>> Enterprise mobility security Part 2.
The learning objectives for this lesson are to
explore mobile deployment scenarios,
to explain mobile security concerns,
and to define key mobile digital forensics items.
Let's get started. Continuing on from Lesson 1,
we're going to go into a deeper dive
into mobile security.
Also, we're going to discuss some
of the issues that may bring
to a company that
chooses to deploy different mobile devices.
Beginning with that, we're going to go over
mobile device deployment scenarios.
The first is bring your own device or BYOD.
This is when the device is owned by the employee.
But the device needs to meet
a certain corporate standard for
specs and also allow for some level of auditing.
This is the most difficult to secure
because the corporation does not own the device.
The next scenario would be the corporate-owned.
This is when the device is owned by the company and
device could only be used for corporate purposes.
The next scenario is the corporate-owned,
personally enabled or COPE.
This is where the device is supplied
and owned by the corporation,
but it allows for a personal access to email,
social media, and related.
These are all accessible to
the employee and they can use them on their own,
but they have to do so within
the corporations' acceptable use policies.
Then finally, we have choose your own device or CYOD.
This is similar to COPE,
but where the corporation will supply
employees with a list of
approved devices that the employee can choose from.
Mobile device, digital forensics.
Now, mobile devices because they've
become so embedded in our lives,
really contain a lot of
information that would be useful to investigators.
We can find out where a device was,
how it was used,
and how the data was used on the device,
as along with many other valuable pieces of information.
We're going to go over those in more
detail in the next slide.
But keep this in mind that because
so many things have been
pushed to our own mobile devices,
just not dimension banking
and shopping and that type of thing.
But most of our communications are
done this way through messaging apps.
But we also take a lot of pictures and we use a lot
of apps on a wide variety of topics.
Because of that, our devices are collecting
more and more information about us in our daily lives.
Here are some of the specific items that would be
very interesting to an investigator
about a mobile device.
We want to look at the subscriber
and the equipment identifiers,
but also the date and time and
language and the system settings,
the contacts that are on the device.
This is very telling for us. Calendar data.
This may be information that we can make
sure where someone might have
been or where they confirmed you have met with someone.
Also text messages, the call logs,
email, any media files such as photo, video or audio.
Messaging apps are a big thing similar to text messaging,
but a lot of people have shifted more towards this.
This could be WhatsApp
or Facebook Messenger, those types of things.
Also, we want to look at their web browsing,
their web history to see what's going on.
Any documents that may be stored on the device,
their social media data,
all the data from the apps that
are installed on the device.
Geolocation data that would show where the person was.
A lot of people aren't aware of this,
but this data is stored for
very long periods of time so you
can really go back and find where a device has been.
Also, many devices we carry
the biographic health data because of
the push to using health apps on mobile devices.
Which brings us to
the security implications for wearables.
Wearables are designed to
be personal data-enabled accessories.
These could be smartwatches,
smart rings, bracelets, or glasses.
They will collect a great deal of data
about the user, including health information.
Because this information is
such a private nature it
presents security issues as well as privacy issues.
But what ends up happening with this data
as it's shared with various apps.
A lot of times people aren't aware
that the app you're using
is collecting that information
to in turn share with other apps.
Because of that, we do have
potential health privacy issues.
In addition, we have geo-location problems
because these devices will
track the location of where they were used.
After all, they're often used for tracking,
running schedules, and running paths,
that type of thing.
It can really show where a device was.
Keep in mind it doesn't always
mean that's where the person
was because the device could be used by someone else,
but it shows where that device was,
and most often that is where the person was as well.
Here's a good example of that.
In 2017, Strava,
which was a run and tracking app company,
they released the heat maps
showing where their users were running.
Well, unfortunately, this revealed the locations of
many secret military bases around the world.
Some of these were used by the United States,
Russia, and Taiwanese forces.
You'd be able to see these running maps,
and then people were able to take those and
locate previously unknown installations.
Eavesdropping. Now, this is a broad category,
but it basically means
to listen to devices that are transmitting.
This could be anything from Wi-Fi to Bluetooth,
NFC, or even cellular.
Eavesdropping is a constant threat and anything that
you do not want to be intercepted must be encrypted.
Bluetooth devices are especially
vulnerable and they can be attacked
using tools such as ramble.
This can be located.
Even hidden devices stored in
the car can be located in stolen.
With RaMBLE, you can locate
a device that is out of sight.
Often, like I said, in the back of a car,
if you keep your phone or your mobile device,
it's tucked away somewhere,
that RaMBLE would be able to locate it.
Because of that, thieves have been able to
break the back windows of cars and steal
things that people thought
were probably pretty safe because they were out of sight.
Device hardware and software security.
First thing we're going to go over is jailbreaking.
These are exploits that enable
a user to become root on an iOS device.
This would allow the user to install apps,
change carriers, and to customize the system
in ways that they wouldn't normally be able to do.
The equivalent for this on the Android side is routing.
Android runs a version of Linux,
and routing refers to obtaining
the system level or root access to the device.
System list refers to obtain
the same access without modifying the system partitions.
This is harder to detect.
When individuals do this,
they would be able to circumvent
any security that corporations may be have placed
on the devices and it does make
the devices more prone to being hacked.
If you're getting around the security that
the manufacturers have installed on the devices,
it makes it easier for attackers to do the same thing.
Unauthorized application stores.
We can use sideloading,
and this refers to the installation of apps that from
any third-party management suites
can be configured not to allow this.
We make sure that we don't want
individuals to install apps that are not
approved and we don't want them
downloading them from other unapproved sites.
Third-party app stores would be a good example of this.
Sites that are other
than Apple's App Store and Google's Play Store.
Examples would be F-Droid in Aurora.
These are app stores that you can download apps.
Sometimes they're the same ones that are
in the Google Play Store,
but oftentimes they are
apps that are not available there.
By using this, you could download different apps that
are not available and install those on your device.
Oftentimes, corporations would not want
these apps installed on their corporate-owned devices.
Because it maybe would introduce
an aspect of security that
they don't have to worry about.
It doesn't mean that these are bad stores.
They're not. I use both of these actually for my phone.
But it does introduce
things that as a security practitioner,
you're going to have to take into account
when you're trying to secure your network,
you don't want anything on there that
isn't necessary for the corporate mission.
Containerization. This divides the device into profiles.
One container profile can be for work purposes,
while the other can be for personal needs.
These containers are isolated from each other and
the apps cannot access each container.
DLP can also make sure of this and then it can
prevent tagged data from being
moved to a non-approved container.
Again, since one part is being used for personal then
the user is able to have all their personal things there,
such as email and their social media there.
But on the worksite,
it's strictly limited to only the apps that are
necessary for work and any documents or
data that's used on that work profile would
not be able to be moved over
to the personal and vice versa.
Hardware manufacturer concerns.
Device manufacturing is a worldwide system.
Parts are made in one place and
then shipped to other vendors,
and then they're assembled.
Original equipment manufacturers or OEM,
are the final sellers of
the device and all support comes from them.
It doesn't come from the people who
manufacture the individual parts.
When vulnerabilities are discovered,
patches must come from the OEM.
If the OEMs are not responsive
then devices remain unpatched.
This is on the Android users have had
a hard time with because
the patch updates have to
come from the device manufacturers such as Samsung.
If Samsung is slower to patch,
so they have a slower patch release schedule,
then that means that there are longer periods of
time that those Android devices are remaining unpatched.
Apple is pretty good about this.
They release patches much more
frequently than Android devices manufacturers do.
Bootloader security. Bootloaders are
the first line of mobile defense for our devices.
They prevent any unauthorized operating systems
from being loaded onto the device.
eFuses are used to permanently
write OS files to flash storage.
eFuses also allow for
cryptographic keys to be
etched into the device for trust.
Since these keys are edge that will be
read-only and they cannot be altered.
These keys can be used to validate software
during installation. Let's summarize.
We discussed mobile device deployment models
and also containerization and mobile devices,
bootloader security,
hardware, and manufacturer concerns.
We went over jailbreaking and routing,
loading apps through sideloading
and other third-party app stores,
and security concerns of wearable devices.
Let's do some example questions. Question 1.
This process allows a user to gain root or
super user-level access of an iOS device.
Jailbreaking. Question 2.
A mobile device is supplied by a company but the employee
may use it to access non-corporate data such as email,
corporate-owned, personally-enabled, or COPE.
Question 3. F-Droid and Aurora are examples of this.
Unauthorized application stores.
Also, you could just say third-party application stores,
but for the purposes of
a corporation controlling access to a device,
these would be unauthorized application stores.
Finally, Question 4, true or false?
Mobile devices are not forensically speaking,
very interesting to investigators.
This is false. They are
very interesting because they contain
so much information about
the person that's using the device.
I hope this lesson was helpful for
you, and I'll see you in the next one.