Widyatama - Lecture.applied Networking - IV Week05 Mobile Security 1

Applied Networking-IV (2231114)
Lecture Week-5
Mobile Security-1
Lecture by: Djadja.Sardjana

Djadja.Sardjana,, S.T., M.M.
www.slideshare.net/djadja
Djadja.sardjana@widyatama.ac.id
18-
18-Mar
Mar--10 Widyatama University-
University-Informatics 1
Mobile Security-
Security-1
Mobile
Security
18-
18-Mar
Mar--10 Widyatama University
University--Informatics 2
The New Age of Risk
Ubiquitous internet protocol-
protocol-based
technology
(Almost) everything connects to the ‘Net
Many vulnerabilities awaiting exploitation
Mobility of people / information / devices
Cyber crime: real and increasing
Terrorist threat: physical now….blended
later?
18-
18-Mar
Hostile World
9-11, 3-
3-11, 7-
7-7 and other major terror attacks
Wars and insurgencies
SARS / Bird flu - global impact of disease
SE Asia tsunami disaster
Katrina hurricane disaster in USA
Tomorrow’s headlines…?
18-
18-Mar
Convergence Of Legal, IT,
And Business
Laws/Regulations Technologies Stakeholders
EU Data Web / Internet Customers

Protect
Databases Competitors
GLB/HIPAA/Patriot
Sarbanes-Oxley Collaboration
Governments
U.S. Identity Theft
Law(s)? Wireless Suppliers/
Partners
Mobile Devices
Employees
Pressure mounting on organizations to prove compliance with

an increasing array of laws and regulations. This makes
information security much more challenging.
18-
18-Mar
Dissolution of Perimeter
Hostile Internet Environment
Joint Ventures Contract Manufacture
“Organization Community”
Contract Design
Parts Un-
Un-trusted
Intranet
“Point defenses” Customers
Servicess
Transportation
18-
18-Mar
Current State of Network Security
Home/Remote
Users
Business Systems
Manufacturing
Research/Development
Intranet Labs
Legacy Systems
HR Systems
Communication/
Messaging Systems
Users Finance/SOx
Eroding Firewall Perimeter
Eroding Firewall Perimeter
Strategic Partners
Suppliers
Vendors
Etc…
Hackers
Hackers
Mobile/Wireless
18-
18-Mar
Mobile Viruses on the rise
2004
2005 06-15-04: Cabir A
06-16-04: Cabir B
01-
01-10-
10-2005: Lasco A 07-10-2004: WinCE/Dust
02-
02-01-
01-2005: Locknut.A 08-06-2004: Brador
03-
03-07-
07-2005: Commwarrior 11-19-04: Skulls A
03-
03-04-
04-2005: Dampig.A 11-29-04: Skull B
12-09-04: Cabir C
03-
03-18-
18-2005: Drever
12-09-04: Cabir D
04-
04-04-
04-2005: Mabir.A 12-09-04: Cabir E
12-21-04: Cabir F
12-21-04: Cabir G
12-21-04: Skulls C
12-21-04: MGDropper
12-26-04: Cabir H
12-26-04: Cabir I
18-
18-Mar
Wireless Enabled & Mobile
Attacks
Blue
Blue--jacking, bugging, snarfing, sniping
Wardriving
Malicious Mobile Code (Virus, Worms, Trojans)
RFID Sniffing
Denial of Service
Web Application
Spyware
Social Engineering
18-
18-Mar
Securing the Mobile Workforce
As the person responsible
for an organization you
only have “control” in this
space
But mobile employees

move throughout the
entire set of possibilities
18-
18-Mar
Effective Security is Complex
PKI Manager
Centralized
Security
Token Card Other Security
Many parts & pieces
Manager Entity Manager
Policy Manager
Complex components
Certificate
Authority
Digital
Signature
OS Security
Management
Single Sign-on
Too few qualified personnel
Tools
Interface Interface Tools
~.005% of employees
Network
Security Event
Lack of standards
Virus Interception Security Policy Cyberwall/Firewall
Report Host-based
& Correction Distributor Rule Base
Writer(s)
Protection programs “custom
Encryption
Application-based
built”
VPN Session or Connection
Application Proxy Facilities for
Tunnel
Manager
Manager and
Logging
Implementations Network
Connections
Authentication
Failure of weakest link (s)
Cryptography
VPN IPSec and
VPN Security Traffic Application Intrusion
Connection Event Analyzer Logging Facility Logging Anti-Virus
Manager
Intrusion Detection
Security Event Security Integrity Intrusion

Intrusion
Logging Manager Prevention Auditing
Detection
Security Management
Stateful Packet Frame Application

Inspection Inspection Inspection Inspection
Security
Network Access Real-time
Control Interception Frame
Filter Engine
and Enforcement Management
Facility
18-
18-Mar
Security Must Make Business Sense
OPTIMAL LEVEL OF SECURITY

AT MINIMUM COST
COST ($)
SECURITY
LEVEL
COST OF SECURITY
COUNTERMEASURES
TOTAL COST
0% COST OF SECURITY 100%

BREACHES
18-
18-Mar
Next Generation Security
Zones and compartments
Extensive use of cryptography
Identity and access management
“Opt in” for more protection
Essential to enable seamless security !
18-
18-Mar
Next Generation Design
Internet
Legacy Zone
e.g. manufacturing
Collaborative
Systems
General Purpose
Systems
Intranet Zone
MOT ISP Seamless Mobility Secure Zone
Not subject to
Regulation Personal Regulated
Systems Data Systems
SOX Compliant
Systems
Availability Not Critical

Systems
Custom Zone
Stand Alone
High Sensitivity Zone
Trade Secret, Race, age, ethnicity
DMZ QZ
Zone Zone
18-
18-Mar
Security is a Process
Not a Product!
Security is achieved by the combination of
People
Process
Technology
Protections Address:
Prevention
Detection
Response
Recovery
18-
18-Mar
Traditional security programs align people, processes and
technology to protect enterprise networks
With seamless mobility, security must now expand to encompass the

extended enterprise.
People
Processes Policies
QuickTime™ and a
TIFF (LZW) decompressor
are needed to see this picture.
Technology
RFID CHIP
18-
18-Mar
Securing Seamless Mobility:
Wireless/Mobility Risk Management
Business
Business--focused understanding and
prioritization of risks, vulnerabilities and
countermeasures
Include technical vulnerabilities as well as
other key elements of the security program
Assures most effective use of limited
resources
18-
18-Mar
Securing Seamless Mobility:
Network Design
Understand existing “wired” environment
Build security into wireless network foundations
Focus on points of connectivity, firewalls, DMZs,
intrusion detection/prevention, VPNs and
encryption
Maximize wireless network availability,
operational security and performance
Secure devices in a system designed for
security
18-
18-Mar
Approach to Information Security
INTERNAL IT
Ensure the
Confidentiality,
Integrity, and
Availability of
Product Security
Motorola I/T Services include
Assets
Support
PROTECTING assets,
development of DETECTING hostile
more secure activities, RESPONDING to
Wireless Security Motorola incidents, and
Services products RECOVERING to limit
adverse business impacts
Leverage our
expertise to
provide
customer
services
18-
18-Mar
Tugas Mobile Security
1. 0606022 - FIRMANSAYH APNET4
Mobile Security
2. Genta Gemilang-
Gemilang-Mobile Security
3. Hillman Nurrachman-
Nurrachman-Mobile
Security Software
4. Mobile Security - Farhan Atsani -
0606P02
18-
18-Mar
Conclusion & Final Words
Mobile
Security
Demo
18-
18-Mar
Conclusion
Threats to organizations are real and
increasing, seamless mobility requires
careful security planning
Security incidents involving mobile and
wireless environment are increasing
Securing seamless mobility requires
holistic approach that address people,
process and technology
18-
18-Mar

Widyatama - Lecture.applied Networking - IV Week05 Mobile Security 1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Widyatama - Lecture.applied Networking - IV Week05 Mobile Security 1

Uploaded by

Copyright:

Available Formats

Applied Networking-IV (2231114)

Lecture by: Djadja.Sardjana

Wars and insurgencies

SARS / Bird flu - global impact of disease

SE Asia tsunami disaster

Katrina hurricane disaster in USA

EU Data Web / Internet Customers

Pressure mounting on organizations to prove compliance with

“Point defenses” Customers

Eroding Firewall Perimeter

But mobile employees

Security Event Security Integrity Intrusion

Stateful Packet Frame Application

OPTIMAL LEVEL OF SECURITY

0% COST OF SECURITY 100%

Essential to enable seamless security !

Availability Not Critical

With seamless mobility, security must now expand to encompass the

You might also like