BYOD: A Mobile
Security Model (Framework?) for organizations
Balance between Management
of Technology and Management of Policy
A Risk Analysis and Policy Management approach
Friday, May 3, 2013
Notes from talk with Dr. Ron Ross at NIST
Mobile security just now finding its own way
Both a technical and policy problem
1. What kinds of controls can be placed on these devices?
2. Which controls can we legitimately place on these devices
-For instance virus scan takes a lot of battery power (technical issue)
-policy issues: some level of risk if proper controls are not placed
-Policy management: if you need certain access, you must have the proper access level (type of account)
-Not giving privilege accounts to someone who shouldn't have it
(These areas are pretty wide open according to Dr. Ross)
-Mobile security: who you are, where you are, and what type of data you want to access
-Dissertation will be a combination of technology and policy; they cannot be separated
-Policies, people, and technologies all work together
-There is no perfect security
-Dissertation focus on types of security controls that typically implemented on a device with
focus on people, policies, and technology
-Policies and technologies are mutually reinforcing
-Advisers should be excited in your topic; they must be supportive during the whole process
Everyone is struggling with mobile security policy space. Lot of folks not doing due diligence.
Opening a lot of holes in security. 95% of Android OS had evidence of malware and tampering (CIA).
Failure is both in policy and technology. Look at different types of policies orgs can have.
Lot of issues: white listing and black listing of executables as an example
Configuration settings
Ids and authorizations
When you don't do two factor auth what are the risks on mobile devices
Perhaps your contribution can be defining the balance between technology and policy (adequate security which is their tolerance
for risk; some allow BYOD and some won't etc.). Crafting your own solution/model in this area.
Next step: flush it out. Create a high level outline. Try to find out as much as you can.
Put your ideas down. Write a 2-4 page outline. Introduce the problem; research and history
of whatever is going on up to this point (literature review). This maps out the dissertation.
Must be very clear in your mind. Come up with some conclusions you are going to publish.
Make a case through your dissertation what you are proposing.
Post by: Nima Zahadat
Both a technical and policy problem
1. What kinds of controls can be placed on these devices?
2. Which controls can we legitimately place on these devices
-For instance virus scan takes a lot of battery power (technical issue)
-policy issues: some level of risk if proper controls are not placed
-Policy management: if you need certain access, you must have the proper access level (type of account)
-Not giving privilege accounts to someone who shouldn't have it
(These areas are pretty wide open according to Dr. Ross)
-Mobile security: who you are, where you are, and what type of data you want to access
-Dissertation will be a combination of technology and policy; they cannot be separated
-Policies, people, and technologies all work together
-There is no perfect security
-Dissertation focus on types of security controls that typically implemented on a device with
focus on people, policies, and technology
-Policies and technologies are mutually reinforcing
-Advisers should be excited in your topic; they must be supportive during the whole process
Everyone is struggling with mobile security policy space. Lot of folks not doing due diligence.
Opening a lot of holes in security. 95% of Android OS had evidence of malware and tampering (CIA).
Failure is both in policy and technology. Look at different types of policies orgs can have.
Lot of issues: white listing and black listing of executables as an example
Configuration settings
Ids and authorizations
When you don't do two factor auth what are the risks on mobile devices
Perhaps your contribution can be defining the balance between technology and policy (adequate security which is their tolerance
for risk; some allow BYOD and some won't etc.). Crafting your own solution/model in this area.
Next step: flush it out. Create a high level outline. Try to find out as much as you can.
Put your ideas down. Write a 2-4 page outline. Introduce the problem; research and history
of whatever is going on up to this point (literature review). This maps out the dissertation.
Must be very clear in your mind. Come up with some conclusions you are going to publish.
Make a case through your dissertation what you are proposing.
Post by: Nima Zahadat
Notes from talk with Dr. Diana Burley
Policy Management on BYOD
Aligning BYOD policies with physical and information security policies
Private sector space versus federal sector space
Information sharing on mobile devices, BYOD versus organizational owned
-Different policy applications
Privacy versus security consideration: incorporation into the security policy
(There is not a whole lot at all according to Dr. Burley :D)
It must tie the policy management to systems engineering space
Applying some concepts that are Risk Management and applying them to mobile security management
-Risk management and BYOD management (good area for systems engineering)
By: Nima Zahadat
Aligning BYOD policies with physical and information security policies
Private sector space versus federal sector space
Information sharing on mobile devices, BYOD versus organizational owned
-Different policy applications
Privacy versus security consideration: incorporation into the security policy
(There is not a whole lot at all according to Dr. Burley :D)
It must tie the policy management to systems engineering space
Applying some concepts that are Risk Management and applying them to mobile security management
-Risk management and BYOD management (good area for systems engineering)
By: Nima Zahadat
Subscribe to:
Posts (Atom)