Thank you for joining. We will begin shortly. Securing Mobile Devices for BYOD Environments Nate Kaminski Joe Yeager [email protected] [email protected] Can you hear me? NO… 1. Turn on/up the volume on your computer speakers - or 2. Teleconference into the webcast a. Tick the ‘Request’ box under the ‘Participants’ panel on the right hand side of your screen Participant Agenda Introduction Mobile Device Fast Facts The BYOD Problem “Solutions” to BYOD Lancope Solution to BYOD Conclusion 3 What is BYOD? 4 Mobile Device are Here to Stay According to IDC estimates, mobile devices will outship PC’s in 2012 by more than 2 to 1 and mobile device spending will exceed PC spending, growing 4 times as fast. 1 Aberdeen estimates nearly 75 percent of companies currently allow employee-owned smartphones and/or tablets to be used at work. 2 Garter finds that 90 percent of organizations will support corporate applications on personal devices by 2014. 3 5 1: http://events.idc-cema.com/dwn/SF_52232_top_10_preditions_2012.pdf 2: http://www.itworld.com/mobile-wireless/151839/75-enterprises-have-byod-policies-53-support-ipads 3: http://www.gartner.com/it/page.jsp?id=1480514 2: 4X 1 90 75 % % Shipping Spending Work Use Corp Apps Organizations should embrace BYOD According to the Cisco Connected World Technology Report, 1 – 40% of college students would accept a lowerpaying job that had flexible IT – 70% of young workers ignore IT rules ISACA has found through surveys that – Almost half of young professionals use their own personal device at work. 2 – Over half of all IT leaders in the U.S. say that employee-owned mobile devices pose a greater risk to the enterprise than mobile devices supplied by the company. 3 6 1: http://www.cisco.com/en/US/netsol/ns1120/index.html 2: http://www.isaca.org/Pages/Survey-Online-Shopping-Risks-2011.aspx 3: http://www.isaca.org/Pages/Survey-Risk-Reward-Barometer.aspx The “BYOD Problem” Most organizations have… Scarce knowledge of what the device, operating system, or patch level is Limited control over policy for what resources device can and cannot access Incomplete information about whose device it is Lack of visibility into what the device is doing on the internal network and how confidential data is moving around Little understanding of the impact of the device on the network 7 BYOD: Proposed Solutions by the Security Industry Say No to BYOD BYOD is here whether you embrace it or not Install more network probes Not a cost-effective nor scalable solution BYOD REQUIRES You have limited control Install agents on the devices A DIFFERENTover the employee’s device Convert the device APPROACH Don’t forget the Your Own part of BYOD to a corporate one Network Security Monitoring Using the Network 3560-X Internet Atlanta ASR-1000 San Jose WAN 3925 ISR Cat6k Cat6k ASA New York Datacenter Cat4k DMZ Access UCS with Nexus 1000v 9 3750-X Stack(s) Cisco Infrastructure Provides the Intelligence... 3560-X Internet Atlanta NetFlow ASR-1000 NetFlow San Jose NetFlow WAN 3925 ISR NetFlow NetFlow Cat6k NetFlow New York NetFlow ASA DMZ NetFlow Datacenter UCS with Nexus 1000v Cat6k NetFlow NetFlow NetFlow NetFlow NetFlow Cat4k Access NetFlow NetFlow NetFlow 10 3750-X Stack(s) Internal Visibility from Edge to Access... 3560-X Internet Atlanta ASR-1000 San Jose WAN 3925 ISR ASA New York Datacenter UCS with Nexus 1000v Cat6k Cat6k Cat4k DMZ Access Lancope NetFlow Collector 3750-X Stack(s) StealthWatch – A Complete, Integrated Family of Products Behavior-based flow monitoring Contextual awareness – – – – 12 Identity Device Application Virtual The Concern IndexTM Relational Flow MappingTM Point of ViewTM Advanced Querying & Reporting StealthWatch Management Reporting Custom Dashboards Security Monitoring Relational Flow Maps Network Performance Monitoring Forensics Anomaly Detection Troubleshooting Service Delivery Compliance Mitigation WAN Optimization Capacity Planning DEVICE AWARENESS APPLICATION AWARENESS IDENTITY AWARENESS VIRTUAL AWARENESS Behavioral Analysis Flow Collection StealthWatch Answers The Tough Questions StealthWatch can show you… 13 Who owns the device What the device is doing Where the device is on the network When the device was on the network How the device is impacting the network StealthWatch Monitors BYOD Environments Monitors the entire internal network by passively collecting data from existing infrastructure and does not use agents, install software, or in any way modify the employee’s device. StealthWatch monitors and records everything that every user on any device running any operating system is doing on the network and how the network is affected by the user’s actions. Utilizing patented behavioral analysis techniques, StealthWatch determines whether any device is acting suspiciously, is accessing privileged resources outside of its policy. 14 Behavior-based Analysis Critical Servers 15 Mobile phones Tablet computers Marketing To Enable Early Interjection BEFORE Crisis Impact to the Business ( $ ) vulnerability closed attack identified credit card data compromised StealthWatch Reduces MTTK attack onset * * early warning * attack identified * * * * CRISIS REGION attack thwarted * Time vulnerability closed Company with StealthWatch Company with Legacy Monitoring Tools StealthWatch: The Solution for BYOD Environments Network activity is correlated with user and device information along with physical location on the network And you can also start with the user or device you are looking for and look at its network activity StealthWatch: The Solution for BYOD Environments And can drill down to the exact flow: 18 StealthWatch: The Solution for BYOD Environments Including which devices in the network it crossed: 19 Quick Recap • BYOD is already here Embrace it • Other solutions do not meet the needs of BYOD Prevent BYOD Install agents Change the device Install more network probes • With StealthWatch you can gain visibility into every device on your network Using your existing infrastructure Answer the tough who, what, where, when, why, and how questions • Once you’ve enabled flow collection you can... Gain deep traffic analysis and network visibility Detect attacks and network anomalies 20 Next Steps Visit Lancope @ Blackhat for a live demo of the StealthWatch System & pickup your free copy of “NetFlow Security Monitoring for Dummies” book. Contact Lancope: Joe Yeager [email protected] Lancope [email protected] Lancope Marketing [email protected] 21 Questions Web http://www.lancope.com Blog http://netflowninjas.lancope.com Twitter @netflowninjas LinkedIn : NetFlow Ninjas http://www.linkedin.com/groups?about=&gid=2261596&trk=anet_ug_grppro NetFlow Ninjas Challenge http://www.lancope.com/netflow-ninja-quiz 22 Webinar with Forrester Research 23 ©2012 Lancope , Inc. All Rights Reserved.