© 2012 S-Generation Co., Ltd. © 2012 S-Generation Co., Ltd.

“การรกษาขอมลขององคกรทอยในอปกรณพกพาสวนตวของพนกงาน” by

Chaiyakorn Apiwathanokul CISSP, CSSLP, GCFA, (ISC)2:ISLA, (IRCA:ISMS)

CEO S-Generation, TISA Committee

31 January 2012

“Unleashing The Power of Mobility Securely”

© 2012 S-Generation Co., Ltd.

Where is your business data?

Personal Devices

Corporate Data/App

Where to draw the line?

76% of smartphone and tablet users access business information on their mobile devices. Source: globalthreatcenter.com

© 2012 S-Generation Co., Ltd.

Mobile Phenomenon

Source: IDC, Gartner, Morgan Stanley Research

© 2012 S-Generation Co., Ltd.

Mobile Phenomenon

Things that you can’t avoid and MUST have strategy to deal with.

• Consumerization [Mobile + Cloud] – Means consumer first then enterprise

– Previously, IT start from IT department and push users to utilize it

– Now, it starts from the users and demand IT department to support it

• BYOD: Bring Your Own Device – Multiple platforms

– Manageability

© 2012 S-Generation Co., Ltd.

Facts about Consumerization

Source: Cesare Garlati @ Trend Micro

600 surveys US, DE, JP June 2011

Does your company allow employees to use their personal devices for work-related activities?

© 2012 S-Generation Co., Ltd.

Facts about Consumerization

Source: Cesare Garlati @ Trend Micro

600 surveys US, DE, JP June 2011

© 2012 S-Generation Co., Ltd.

Personal Devices Used for Work

© 2012 S-Generation Co., Ltd.

© 2012 S-Generation Co., Ltd.

Facts about Consumerization

Source: Cesare Garlati @ Trend Micro

600 surveys US, DE, JP June 2011

© 2012 S-Generation Co., Ltd.

Take The Balance

SECURITY Business

Enablement

Security Risk IT Risk Business Risk

© 2012 S-Generation Co., Ltd.

ตวอยางขอมลส าคญ (สวนตว)

• หมายเลขบตรประจ าตวประชาชน • วน เดอน ป เกด • ทอย/เบอรโทรศพท • สมดโทรศพท • หมายเลขบตรเครดต • วงเงนบตรเครดต • เลขทบญชธนาคาร • ภาพถาย วดโอคลป • ขอมลสขภาพ/ประวตการรกษาพยาบาล • ขอมลการแพยา • Password • Email account • eBanking account • Stock trading account

© 2012 S-Generation Co., Ltd.

ตวอยางขอมลส าคญ (องคกร)

• ขอมลการเงน

• ราคา/ตนทน

• ยอดขายสนคา

• Proposal/Quotation/Order/Invoice

• ฐานขอมลลกคา

• แผนกลยทธ

• แผนการตลาด

• ขอมลโครงการ

• ขอมลเงนเดอน

• ขอมลประวตบคคล

• ทรพยสนทางปญญา

• ความลบทางการคา (Trade secret)

• Corporate user account

© 2012 S-Generation Co., Ltd.

ผลกระทบ

ตนเอง • อบอาย

• เสยชอเสยง

• เสยความเปนสวนตว

• ถกเอาเปรยบ

• ถกกลนแกลง

องคกร • เสยภาพพจนชอเสยง

• เสยประโยชน

• เสยความไดเปรยบทางการคา

• เสยลกคา

• เสยรายได

• ถกปรบ

• เสยความนาเชอถอ

© 2012 S-Generation Co., Ltd.

Risk = Threat x Vulnerability

Threats

• Business competitor

• Intellectual property

• Cyberwarfare

• Intelligence

• Black market

• Politics

• Criminal

• Insider

• BOTNET

• APT

Vulnerabilities

• ORG – No policy

– No standard/guideline

– No control

• Technology – OS

– App • Insecurely developed

• Intentionally malicious

– Retrievable SIM

– Unencrypted data

• Human – Lack of awareness

© 2012 S-Generation Co., Ltd.

Mobile OS Vulnerabilities

© 2012 S-Generation Co., Ltd.

Mobile Spyware Features

• Call Log

• Each incoming and outgoing number is logged along with duration and time stamp. SMS (Text Messages) Log

• Every text message is logged even if the phone's logs are deleted. Includes full text. GPS Locations Log

• GPS postions are uploaded every thirty minutes with a link to a map. Contacts

• Every contact on the phone is logged. New contacts added are also recorded. Tasks

• All personal tasks that are created are logged and viewable. Memos

• Every memo input into the phone is logged and viewable.

• Cell ID Locations

• ID information on all cell towers that the device enters into range of is recorded. E-Mail Log

• All inbound & outbound email activity from the primary email account is recorded. Calendar Events

• Every calendar event is logged. Date, time, and locations are recorded. URL (Website) Log

• All URL website addresses visited using the phone's browser are logged. Photo & Video Log

• All photos & videos taken by the phone are recorded & are viewable.

© 2012 S-Generation Co., Ltd.

What researcher said?

In 2012 there will be a rise in targeted attacks, where the mobile device is used as a conduit to steal corporate intellectual property.

Source: BIT9 REPORT THE MOST VULNERABLE SMARTPHONES OF 2011

© 2012 S-Generation Co., Ltd.

© 2012 S-Generation Co., Ltd.

You Need …

• Vision

• Knowledge

• Policy

• Strategy

• Technology

It’s not just how to secure it. It’s how to unleash the power of

mobility securely.

© 2012 S-Generation Co., Ltd. © 2012 S-Generation Co., Ltd.