More Related Content
What's hot (20)
Similar to How Healthcare CISOs Can Secure Mobile Devices (20)
![[Webinar] Why Security Certification is Crucial for IoT Success](https://cdn.slidesharecdn.com/ss_thumbnails/webinarwhysecuritycertificationiscrucialforiotsuccess-170722001838-thumbnail.jpg?width=560&fit=bounds)
How Healthcare CISOs Can Secure Mobile Devices
- 1. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 1 HOW HEALTHCARE CISOs CAN SECURE MOBILE DEVICES Jim Routh, CSO, Aetna Adi Sharabani, CEO, Skycure
- 2. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 2 Meet Your Speakers Jim Routh CSO Aetna Adi Sharabani Co-founder and CEO Skycure
- 3. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 3 Quick Housekeeping • Q&A panel is available if you have any questions • There will be time for Q&A at the end • We are recording this webinar for future viewing • All attendees will receive a copy of slides/recording Join the discussion #MobileThreatDefense
- 4. Aetna Inc. The Mobile Device is Our New Appendage 4 There are now more cell phones on the planet than there are people 90% of 19-29 year-olds in the U.S. sleep with their cell phones 65% of survey respondents said mobile phones make them better parents 75% of survey respondents bring their phones to the bathroom Apple Siri captures everything you say to her for 6 months and aggregates it for 18 months Social media apps have the ability to use your phone’s microphone to listen to your dialog What is the most commonly used mobile app? Source: Qualcomm, Slick Text Surveys The mobile phone is the best surveillance device in history
- 5. Aetna Inc. Mobile Security Landscape Security Changes New Interaction Opportunities Factors driving changes in mobile security • Frequent and shorter log-ins instead of long-on line sessions • Barriers to task completion • Improved customer experience using native features they are familiar with…information presented in a format using native features • No browser- the application needs hardening • Additive controls feasible • Mobile customers want more security to have confidence in the channel. Customer adoption is slower due to security concerns • Software distribution is a factor in security profile • Security vetting varies greatly • Fraudsters can scan mobile apps for vulnerabilities in app stores more easily • Mobile channel offers geo location, enhanced authentication capabilities (voice recognition, image and device attributes) • Mobile can potentially offer better customer experience (location of ATMs, identification in a branch, authentication to a CSR, voice commands, etc.) • 90% of 18-29 year olds sleep with their phone • 113 smartphones are lost or stolen every minute • The theft of cell phones makes up 30-40% of all robberies nationwide • Email, phone, browser used to be separate channels…now consolidating Consolidated Channels New Capabilities App Stores New Interaction Style Native Applications Security Sensitivity Proximity with user 5
- 6. Aetna Inc. Mobile Threats on the Rise 6
- 7. Aetna Inc. 7 The fourth dimension- Privacy Dimensions of Mobile Application Risk 1. Application Development 2. Software Distribution The mobile ecosystem 3. Device Configuration • Threat Models/Security features • Education & Developer Checklist • Application “wrapper” options • Root detection • Authentication • Security Test Selection Matrix • Static analysis • Dynamic scanning • Pen testing • Different stores have different security vetting procedures • The probability of “application collision” needs to be managed • Vetting mobile apps used by enterprise users for security and privacy • Does the app need to be tamper resistant? • Consumer • Code protection • Root/malware detection • Authentication • Channel verification • Enterprise • Mobile device configuration standard- MDM • Authentication controls • VPN channel Consumer Enterprise User
- 8. Aetna Inc. Aetna Mobile App Security SDLC Requirements Design Development Test Release Technical Design Patterns • Key management • Encryption (data in transit, data at rest) • Authentication • Version updates ENABLE VERIFY Static Analysis Dynamic ScanningThreat Modeling Design Patterns Ethical HackingOpen Source Risk Classification Mobile Mavens Mobile Security Software Training (Role-Based Curriculum) Preventive Detective Security Reqs Behavioral Auth SDK Code Protection DISTRIBUTE App Signing Process Guides 8
- 9. Aetna Inc. Threat Modeling / App Risk Assessment Key questions when threat modeling: • What are we building? • What information can be abused? • Are their flaws in the design? • How will the customer information captured be handled on which platforms? Benefits of threat modeling: • Early identification of security defects- lower cost • Increase product quality • Identify and understand security requirements 9
- 10. Aetna Inc. Static Source Code Analysis • Performed during development cycle • Includes exhaustive review of code quality (E.g. Objective-C, Java or C#), security and privacy issues • Goal to decrease defects during development lifecycle which results in longer term savings • Benefits • Immediate feedback and learnings for developers • Explicit references to areas needing attention • Developer oversights • Increase product quality Scan Results 10
- 11. Aetna Inc. 11 Next Generation Authentication • Binary authentication is obsolete • Behavioral- based model is key • Innovation applied to the interface Authentication Hub LOA Advanced Analytics Risk Score API Dynamic LOA API Backend Analytics & Risk Engine Prevent @ Inception RT Push+TouchID iWatch & Sign Out Wearables + T/Haptic Spatiotemporal + Real-Time (RT) Authorization SWIPE + Contextual SWIPE + TAP Advanced Contextual Cognitive & Device Biometrics FIDO UAF 1.0 FIDO 2.0 When Available Decentralized Authentication The mobile device provides an opportunity to improve authentication
- 12. Aetna Inc. Brand Protection – Tamper Resistance 12 • Reduce ability to perform app store scan for security vulnerabilities • Increase difficulty for attackers to create malware attacking our applications • Reduce ability to create clone applications • Provide brand protection
- 13. Aetna Inc. Brand Protection – App Store Monitoring 13
- 14. Aetna Inc. The 2 Most Widely Exploited Mobile Vulnerabilities 14 Apps for Android 314,000,000 hits TLS is broken Any credentials shared are exposed
- 15. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 15© 2015 Skycure Inc. Mobile Attack Vectors
- 16. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 17 Mobile Security Trends in Healthcare Exclusive Preview Source: Skycure Mobile Threat Report TREND High Risk 2.39% Minimal Risk 31.78% Low Risk 24.43% Medium Risk 41.40% Report is available here: goo.gl/DJc5IF
- 17. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 18 Mobile Threat Landscape Physical Network Vulnerabilities Malware
- 18. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 19 Physical Network Vulnerabilities Malware Physical Threats Addressed by our partners
- 19. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 20 % of doctors accessing patient data and exposed to network threats NUMBER OF DOCTORS SHARING DATA THROUGH… Network Threats Mobile devices connect to x100 more networksPhysical Network Vulnerabilities Malware Man in the Middle WifigatePineapple arpspoofdnsspoof SSL stripping SSL decryption Content manipulation https://www.youtube.com/watch?v=F9qIgSRD5vs
- 20. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 21 Malware Now affects iOS as wellPhysical Network Vulnerabilities Malware AndroidGoogle Play Store Apple AppStore ”Chinese” Stores XcodeGhost YiSpecter Repackaged Apps Malicious Profiles iOS NUMBER OF ANDROID DEVICES WITH MALICIOUS APPS INSTALLED NUMBER OF ANDROID DEVICES WITH AT LEAST ONE MEDICAL APP AND HIGH RISK MALWARE
- 21. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 22 Vulnerabilities Organized & directed effort from hackers 0 50 100 150 200 250 300 350 400 2007 2008 2009 2010 2011 2012 2013 2014 2015 Number of CVEs Trajectory (Apr 15') 0 50 100 150 200 250 300 350 400 2007 2008 2009 2010 2011 2012 2013 2014 2015 Number of CVEs Physical Network Vulnerabilities Malware iOS Vulnerabilities Source: Skycure analysis based of CVEdetails.com PERCENTAGE OF MOBILE DEVICES RUNNING OS WITH HIGH-SEVERITY VULNERABILITIES AND STORED PATIENT DATA Accessibility Clickjacking No iOS Zone Cookie Stealer HRH WiFiGate LinkedOut
- 22. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 23 Skycure Solution Overview Mobile Threat Intelligence Platform Physical Network Vulnerabilities Malware • Policy enforcement • Risk-based management • Enterprise integrations • Visibility Security Visibility IT Satisfaction Management • 24x7 detection and protection • Network, device and app analysis • Multi platform Seamless experience Privacy Minimal footprint End-User App 1 Million+ Global Threats Identified https://maps.skycure.com Crowd Wisdom Millions of monthly tests - apps & networks Skycure Research No iOS Zone, Malicious Profiles, WiFiGate, LinkedOut Threat Aggregator Dozens of threat feeds from 3rd parties Legitimate Services Attackers & Threats
- 23. Title of Presentation DD/MM/YYYY© 2016 Skycure Inc. 24 Assess Your Mobile Risk Request a Free Trial: http://skycure.com/trial