- iPad « Secure Thinking

Posts tagged - iPad

Friday, January 13, 2012

The Year of the Mobile Wallet

By Sushila Nair, Security Specialist, BT Global Services

Mobile payment technologies have been around for quite some time and yet it has never really burst into common place use…until now.

In 2012, I suspect that mobile payments will be more commonly used in theU.S. as many of the major technology players are putting on their gloves and getting ready to duke it out to be a leader in this market. It will be fascinating to see who comes out on top.

TheBattle: Google vs. Apple vs. PayPal

One of the major contenders is Google. The Google Wallet uses Near Field Communication (NFC) with special NFC capable point-of-sales (POS) device and phones. NFC allows for data exchange and wireless connections which are in close proximity to each other. The NFC forum that consists of 130 countries and many large organizations control the specifications, which is also an ISO standard ISO/IEC 18092. Currently only the Nexus S 4G supports Google Wallet, but next year should welcome a host of new Google Wallet-enabled devices.

The sheer size and weight of Google may enable the collaboration of card issuers, mobile device manufacturers and merchants.New Yorkyellow cabs already accept Google Wallet, enabling riders to pay fares with any enabled technology. OfficeMax also upgraded over 100 of its stores to support Google Wallet and SingleTap, which provides payment and automatic location of coupons.

Apple is the other contender in the market. The iPhone 4S does not support NFC and there has been no word from Apple on what future models may support. However, Apple has already dipped its toe into mobile payments. As part of its upgrade to the Apple Store app, the company introduced a new service called EasyPay. This service lets a user look up information about a product based on the barcode and then charge the product to his or her iTunes account. At the moment, EasyPay is extremely restricted; it only works in theU.S.and only in Apple stores and does not include the purchase of big ticket items. However fascinating because it makes iTunes a payment vehicle and really displays how consumers expect mobile payments to function.

PayPal Mobile announced a 511% increase in global payment volume compared to Thanksgiving 2010. Consumers have wholeheartedly embraced mobile shopping this year with iPhones generating the majority of the traffic and Androids not being far behind. PayPal is working hard to maintain its position as a payment processor and to being a big player in the mobile arena.

PayPal has an in-store mobile payment system that does not require NFC technology. The system allows shoppers to scan bar codes and to authorize payment through their PayPal mobile accounts. The benefit, of course, is vendors do not have to replace their POS and consumers do not need to replace their phones.

But it is not just the big players that are hedging bets on the adoption of mobile payments. There are also third-party vendors specializing in payment who are in this space. Square’s card case promises to let customers pay by having their smartphone in their pocket. It functions using GPS-style technology and appeals in part to the market move towards instant deals. The service provides merchants with a wealth of information on the consumer and encourages transparent spending for consumers.

Creating a tie-in between payment choices, location-based service, deal-of-the-day vendors and adding enhancements to loyalty programs and coupons is really what mobile payments are about. It is stretching the phone past just being a payment choice, it is about making the consumer experience different. Companies that invest in these technologies have a far better chance of surviving the challenging economic times ahead by wooing the consumer in every way possible.

Wednesday, January 4, 2012

BYOD: Why Bring Your Own Device Doesn’t Spell Disaster for Your Network’s Security

by Tara Savage, Senior Marketing Manager, BT Global Services

This holiday season was brought to you by the letters B.Y.O and D. Those four letters spell a major shift in the technology world, one which is going to have a big impact on businesses this month.

It goes without saying that the number one holiday gift this year will be tablet computers and smart phones and that the vast majority of people will want to bring their new device to work with them when they come back to work. In other words, they’ll be bringing their own devices through your business’s front door and wanting to log on to the corporate network.

Before panic sets in at the thought of hundreds of unsecured devices wreaking havoc on your well managed network, take a step back and have a look at the big picture.

BT’s Ray Stanton and Jeff Schmidt have been talking to the media about why the panic over BYOD is much ado about nothing and that the benefits of enabling workers to use mobile devices far outweighs the risks that are commonly associated with them.

From Jeff’s perspective tablets enable worker productivity and enhance customer satisfaction. As long as strong authentication is enabled and device-wipe capability is part of the tablet’s set up, data is likely more secure than if it was sitting on a desk-top computer in an office park.

In a recent article on searchsecurity.com Ray pointed out that securing mobile devices is very similar to securing lap tops, something that companies have been doing successfully for many years now. He says: “[i]f the policy is to allow tablet use, then introduce the same security policies and enforcement as you would on a laptop computer”. It’s irrelevant if it is your own device. If users are accessing corporate data, the rules revert to the corporate policies, irrespective of what they have accessed it from.”

Ray points out that the other keys to success are user education to make sure employees are aware of policies and understand both why they are in place and how to comply with them. Ray is particularly impressed with Good Technology from Good Dynamics which have some excellent platforms for multi-end user environments to manage and secure mobile devices.

And, as Martin Brown, another of BT’s security experts has said in his Twelve Tips for Christmas: “Make sure you enable a password set-up immediately and run security updates until there are no more flashing icons. Just because it’s new doesn’t mean it’s secure!”

Monday, December 12, 2011

The 12 Days of Christmas for Security Geeks

by Martin Brown, General Manager, Security Technology & Strategy

Twas the night before Christmas, and all through the house, not a peripheral was stirring, not even a (bluetooth) mouse…

So, it is that time of year again where everyone is filled with holiday spirit and glee (not the singing school version) yet don’t forget that it is during this time of year that the Grinch is scanning the horizon, trying to phish the joys of Christmas away from you.

Here is a friendly reminder to keep your spirits up and keep the Grinch away by considering the following 12 steps:

1) Don’t tell the world via social networks that your crib (or office), is empty over the holiday period. When you leave your stable unprotected anyone can come in and wreak havoc with your donkey and asses!

2) Make sure you keep your Anti-Virus and security tools updated. The holiday season brings gremlins out of the shadows who will eat after midnight and exfiltrate your holiday cheer!

3) Take your company back-ups offsite to a secure storage facility just in case Rudolph comes crashing through the roof due to that glowing nose actually being a single point of failure!

4) Make sure your remote access is working as planned and you can get online if required over the holidays, but keep it secured so the trolls don’t get in.

5) Have some company letterhead available so you can write official documents if needed. It can also come in handy to make a last minute list if you partner mentions any ‘wouldn’t it be good if’ wishes for presents. Failing that, paper darts to change channel on the TV when you have lost the control under a mountain of wrapping paper.

6) Don’t be scammed. If it seems too good to be true, it probably is. ‘Tis the Season for pop-ups and alerts promising great deals and holiday freebies. THINK before you click.

7) Advise your alarm company that the building will be unattended and that if a fat man in any color suit gets stuck in the ventilation, it’s not going to be Father Christmas and it’s going to be more “Heave Ho” than “Ho Ho”!

8) Be careful with your decorations around the office and make sure it’s electrically safe. When you leave, turn off all devices not needed over Christmas as well as the Christmas lights, but remember to turn the networking equipment back on before anyone returns to work! Hung-over or not, people will still need a building to return to, and access to the network.

9) Check your systems daily to make sure they are operational for emergencies and those unable to digest yet another Christmas musical and who instead prefer to catch-up on the reams of photos from that Office Christmas party before HR intervenes…

10) Don’t stand that glass of ‘Holiday Cheer’ next to your keyboard! Keyboards do not appreciate mulled wine, and nor will they appreciate a mince pie… When mixed, the two create a Christmas Keyboard Concrete which only the ghost of Christmas Future can fix with the aid of a small jackhammer.

11) If you get a new computer or other network enabled device, add a passcode/password and repeatedly run the software updates until there are no more security updates to be found. Just because it’s new and shiny does not mean it’s secure!

12) And finally, don’t send ‘helpful’, ‘insightful’, or ‘if you want to know what I think’ text or email messages to the boss (or anyone else) while buoyed by Holiday spirits!

Wednesday, August 3, 2011

Evil Dad and the Internet

By: Martin Brown, General Manager, Security Technology & Strategy

I have a small swarm of kids, four to be precise, not enough to form a football team, but enough to cause chaos.

My kids are of the age, like the majority of the population who are between the mud and deodorant stages of life, where they have always known the Internet, and the things it bring us.

I, for my sins, am a security bod. I have worked in security for around 20 years, and am currently in BT Security strategizing what future technologies will need to look like if we’re going to be online securely. I refer to myself as a “Technology Funalist” as I enjoy pretty much enjoy all facets of technology, and have the electricity bill to match. My wife introduces me as “the gadget man” and endures this hobby well, being generally accommodating to my techno wishes.

I have, on occasion, had to resort to devious methods to gain access to the latest tech – take the iPad for example – knowing the likely repercussions of returning home from yet another “just having a look” trip to the local computer superstore with a shiny new gadget.

As the “I thought you were only looking!?” conversation began, with dramatic flair I presented her with her own iPad. With an audible “whoosh” the pressure abated, the smile appeared, and we began our blissful life of sharing of apps, music and other tablet-esque adventures. Mission accomplished!

Unlike most normal people, I run our home network like a small business and apply the security controls in a similar vein, despite the groans and moans from the kids.

Whilst they don’t realise it, the kids indirectly benefit from my enthusiasm, getting access to some pretty cool tech stuff which is integrated, just works and is locked down with the intention of keeping it and those using it secure and safe.

That final point is where my kids and I begin to have differing views on the controls around using the Internet, how it should be used, what they can do and where they are allowed to go.

Yes, some of their friends do have access to more stuff than they do, and whilst my kids might think of me as being just to the right of Attila The Hun in terms of internet controls this is because I tend to stick to the rules of the (Internet) road, and pay attention to what ages products and services are intended for. Sadly, this does not seem to be the case for all…

A good example is social networking. Many of the children at school have Facebook accounts, despite being below the minimum age, but we are sticking to the rules – this creates an imbalance which our kids are keen to redress, and are supported by their peers when discussing the tales of woe around how evil Dad is about such things.

As you would expect the sites and materials they want are not offensive, adult or inappropriate, however it’s managing the access to the grey areas where the information, or site, is legally, or based on the end user license, placed just outside their reach.

So how do we maintain and apply these home policies. There are four children in our house, each with around 3-5 years between them. This means there is no such thing as a one size fits all option – each needs to be addressed individually. It is not fair on those who do have Facebook to find they can’t access it and are expected to make do with cartoons and other cuddly images.

As a first step, all the house traffic is routed through a cloud based filter before it gets to the house. This service does a reputation based category web check, and malware checks on web and email as well as providing us with our anti-spam filters.

Each of us has a login which authenticates for web access. Besides some blanket category blocks there are unique restrictions and permissions per user appropriate to age and content type. Attempting to go to a site which is blocked, results in the following user friendly message:

What a handsome chap!

The next layer in is the firewall. As well as being a firewall, has some IDS and is also blocking all SMTP inbound and outbound other than that destined for my cloud-based mail security providerP2P torrents and the like have no place here!

Finally we get to the client.

All computers, including servers, PCs and Macs have antivirus and firewall on them. No exceptions. There is a mistaken view that Macs do not need AV. That is not the case, and as Apple’s market grows, so does the risk of encountering malware on OSX.

My children are used to this now. They generally accept it and, along with the final piece of the puzzle, education, they are frequently reminded the Internet can be a bad place, and you can only trust someone is who say they are of you seen each other to face and discussed meeting online. Sure, they still click the wrong thing from time to time, but that’s what the layers of protection are for…

And finally, one unintended little “benefit” of running the kids’ laptops in a Windows domain, is when you see their laptop is on at some ridiculous hour, ‘shutdown -i’ is my friend, allowing me to remotely shutdown their laptop. You can tell if they were awake by the immediate response as it shuts down in front of their eyes!

Evil Dad strikes… again!

Monday, July 11, 2011

On Cyberspace, Cyber Security, and War

By Jim Tiller, Vice President, Security Professional Services, North America, BT Global Services

Back in 2000/2001 I started giving a number of speeches about cyber war. Funny thing was, back then, most of the audience concluded I was simply nuts. The concept that a war could occur in cyberspace seemed so surreal to most people.

Given how reliant we are on the digital world I thought it was obvious that issues in cyberspace would have implications in the physical world and the two would eventually become inseparable. With the rash of cyber policies emerging from governments, the recent report that the Pentagon has noted that computer sabotage coming from another country can constitute an act of war is entirely predictable.

Today, technology – interconnected and interdependent technology – has become so integrated into how we function it’s nearly invisible. It’s not simply e-mail, Twitter, Facebook, cable TV, and iPads, but that’s what you see every day. Technology is what moves trains and trucks, electricity and water, food, fuel, and, importantly, money. It enables resources, such as emergency services, military, textiles, communication, transportation, and intelligence.

Technology, or more specifically cyberspace – a genera term representing a digital ecosystem – is a resource. And, it is a resource that has become essential to all other resources. As such, it is a force multiplier and can have far reaching effects. Although it may be hard to imagine, it is not beyond comprehension that a cyber-attack could result in the loss of life directly and indirectly. Disruptions in the digital world can have resonating impacts, most notably in the form of resource impedance, such as shutting off electricity, disabling the banking system, or shutting down the transportation infrastructure. It can affect production leading to economic instability and downstream civil unrest. We need to take a defensive stance to protect our resources, because without it, the country will dissolve and cyber space is no different from the other resources we seek to protect.

The resort to war is human and is usually a result over competition for resources. Accumulation of resources means power and, eventually, someone wants your resources and your power, or wishes harm against you because of your power. To ignore this is ignorance and denial resulting in being unprepared, ineffective, and, frankly, doomed.

So, what is my take on the Pentagon’s position? On a very basic level it is an acknowledgement of the importance of cyberspace as a resource, and this isn’t a bad thing. The point here is that, like it or not, an attack in cyberspace is quickly becoming indistinguishable from a physical attack and we must prepare, on many levels, for this outcome. I’m not suggesting you go off-grid, hide in a bunker, and fill your basement with food, water, and ammo… far from it. I’m saying understand the realities of the 21st century and recognize the entanglement of things we’ve tried too hard to view separately.

We need to come to grips with the importance of cyberspace, not only as a nation, but as a global community. I for one don’t. I don’t differentiate the relevance of cyberspace and our national infrastructure as separate resources. You can’t because the lines have grown so thin they are invisible. But know they are there and becoming more integrated and important every day.

Wednesday, May 18, 2011

Assessing Risk in the Mobile World: Part One

By Jill Knesek, Chief Security Officer, BT Global Services

One of the hottest topics at the CIO water cooler at the moment is the question of how we should deal with the risks posed by personal mobile devices in the workplace.

While some companies ban the use of personal devices or heavily restrict their use, BT allows the use of most mobile devices as long as ExchangeActiveSync is used to connect to MS Exchange servers. This allows for the BT password policy to be pushed to the device ensuring some basic level of security. For tablets, such as the iPad, they must have hard disk encryption installed and implemented to protect locally stored data and emails.

I know that some of my peers think this is a risky choice. But when my team and I assessed the risk, we found that risks associated with personal mobile devices is similar enough to a BT-supported device that the benefits of allowing their use outweighed the risks, with a few exceptions.

While our Ethical Hacking team can test all BT-supported devices and software, it is harder for them to test all hardware and software associated with personal devices. Instead, they focus on the security features that are present whether it is a BT-supported device or a personal one, such as password security and hard disk encryption.

In most cases, being aware of these two elements will mitigate risk to an acceptable level, but there are still areas of exposure around personal software and the ever-popular applications could undermine our risk assessment. The other aspect which has the potential to cause complications is that when a vulnerability is identified it is much more difficult to get the problem patched or fixed because the necessary contractual relationships are not in place.

So, if your company assesses that the business value of having a highly responsive, mobile workforce outweighs the risks posed by personal devices, what steps should your IT team implement to provide the most secure operating environment? The top five things that my team and I recommend are:

Conduct a robust security awareness program for employees on critical issues
Require that all software and apps be fully tested by the company
Require strong password policies and email encryption
Set policies such as webmail access only; regular data deletion, or classification rules for data storage
Require all devices be capable of remote wipe to ensure that sensitive data can be removed promptly once the loss or theft is reported

Friday, February 25, 2011

Getting Back to the Basics of IT Security

By Tara Savage, Senior Marketing Manager, BT Global Services

In the February issue of Bank Technology News, Ben Rothke explores how those responsible for securing the banking industry can get 2011 off on the right foot. He addresses issues ranging from accountability and the importance of an effective CISO to developing security policies and casting a critical eye on new technologies.

Ben says that getting back to basics in security is a must and can best be explained through this quote from the film, Bull Durham: “This is a very simple game. You throw the ball, you catch the ball, you hit the ball.” He draws an analogy between security and baseball — you encrypt the data, you decrypt the data, you use the data.

As 2011 starts, the key to data security is all simplicity and getting back to the basics.

Want to read more? Read Ben’s full article here.

Thursday, February 24, 2011

Security Crystal Ball 2011: Mobile Device Threats are On Trend

By Tara Savage, Senior Marketing Manager, BT Global Services

As highlighted back in October by BT’s CSO, Jill Knesek, threats to network security posed by mobile device use are on trend in the first few weeks of 2011. Eric Parizo of TechTarget’s Security Media Group has put together a great snapshot of studies highlighting these trends and the likely sources of infiltration and exploitation.

Eric rightly points out that ignoring these threats just because there is hype surrounding them at present is a fool’s errand. Whereas mobile device attacks were once a low-level threat, with the increasing platform homogenization, mobile device attacks are potentially lucrative for attackers. What is more interesting is this kernel from Nick Lewis, a security practitioner and SearchSecurity.com’s expert in residence, who points out that “another underestimated lure for attackers is the increasing use of mobile devices as a second factor of authentication for enterprise systems.”

To read more about what Eric and Nick have to say check out the full article here.

Monday, February 21, 2011

Smart Devices Give IT Departments Heartburn

By Sushila Nair, Product Manager, BT Counterpane

Drum roll please… and the big winner of the 2010 technology market is – Apple (gasp!). For most pundits, Apple’s ability to stream ahead in the marketplace was a surprise, as the prophets were poised to hand first place honors to the Android.

Apple sold more than three million iPads within the first 80 days and is on track to become the fourth largest consumer electronic category. Unlike other consumer toys, the growing problem is that smart devices like the iPad are sneaking into the corporate network, causing IT departments to suffer from heartburn.

The iPad is evolving in a way that excites consumers and is moving from simple apps to more complex apps that use location, social and cloud services. In response to the consumer excitement around the iPad, many corporations have allowed their employees to purchase these devices and use them to access company data. These companies see the cost savings of allowing employees to read company information while commuting and enabling employees to be instantly responsive using smart device technology.

As companies build Near Field Communication (NFC), these smart devices enable all kinds of possibilities — from opening car doors to paying for a drink at the vending machine. The vast possibilities of how consumers will use these devices in the near future will change the way that we interact with the world around us; all the way from the way we borrow library books to how we pay for the metro.

But the reality is that the new wave of adoption of smart devices has caught companies by surprise, and most organizations have no strategy to leverage this technology or secure it.

The Blackberry was aimed at a corporate market, and the backend was designed to enable the device to connect to corporate networks securely. However, the new generation of smart devices includes fun and consumer-oriented products, with the corporate applications more of an after-thought than a focus.

Apple is reportedly working to address this problem and bring in high level expertise to resolve the security issues inherent in iOS, Apple’s mobile operating system on the iPhone and iPad. The word is that Apple will be improving its encryption and enabling more effective centralized control; however, the focus for greater security does not lie solely with Apple.

Organizations need to really understand these devices and thoroughly envision the possibilities offered by these smart products as well as the risks.

The fact that so many of these smart devices are owned by the employee and yet contain corporate data is indicative of the fact that much like with Facebook, organizations are behind the curve on how to apply appropriate security measures in connection with the technology.

There is no doubt that there is a growth in organizations allowing and, in fact, encouraging un-trusted end points to access their corporate network. The solution then becomes to ensure that there are clearly defined security polices for smart devices and that these policies are communicated to the user base.

The policies should include and not be limited to ensuring these devices only connect through secure channels, have remote wipe capability, and the classification of data stored on these devices are in line with risk.

There’s no question, we are seeing a change to the way organizations work. And as we lose control over the end point, we need to increase control over the channel from the end point to the corporate network and monitor, monitor, MONITOR.

Monday, August 9, 2010

What CSOs Talk About at Dinner

By Jill Knesek, Chief Security Officer, BT Global Services

Last week I had the pleasure of meeting with some of Chicago’s outstanding CISOs and CSOs. We met for dinner to discuss those thorny and gnarly issues that keep us working overtime to make sure that our companies are secure and our employees excel at work. So, what was on our menu that night?

The first hot topic was methods of securing data across companies with disappearing perimeters. BT, like many companies, works to enable its workers to literally work anywhere to boost their productivity and enhance their work-life balance. But as the office walls disappear, new challenges abound.

While we touched on what value firewalls and IDSs provide, much more time was spent discussing endpoint security, such as personal firewalls, antivirus products and good patch management processes. I see particular value in hard disk encryption on laptops, which renders stored data nearly useless to thieves.

Obviously, mobile devices are top of mind for us. Not only do we have to worry about laptops — with more companies supporting a “BYOD” (bring your own device) policy, we have a whole new set of things to be concerned about. For example, it seems inevitable that companies will need to let employees bring their own hardware platform into the workplace. And, while we all love our iPads, iPhones, Blackberries, and Android phones, with hundreds of thousands of apps available for download and many thousands more becoming available each day, how do we secure them? While I wish I could say that we came up with a solution during dinner, this topic, for now, still generates more questions than answers.

The other topic that provoked a great deal of discussion as the economy emerges slowly from recession is how we secure new acquisitions. The biggest problem facing CSOs in this area is — how do we change the culture of a new acquisition without breaking the business model that made them a desirable target? But, the bottom line is that at the end of the day, CSOs are responsible for the security of all company assets, whether organic or acquired. From my view, the key is good communication with the acquired management team and a strong security awareness campaign, since employees remain our first line of defense. After that, it comes down to pure risk management and understanding the biggest threat against the acquired company — and mitigating that piece first.

And, from that discussion, we found ourselves deep in the nitty-gritty of Risk Management. I know this message is getting tired, but the reality is that having a mature risk management program with real stats and data to back up your risk register can be a great tool in communicating at the boardroom level. We can’t be Chicken Little, but we do need to rely on cold hard facts that resonate with the senior management team.

The example I used was how to relate a fraud case to the senior leadership team in terms of revenue lost from the bottom line. For example, if you lose $1 million in a fraud, how much revenue would it take to make up for that net loss? Well, if the revenue was from a service with a 15% margin, it would take nearly $7 million in new revenue to make up for the loss. Putting the cost of crime in terms of revenue helps the CFO and senior management appreciate the importance of reducing crime through security.

By the time we reached dessert, we’d hashed through these and other very interesting topics. And, while we didn’t come up with concrete solutions or definitive answers, we learned a lot from sharing our common experiences and unique responses.

I’d like to thank everyone who came and invite you all to carry on the conversation in cyberspace. Leave a comment below, or let me know what you think in the Security Leaders Group on LinkedIn.