 311
Another thing we also look at 312 312
is being able to prevent root or jailbreaks. 313 313
So as I said, 314 314
jailbreaking your device is going to remove 315 315
a lot of the permissions and restrictions 316 316
that Apple puts on your device if you have an iPhone. 317 317
Well, that also makes you vulnerable to attack. 318 318
So as an MDM, we want to make sure that doesn't happen, 319 319
so we want to make sure jailbreaking is not allowed. 320 320
Another great thing we could do with this type of software 321 321
is we can create encrypted containers for data. 322 322
Now what I mean by this is 323 323
if I have a device like my iPhone that I have, 324 324
I can have a particular part of that that is cordoned off 325 325
and it's a secure container that is created 326 326
and all the data inside of it is encrypted. 327 327
So when I'm using that device to play Angry Birds, 328 328
it's not in that encrypted container, 329 329
but if I'm going in there and looking at student information 330 330
that relates to my business, 331 331
all that information will be in that encrypted container. 332 332
And again, this is another feature 333 333
of these mobile device management 334 334
or enterprise mobility management systems. 335 335
And finally, we can also restrict features and services. 336 336
I just said I was playing Angry Birds on my work phone. 337 337
Do you want me to be able to do that? 338 338
Well, if not, you can actually turn that off and say, 339 339
"You're only allowed to have these 10 applications. 340 340
You can only do these categories of things. 341 341
You can't do games, but you can do productivity. 342 342
You can't use VPNs, but you can use this." 343 343
Those are the things you can do 344 344
by restricting different features and services 345 345
within those apps. 346 346
Now, the final thing you can use MDMs for 347 347
is to manage incidents and conduct investigations. 348 348
So if I'm a support technician, 349 349
I can actually use MDM for that as well, 350 350
because they have the ability to share your screen 351 351
so I can remotely see what you're seeing 352 352
and walk you through those things and help you through that. 353 353
You learned about that all the way back in A+. 354 354
Now, if we're doing an investigation, 355 355
because we have a data breach or something else, 356 356
we could track that device in every place it's been 357 357
physically in the world based on its GPS, 358 358
as well as what it's connected to based on the IP addresses 359 359
and the different networks it's connected to, 360 360
and all that can be stored and rolled up and passed to us 361 361
through those MDM systems. 362 362
And so we can take all that information 363 363
into a central database, something like a seam, 364 364
and be able to use that 365 365
as part of our larger instant response efforts.