>> Enterprise mobility security part 1.
The learning objectives for this lesson are to
explain Mobile Device Management software,
to explore mobile device
connectivity options and their risks,
and to learn about WPA3 and Wi-Fi 6.
Let's get started.
Enterprise Mobility Management are policies and
technology tools that allow us to
centrally manage the mobile devices on our network.
It allows us to control the way users
themselves are allowed to use the devices.
For example, what apps are allowed to be used,
and overall device security.
Now a subset of EMM is Mobile Device Management or MDM.
This focuses on making sure the devices are
compliant with our organizational security policies.
For example, we can institute application controls
which have an allow list and a block list.
We can require strong password controls to ensure
that users are choosing good passwords for the devices.
In a similar way, we can use
multi-factor authentication requirements to
make sure that MFA
is used before gaining access to
any network resources from one of these managed devices.
Also, we can use token-based access.
This utilizes network access control,
and it requires that a device provide a valid
token before it's allowed to
gain access to network resources.
An MDM also allows for a patch repository.
This is a centralized management way of
pushing out updates and patches to devices.
In this way, we can control how
those updates are being pushed out and
schedule them to ensure that
all devices are being kept up-to-date and current.
Device certificates.
The first column we have our trust certificates.
These are used to globally identify
a trusted device within a given organization.
The key is, if that certificate is ever copied,
any device can use it and
the certificate must be immediately revoked.
We also have user specific certificates that
utilize a more granular control for allowing access,
and also they're easier to identify and revoke.
Firmware over-the-air.
Now, baseband has updates that modify
the firmware of the radio for modems,
such as our cellular modem, Wi-Fi, Bluetooth,
NFC, near-field communication, and GPS operations.
This firmware is separate from
the device's own operating system.
There have been vulnerabilities and these in the past
and it's very critical that we keep them up-to-date.
Over the air, OTA updates are delivered via
the cellular network or Wi-Fi connections
to the device for these updates.
Remote wipe. If a device is ever lost or stolen,
there is a way that it can be restored to
factory default and have
all of the sensitive data removed.
This can be triggered, for example,
by putting the wrong password in too many times or also
we could send the command to
the device over-the-air to do so.
However, there is a way of preventing
this by using a faraday bag.
If you were to put your mobile device in this bag,
it would not be able to receive
the command via the cellular
or Wi-Fi network to execute that remote wipe.
Wi-Fi protected Access 3 or WPA3.
Now, neither web or WPA is considered safe at all.
No one should be using either of these.
WPA2 uses AES encryption with 128 bit key.
While it's stronger, it's still vulnerable.
The key to remember about WPA2 is
the vulnerability is not in the encryption itself,
but rather how that encryption was implemented.
WPA3 was designed to
address some of the weaknesses in WPA2.
For example, now we have
simultaneous authentication of equals,
this replaces WPA 4 way handshake
with a Diffie Hellman agreement.
We also have enhanced open,
which is an encrypted in open authentication method.
We also upgraded the crypto protocols in
WPA3 by replacing the AES,
CCMP with AES, GCMP.
This allows for 192 bit key.
Enterprise users are required to use this 192 bit key.
Near field communications or NFC.
This is based on a specific type
of radio frequency ID or RFID,
and it's included with most modern smartphones.
It can be used to read passive RFID tags at close range,
but it can also be used to exchange information
such as business cards from device to device.
NFC is not encrypted,
and that's really important to remember.
But the most common use of NFC
today is for contactless payment.
Examples would be Apple Pay,
Google Pay, and Samsung Pay.
It's vulnerable to many other types of
attacks such as men in the middle and skimming.
Bluetooth. Bluetooth is
a short range wireless communication protocol.
It can be used to create your
own wireless personal networks.
It's often used to connect other devices,
such as keyboards, mice, and headsets.
There are several types of attacks that are
targeted towards Bluetooth,
but by far the most dangerous is the blue borne attack.
Blue born allows for
complete device control by an attacker and it
doesn't even require that the attacker be paired
or connected to the victims device.
Mobile device connectivity, peripherals.
Peripherals are any additional tech that we want to
connect to our mobile devices such as speakers,
keyboards, headphones, chargers or mice.
They can also be manipulated and
become malicious to that mobile device.
Tethering is using the smart device to
share its data connection with other devices.
You can connect other device to your phone via Bluetooth,
Wi-Fi, or the USB cable,
and then use the phones or
the tablets Internet connection via
cellular and share it out to those other devices.
Instructor side note. Now,
peripherals can be very dangerous.
The device and this picture is an OMG cable.
In this case, it is Apple lightning cable.
But the company also makes USBC and USB micro cables.
It's not just an Apple thing.
Inside of this cable is
a mini-computer that also has Wi-Fi.
You plug this into your phone and a computer,
it can actually steal data or introduce
malicious content to your phone
or the computer is plugged into,
and because the cable has Wi-Fi,
the attacker can connect to the cable via
Wi-Fi to get access to either
the computer is plugged into or
the device that's plugged into.
On top of all of that,
it also has a key logger in it. Device encryption.
Now, mobile devices often contain
sensitive data and because
of that, we've got to protect them.
Encryption allows for the data
on the device to be secured.
Starting with Android 9,
Android has hardware support to encrypt metadata.
This covers anything that's not
encrypted by the file-based encryption.
Apple iOS devices use
a unique 256-bit ID for each device.
This is stored in the hardware device.
This two 56-bit ID,
combined with a user's password,
encrypts all the data on the device.
VPNs. We can also use VPNs on our mobile devices.
We start at the OS level,
which is where everything is connected through the VPN.
It's considered always on.
All data leaving and coming to
the device is encrypted over the VPN.
But we also have app level VPN,
which protects the data of a specific app.
Finally, there's web-based VPN,
which is usually done with inside of a browser.
The common uses for this is to
bypass geo-restrictions or firewalls.
Location services.
This is used provide geographical position of the device.
We can use several methods to do so.
But by far, GPS is the most common.
But we can also use cellular tower triangulation,
Wi-Fi signals, and Bluetooth.
Geofencing is when we allow different levels
of access based on the device's location.
Within sight of our corporation,
we might give it full access,
but once it leaves the building,
then it's no longer allowed to access network resources.
Geotagging is adding addition or
locational metadata to files or devices,
and we use this for asset management.
DNS protection. Now, by default,
DNS is unencrypted, and this allows for interception.
But we can also use custom DNS services,
for example, Quad 9 or Cloudflare or Cisco's umbrella.
Using these services allow us
to filter malicious DNS requests.
We also have DNS over HTTPS,
and this will encrypt the DNS traffic because
it's tunneled over HTTPS using TLS.
This will encrypt the DNS request.
But it can cause this use to organizations as they
can no longer see the requests leaving their network.
It's often used by malware to help hide itself.
Let's summarize. We went
over Enterprise Mobility Management,
we discussed WPA3 and
Wi-Fi 6 and we went over remote wiping.
Mobile device connectivity options and their risks.
We also discussed Device Configuration Profiles.
Let's do some example questions.
Question 1, this mobile device configuration setting
allows for the granting or removing of
access rise based on the devices physical location.
Geofencing. Question 2,
this feature of mobile devices allows the device to
share its internet connection with other nearby devices.
Tethering. Question 3,
this mobile device security measure
allows for all data on
a device to be wiped under certain defined circumstances.
Remote wiping. Finally, Question 4.
This is a suite of policies and tools designed to
centralize remote management of mobile devices.
Enterprise Mobility Management.
I hope this lesson was helpful for you,
and I'll see you in the next one.