http://m.darkreading.com/133696/show/a7ce08c4d45a3aa5d9ef63afde05c0cc/
By: Nima Zahadat
Tuesday, April 30, 2013
Monday, April 29, 2013
Articles suggested by Rick Tracy
http://fcw.com/Articles/2013/04/26/byod-managing-devices-not-enough.aspx?Page=1
http://www.scmagazine.com/panel-expect-productivity-gains-with-byod/article/290469/
By: Nima Zahadat
http://www.scmagazine.com/panel-expect-productivity-gains-with-byod/article/290469/
By: Nima Zahadat
Meeting with Richard Tracy of Telos
Today I went to see Rick Tracy at Telos and discuss mobile security
in
hopes of narrowing down my topic. Rick was very helpful and talked very
intelligently about the subject matter. He also emailed some of his
contacts, two of whom have responded already and offered to help me
out. Rick also handed me a copy of today's Washington Post which had an
article on Mobile Security. I plan on reading it. Here is some of
what I remember him talking about:
- Containerization versus usability
- With Containerization security is built in
- Unlike desktops and laptops, mobile devices do not have well defined security boundaries
- Containerization is safer but brings about usability issues and high overhead
- If containerization is not used, a VPN is typically used which while securing communication, allows malicious programs to also use the VPN
- An organization has to ask what is their tolerance for risk when dealing with mobility?
- Consumerization of IT meaning that businesses are scrambling to decide what to do with consumer products that are coming out (Pads and Smartphones) as they want to use them more and more
- A lot of organizations have mobile devices because it is more efficient
- Many have them just for the image it projects or sophistication
- There are no best solutions yet for mobile security
For this last point, Rick pointed out something great. He mentioned that with mobile security, the goal is to iPhone it. What he meant was that iPhone changed the the way phones are used and people think of phones for good. A technology has to come along that does away with all other bits and pieces of security as they relate to mobile security and is so comprehensive that everyone uses it by default.
Telos according to Rick relies on
- Policy
- Education
- Devices that supports complex passwords and full encryption
For every 50 developers, Telos has one security coach who is also a developer. This person is responsible to coach the other developers (and monitor them) in their code so that security is not an afterthought but integrated in the code they produce.
By: Nima Zahadat
- Containerization versus usability
- With Containerization security is built in
- Unlike desktops and laptops, mobile devices do not have well defined security boundaries
- Containerization is safer but brings about usability issues and high overhead
- If containerization is not used, a VPN is typically used which while securing communication, allows malicious programs to also use the VPN
- An organization has to ask what is their tolerance for risk when dealing with mobility?
- Consumerization of IT meaning that businesses are scrambling to decide what to do with consumer products that are coming out (Pads and Smartphones) as they want to use them more and more
- A lot of organizations have mobile devices because it is more efficient
- Many have them just for the image it projects or sophistication
- There are no best solutions yet for mobile security
For this last point, Rick pointed out something great. He mentioned that with mobile security, the goal is to iPhone it. What he meant was that iPhone changed the the way phones are used and people think of phones for good. A technology has to come along that does away with all other bits and pieces of security as they relate to mobile security and is so comprehensive that everyone uses it by default.
Telos according to Rick relies on
- Policy
- Education
- Devices that supports complex passwords and full encryption
For every 50 developers, Telos has one security coach who is also a developer. This person is responsible to coach the other developers (and monitor them) in their code so that security is not an afterthought but integrated in the code they produce.
By: Nima Zahadat
Tuesday, April 23, 2013
ISACA
Became an ISACA member today. It is short for Information Systems Audit and Control Association. Between ISSA, ISACA, IEEE, ACM, and KMA, I hope to meet enough people to help me with my research direction and also support me in locating good articles and research material.
By: Nima Zahadat
By: Nima Zahadat
ISSA social networking meeting Rosslyn
Today I went to my second ISSA meeting which was for social networking. I met Leonard, Scott, Berkley, and Dr. Ron Ross who works at NIST. Dr. Ross is a security guru who puts out many of the NIST standards. I introduced myself and told him what I am doing for my PhD briefly. He gave me his email and asked me to email him and exchange contact info. I did just that and hope to hear from him. Leonard was a member and gave me a talk on mobile point-to-point encryption and agreed to send me contact info of some people in the field. Scott was helpful and in fact he is the one who pointed out Dr. Ross to me. I am hoping for some leads. This Monday I will be meeting with Rick Tracy at Telos and on Tuesday will be talking to Diana Burley from GW who is a security guru. Rick is also a security expert with focus on software development including security integration. There are other associations named ISACA and IAA or IIA (not sure). I might join them too and start this networking business more actively. It might workout well.
By: Nima Zahadat
By: Nima Zahadat
Sunday, April 21, 2013
ISSA email
Got an email from the ISSA that my topic is a hot topic and much in demand. He and I as well as other members will be discussing it later and I hope to narrow down the topic as requested by the panel and get going. Here is his email:
Nima,
... Mobile security is a hot topic and would be a good basis for your research. Traditional PCs and laptops are on the way out, replaced by mobile smart phones and tablets.
...
By: Nima Zahadat
Nima,
... Mobile security is a hot topic and would be a good basis for your research. Traditional PCs and laptops are on the way out, replaced by mobile smart phones and tablets.
...
By: Nima Zahadat
Progress Sunday April 21, 2013
I read the following journal today:
Securing Enterprise Mobile Information
The journal was very new (2012) and discussed an outline for planning security for mobile devices though I got the impression it was an add-on to an existing network security policy. It discussed using ISO 17799 standards for developing the needed policies for mobile security. It further discussed designing policies that are in line with federal and local laws as pertaining to security and privacy. This is a good journal that I will be using further. Many great resources were mentioned including ISO 17799 and NIST.
I also finished chapter 1 of the Management of Information Security book. It discussed project management techniques with emphasis that security management is more challenging and requires additional steps, policies, expenses, tools, and training.
By: Nima Zahadat
Securing Enterprise Mobile Information
The journal was very new (2012) and discussed an outline for planning security for mobile devices though I got the impression it was an add-on to an existing network security policy. It discussed using ISO 17799 standards for developing the needed policies for mobile security. It further discussed designing policies that are in line with federal and local laws as pertaining to security and privacy. This is a good journal that I will be using further. Many great resources were mentioned including ISO 17799 and NIST.
I also finished chapter 1 of the Management of Information Security book. It discussed project management techniques with emphasis that security management is more challenging and requires additional steps, policies, expenses, tools, and training.
By: Nima Zahadat
Saturday, April 20, 2013
Journals read today
I started by reading "Framework for Security Management of Mobile Devices" but the English was so bad that I gave up after the first couple of paragraphs. Then I read
Multi-Layered Collaborative Approach to Address Enterprise Mobile Security Challenges
which ended up being excellent. This is for far the closest thing to my research topic. The authors discussed the various shortcomings of today's security for mobile devices and then delved a little deeper to offer an overview of a framework covering various aspect of mobile security in an enterprise. They acknowledge that one model does not fit everything but give a starting point for designing a framework. Their example was focused on Blackberry. I like to focus on iPhone and Android as Blackberry is being phased out. Their model needs to be modified and extended to do what I want and this might just be the starting point for my research.
The other journal I managed to read
Risk Based Mobile Access Control (RiBMAC) Policy Framework
was also excellent. Somewhat confusing which means I have to read it again. This journal though, is recent (2011) and it discussed how due to lack of physical security, mobile devices cannot use traditional security policy frameworks. It suggests the use of risk based adaptive security policy framework approach. Since mobile devices are accessed by generally one individual and should they be lost or stolen, all the data and apps are in danger, a risk based security approach is the best solution, the paper argues. Based on the threat type, the location, the time, and the value of possible data on the device (combined risk), different policies can be applied to the device remotely. I found the article interesting and since the authors work at the Naval Research Lab in DC, I have emailed them to see if they are willing to sit with me and discuss this further to help my dissertation.
By: Nima Zahadat
Multi-Layered Collaborative Approach to Address Enterprise Mobile Security Challenges
which ended up being excellent. This is for far the closest thing to my research topic. The authors discussed the various shortcomings of today's security for mobile devices and then delved a little deeper to offer an overview of a framework covering various aspect of mobile security in an enterprise. They acknowledge that one model does not fit everything but give a starting point for designing a framework. Their example was focused on Blackberry. I like to focus on iPhone and Android as Blackberry is being phased out. Their model needs to be modified and extended to do what I want and this might just be the starting point for my research.
The other journal I managed to read
Risk Based Mobile Access Control (RiBMAC) Policy Framework
was also excellent. Somewhat confusing which means I have to read it again. This journal though, is recent (2011) and it discussed how due to lack of physical security, mobile devices cannot use traditional security policy frameworks. It suggests the use of risk based adaptive security policy framework approach. Since mobile devices are accessed by generally one individual and should they be lost or stolen, all the data and apps are in danger, a risk based security approach is the best solution, the paper argues. Based on the threat type, the location, the time, and the value of possible data on the device (combined risk), different policies can be applied to the device remotely. I found the article interesting and since the authors work at the Naval Research Lab in DC, I have emailed them to see if they are willing to sit with me and discuss this further to help my dissertation.
By: Nima Zahadat
Friday, April 19, 2013
Journals read so far
Managed to read two journals today:
1. A Distributed Hierarchical Policy Management System for Security Control over Tachtical obile Ad Hoc Networks
This journal focused on using simulation to create a design for the Army for their use of ad hoc mobile networks. It discussed that mobile ad hoc networks are new and do not fall neatly in place with the use of protocols such as TCP. The authors suggest that since ad hoc networks are dynamic with a high rate of data loss, a new approach is needed to secure the ad hoc mobile networks including recovery from an attack. They suggest using Reliable UDP (RUDP) for the normal operation of the network and using flooding when recovering from an attack. Overall, I found the topic interesting but lacking a more universal appeal.
2. Enabling Mobility in Enterprise Security Management
This paper discussed using mobile devices to administer networks remotely. I must say it sounds pretty interesting. The authors take the approach of comparing traditional remote web administration and remote desktop administration and their benefits and shortcomings; next, they move into the realm of using mobile devices to securely administer servers and devices remotely pointing out the many benefits. The article is 6-7 years old considering they use a Dell handheld for mobile device and also point out that due to mobile devices being new, not many viruses exist for them. Nevertheless, their approach was well outlined and communicated. The authors discussed modeling their approach on the ISO 17799.
By: Nima Zahadat
1. A Distributed Hierarchical Policy Management System for Security Control over Tachtical obile Ad Hoc Networks
This journal focused on using simulation to create a design for the Army for their use of ad hoc mobile networks. It discussed that mobile ad hoc networks are new and do not fall neatly in place with the use of protocols such as TCP. The authors suggest that since ad hoc networks are dynamic with a high rate of data loss, a new approach is needed to secure the ad hoc mobile networks including recovery from an attack. They suggest using Reliable UDP (RUDP) for the normal operation of the network and using flooding when recovering from an attack. Overall, I found the topic interesting but lacking a more universal appeal.
2. Enabling Mobility in Enterprise Security Management
This paper discussed using mobile devices to administer networks remotely. I must say it sounds pretty interesting. The authors take the approach of comparing traditional remote web administration and remote desktop administration and their benefits and shortcomings; next, they move into the realm of using mobile devices to securely administer servers and devices remotely pointing out the many benefits. The article is 6-7 years old considering they use a Dell handheld for mobile device and also point out that due to mobile devices being new, not many viruses exist for them. Nevertheless, their approach was well outlined and communicated. The authors discussed modeling their approach on the ISO 17799.
By: Nima Zahadat
Topic drilldown ideas
What should I focus on in Mobile Security Policy Management? I am jotting down ideas:
-Mobile app development security policy and management
-Using mobile devices to administer networks, a security policy management design
-Mobile devices security policies
-policy management regarding mobile devices secure communication
-managing security with regards to lost/stolen mobile devices
-Unified application integration between mobile devices and desktop devices
-This would include contacts, emails, calendars, and any other enterprise-wide application
-policy management regarding viruses/worms/rootkits attacking mobile devices of the organization
By: Nima Zahadat
-Mobile app development security policy and management
-Using mobile devices to administer networks, a security policy management design
-Mobile devices security policies
-policy management regarding mobile devices secure communication
-managing security with regards to lost/stolen mobile devices
-Unified application integration between mobile devices and desktop devices
-This would include contacts, emails, calendars, and any other enterprise-wide application
-policy management regarding viruses/worms/rootkits attacking mobile devices of the organization
By: Nima Zahadat
Book: Management of Information Security
I have begun reading this book; it seems to be excellent and I am hoping it will guide me throughout my research.
By: Nima Zahadat
By: Nima Zahadat
CISSP Prep
I have started studying for CISSP in an attempt to get more focused on security policy management. ISSA also offers CISSP workshops where people get together and discuss the 10 domains. If it wasn't for this silly time table of December 2013 deadline for our conference, I think I would be doing a lot better.
By: Nima Zahadat
By: Nima Zahadat
Thursday, April 18, 2013
First ISSA meeting at Oracle
Attended the first ISSA meeting tonight. It was really good. I met some people and they told me they were willing to help me narrow down my topic or even pick another topic. I will be contacting them to see. New topic came to my mind: developing a security policy framework for cloud computing so that the framework is created once but used many times for private corporations or perhaps for universities. In other words how can a private organization's security policies be met by cloud companies including SaaS, PaaS, and Storage while meeting needed security policies. The idea is to have a universal security policy framework that must be adhered to but one that is extensible. I have to think about it some more.
By: Nima Zahadat
By: Nima Zahadat
Sunday, April 14, 2013
PhD topic idea
My first topic which related to designing a system for online delivery of technical subjects was killed by the panel as being more education related than engineering. Dr. Mazzuchi suggested picking a topic in Information Systems Security Policy Management.
I decided to go for Mobile Security Policy Management. Initially I defined "Mobile" as laptops, notebooks, tablets, and smartphones but have since decided to limit it to tablets and smartphones. My topic is to analyze why mobile security is an after thought to the overall security in most organizations. In other words, mobile security is not integrated in the overall security policy of most organizations (if any) and is generally band-aided later on. Further, mobile app security is not an integrated part of mobile app development. My goal is to identify such shortcomings and propose a framework for integrating mobile security through out the overall security policy of an enterprise for a more complete security policy management.
By: Nima Zahadat
I decided to go for Mobile Security Policy Management. Initially I defined "Mobile" as laptops, notebooks, tablets, and smartphones but have since decided to limit it to tablets and smartphones. My topic is to analyze why mobile security is an after thought to the overall security in most organizations. In other words, mobile security is not integrated in the overall security policy of most organizations (if any) and is generally band-aided later on. Further, mobile app security is not an integrated part of mobile app development. My goal is to identify such shortcomings and propose a framework for integrating mobile security through out the overall security policy of an enterprise for a more complete security policy management.
By: Nima Zahadat
Subscribe to:
Posts (Atom)