Meeting with Jack

Met with Jack last night and it was very positive.  He told me there are a lot of MDM solutions out there but not a single one is complete.  He reaffirmed Dr. Ron Ross' statement that there must be a balance between technology and policy.  He has a solid grasp on mobile security and systems engineering concepts.  Here are some of what I wrote down:

• Jack believes it is better for organizations to issue devices rather than BYOD
• Mentioned MDMs use the sandbox approach; drawbacks include
• Interface is propriety and people hate it
• Sandbox can be attacked
• Battery usage is excessive; mentioned in a test, their sandbox drained the battery in 2 hours
• MDMs are a collaboration between Apple, Google, Microsoft, and Blackberry
• These are the proprietary standards for mobile security
• Mentioned 37 items that form an MDM
• None of the vendors support all 37 items
• Jack mentioned he believe NIST or IEEE or some high level government organization needs to propose the standard for these vendors to adhere to
• MDM provides security but in and of itself is not secure
• This was very cool to know
• He showed me his iPhone 5 which has MDM installed and under settings it can easily be removed
• He mentioned that the data stays however
• Jack mentioned a company that installs a legal root-kit that bypasses all the software and controls everything from below
• Problem is, especially in BYOD, the privacy issues and would someone want a root-kit on their own device
• Some BYOD challenges
• What if you do not want to register your device?
• Even if registration is done, there needs to be a separate MDM profile for each OS version for each carrier.  So each updates to iOS would need a different MDM profile and of course separate ones for AT&T, Verizon, and Sprint!  The permutations is crazy
• GPS technology is available to disable hardware (such as camera) based on what location you are at
• Again, no vendor supports all the MDM requirements

A successful plan require technology, culture, MDM, policy, and management  commitment

iOS is built on a far more superior architecture than Android

• Apple does not allow apps to talk to each other
• Android does and causes a havoc
• Compare the early days of Windows to Mac; that's Android verus iOS

Systems Engineering

• Security is a derived functionality requirement of the Systems Engineering process
• To start, we need
• Define needs
• Define requirements
• Functional requirements
• Technology requirements
•  Security requirements
• Define the architecture
• Define the specifications
• Define the design
• Define the implementation
• Security is in effect a subsystem of Systems Engineering

BYOD

• Define mobility needs
• Define the context you are operating in
• Determine the specs
• Design

 Cost consideration:

• Would you spend millions to secure 30 devices?

Security policy consideration:

• With security in place, there has to be Trust but Verify
• Can we trust and verify or no because if it is not, the security or its policy are not worth it
• At what point do you rely on technology?
• At what point do you rely on policy?
• What are the privacy and legal consideration?

 IT Systems

• IT is built from many systems
• LAN
• WAN
• Web
• DNS
• Mail
• Application
• Storage
• Databases
• Hardware
• Software
• Security is another part of an IT system that permeates everything

By: Nima Zahadat