All right, mobile application management.
Okay, mobile device management in general is a necessity.
If you want to properly secure mobile devices, generally out of the box, you're
not going to have nearly the granularity of security configurations that you like
or easily administered, especially when employees are using their own devices.
So MDM provides platforms for over the air
or wired distribution of applications, data, configuration settings for all types
of mobile devices, mobile phones, smartphones, tablets, etc.
You'll be doing a lab on mobile device management, so you get a feel for that.
It falls into a couple subcategories.
Mobile application management, mobile
content management, which are again, control, distribution, deployment,
updating of applications, content, the actual data.
Solutions to safeguard content or data of mobile devices,
control and secure organizational data, mobile application management.
Now, a lot of times this stuff will be wrapped into a single unified solution.
Sometimes they may be separate solutions.
Context or authentication.
Little bit out of the category here of the flavors of mobile device management, but
context aware location does use the contextual information of a user
like geolocation, identity and behavior for enhancing security decisions.
When you are authenticating to corporate
network, you can use things like location tracking, geo fencing to be sure that
you're within a secure perimeter or something along those lines.
This is also an example of a different type after hours access control.
It doesn't necessarily apply just to mobile devices.
It could also apply to really any telecommuter using...
Man, that goes back to call back dial up options.
It could also use IP addresses.
Mobile email management offers secure access to organizational
email infrastructure and data on the employee's mobile devices.
Mobile security, actions and precautionary steps for securing organizational devices.
Enterprise mobility tools and technologies
used to secure the data and BYOD in organizational devices.
We're going to pick apart BYOD in possibly
some better options than just straight employees using their own devices.
Couple of company own solutions, we'll talk about that here in just a second.
Remote wipe, really important.
Remote wipe allows you to track and
remotely clear the device if it's ever physically lost.
One time in my history, if I misplaced a phone, and we're actually coming back from
vacation, we're at Miami International Airport.
When I get on a plane, I put my phone down under my leg and I typically fall asleep.
So this time, wake up, a rush, a little disoriented, just woke up.
We had to catch a connecting flight and I left my phone on the plane.
Figured out about halfway across the airport, no way I'm going back for it.
So we'll just check that off as being lost.
And I could not wait to get home and get
on the computer and use the Find My iPhone application, wipe that thing.
And it had left the airport.
So that location track and what wiped, it goes a long way.
If your device is lost or stolen, it's
just a matter of time before somebody dumps it with a forensic utility.
Now, encryption and all that goes a long
way, but there's lots of forensic acquisition utilities for dumping the
contents of those devices, especially if it is routed or jail broken.
So we'll talk about some pros and cons to routing and jailbreaking.
I've got a policy now, no routed devices.
We'll talk about that here in a little bit in a second.
Mobile device management continued.
Screen lock.
Screen locks should be set after a period of inactivity.
Secure data, prevent illegal access by perpetrators.
You should not have a swipe to unlock screen lock.
That defeats the purpose of having a screen lock.
You should utilize passwords and pins
which protect private data in organizations, stored on the device.
I think we're all pretty familiar with what passwords and pins are.
Passwords are better than pins.
Pins like a four digit pin has a relatively small key space and you may be
able to guess pretty easily birth dates, things like that.
People have a tendency to use this pins.
Passwords, way more secure.
But really, every time I pick up my phone, I'm going to type in a password.
That thing shuts off all the time, and every time I check my phone, instead of my
biometric, I'm going to type in a password.
So biometrics, great solution.
Love that.
The swipe to unlock and all that horrible idea.
The swipe patterns, those are actually fairly easy compromise.
You can actually look at oils on the screen, things like that.
Biometrics, great option.
As long as it's biometrically accurate.
But fingerprint readers love that.
Push notification services.
Speak a little bit more on biometrics.
Probably the most commonly used is fingerprint.
We're seeing a lot more facial recognition.
My wife's phone, she's got an iPhone.
I'm still an Android guy.
It's got a pretty solid facial recognition on it.
I'm still the Android guy.
Actually due for an upgrade like I just
mentioned here, I'm still rocking the Pixel 3 and it's time for a change.
I'm looking forward to playing around a
little bit with the biometric authentication of that device.
Push notification services, messaging
feature that allows you to push out updates, delivery of data messages from an
application without any explicit request from the user.
We have to remember when push notifications weren't even a thing on
earlier iPhones for checking email, things like that.
Come a long way since 2008.
2007?
2007.
Mobile device management. Continued.
Geolocation. Technology that can identify the real
world geographic location, which can be based on GPS or it can be
based on IP or it can be based on cell phone towers.
Geofencing, virtual fence positioned at a specific location, interacts with mobile
users whenever they cross the fence, helps marketers gather sensitive data and
information about users' offline activities from location data.
Pretty much every app you install on your phone does that.
Full device encryption, very important.
Our right, so couple of scenarios.
Full device encryption, security feature that can be used to encrypt all the
information stored on any storage medium within a mobile device that goes a long
way for physically attacking the storage device.
How do you get However, if you're booted up and it's a routed device, then
a lot of times you can just dump it right from a USB cable.
I'll give you a quick example.
I always was of the opinion that the first
thing you do to a new mobile device is you jailbreak it or you root it because that's
what you do because it gives you full control over the device you own and remove
manufacturer bloatware and install cool utilities that you couldn't use otherwise.
I remember the day when I was driving
around in my car with my iPhone 3 at that point, FaceT iming over 3 G.
It couldn't get any better than that, right?
Because I had jail broken it.
I installed the utility from the city app marketplace.
It gives you features and functionality you don't normally have,
but at the same time, it removes a lot of security on the device.
Not only does it make through the file system available to you, the end user, it
also makes all of the device functionality available to malware as well.
Up through my Galaxy Note 3, I routed all
my Android devices, and primarily it was so I could get free WiFi tethering.
I'm just going to say that loud because it's been times passed, I think.
Now I get free WiFi tethering anyway, so there's not a lot of reason to.
My eyes age more and I'm 51 now.
As I look at things, I need reading
glasses and I'm probably not going to install a bunch of hackers security tools
on my device, terminals and things like that.
I just lost the reason to root it.
Others definitely have reasons for it anyway.
There are some cons to root it, but my last rooted phone, I've actually got an
example dump that I deliver in forensics class where I used to use totally called
Andriller and the device was locked, lock screen and all I did was plug in the USB
cable and I dumped everything off that device.
Full report, WiFi passwords, Google Chrome
history, the whole ball of wax from a routed device.
So if the device is routed or jail broken,
even if encryption is enabled, you're still logged into it.
You still have access.
So full device encryption should definitely be implemented.
It'll protect against a device that's been compromised and you're using a dumping
utility or something like that without the actual encryption key.
So big proponent of device encryption without a doubt.
But there are some situations where you
still have some security issues with it, depending on your access to the device.
I think I beat that to death.
So containerization.
We've already talked about containers, but containerization in this context,
technique in which all personal organizational data is segregated on the
employee's mobile device helps improving the security of organizational data.
So when you container and you lock things up in a separate compartment, it's easier
to secure rather than things being just littered throughout the file system.
Ota updates.
Method of delivering updates for
applications, firmware, and time zone rules to a mobile device.
Any over the air is something you could push down automatically.