psilva's prophecies: October 2012

Tuesday, October 30, 2012

In 5 Minutes or Less: BIG-IP ASM & Cenzic Scanner

I show you in this special extended edition of In 5 Minutes or Less, how BIG-IP ASM is integrated with Cenzic Hailstorm Scanner for complete website protection. From vulnerability checking to detection to remediation, With a few clicks, you can instantly patch vulnerabilities.

Resources:

BIG-IP Application Security Manager
F5 and Cenzic partnership
In 5 Minutes or Less Series (22 videos – over 2 hours of In 5 Fun)
F5 YouTube Channel

Technorati Tags: F5,big-ip,security,management,infrastructure,big data,cloud,waf,asm, analytics,cenzic,video

Connect with Peter:	Connect with F5:

Tuesday, October 23, 2012

BYOD Policies – More than an IT Issue Part 5: Trust Model

#BYOD or Bring Your Own Device has moved from trend to an permanent fixture in today's corporate IT infrastructure. It is not strictly an IT issue however. Many groups within an organization need to be involved as they grapple with the risk of mixing personal devices with sensitive information. In my opinion, BYOD follows the classic Freedom vs. Control dilemma. The freedom for user to choose and use their desired device of choice verses an organization's responsibility to protect and control access to sensitive resources. While not having all the answers, this mini-series tries to ask many the questions that any organization needs to answer before embarking on a BYOD journey.

Enterprises should plan for rather than inherit BYOD. BYOD policies must span the entire organization but serve two purposes - IT and the employees. The policy must serve IT to secure the corporate data and minimize the cost of implementation and enforcement. At the same time, the policy must serve the employees to preserve the native user experience, keep pace with innovation and respect the user's privacy. A sustainable policy should include a clear BOYD plan to employees including standards on the acceptable types and mobile operating systems along with a support policy showing the process of how the device is managed and operated.

Some key policy issue areas include: Liability, Device Choice, Economics, User Experience & Privacy and a Trust Model. Today we look at Trust Model.

Trust Model

Organizations will either have a BYOD policy or forbid the use all together. Two things can happen if not: if personal devices are being blocked, organizations are losing productivity OR the personal devices are accessing the network (with or without an organization's consent) and nothing is being done pertaining to security or compliance.

Ensure employees understand what can and cannot be accessed with personal devices along with understanding the risks (both users and IT) associated with such access. While having a written policy is great, it still must be enforced. Define what is ‘Acceptable use.’ According to a recent Ponemon Institute and Websense survey, while 45% do have a corporate use policy, less than half of those actually enforce it.

And a recent SANS Mobility BYOD Security Survey , less than 20% are using end point security tools, and out of those, more are using agent-based tools rather than agent-less. According to the survey, 17% say they have stand-alone BYOD security and usage policies; 24% say they have BYOD policies added to their existing policies; 26% say they "sort of" have policies; 3% don't know; and 31% say they do not have any BYOD policies. Over 50% say employee education is one way they secure the devices, and 73% include user education with other security policies.

Organizations should ensure procedures are in place (and understood) in cases of an employee leaving the company; what happens when a device is lost or stolen (ramifications of remote wiping a personal device); what types/strength of passwords are required; record retention and destruction; the allowed types of devices; what types of encryption is used. Organizations need to balance the acceptance of consumer-focused Smartphone/tablets with control of those devices to protect their networks. Organizations need to have a complete inventory of employee's personal devices - at least the one’s requesting access. Organizations need the ability to enforce mobile policies and secure the devices. Organizations need to balance the company's security with the employee's privacy like, off-hours browsing activity on a personal device.

Whether an organization is prepared or not, BYOD is here. It can potentially be a significant cost savings and productivity boost for organizations but it is not without risk. To reduce the business risk, enterprises need to have a solid BYOD policy that encompasses the entire organization. And it must be enforced.

Companies need to understand:

• The trust level of a mobile device is dynamic

• Identify and assess the risk of personal devices

• Assess the value of apps and data

• Define remediation options

• Notifications

• Access control

• Quarantine

• Selective wipe

• Set a tiered policy

Part of me feels we’ve been through all this before with personal computer access to the corporate network during the early days of SSL-VPN, and many of the same concepts/controls/methods are still in place today supporting all types of personal devices. Obviously, there are a bunch new risks, threats and challenges with mobile devices but some of the same concepts apply – enforce policy and manage/mitigate risk As organizations move to the BYOD, F5 has the Unified Secure Access Solutions to help.

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability,web,internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

Monday, October 22, 2012

BYOD Policies – More than an IT Issue Part 4: User Experience and Privacy

Some key policy issue areas include: Liability, Device Choice, Economics, User Experience & Privacy and a trust Model. Today we look at User Experience & Privacy.

User Experience and Privacy

Most application deployments have the user experience in mind and BYOD is no different. Employees want and need fast and secure access to the right resources, at the right time to accomplish their job. BYOD only enhances or increases the need for a rich user experience. Understand how the policy impacts user experience including battery life. Some apps can drain battery life quickly, which in turn decreases user satisfaction and can potentially limit their interactions. There may be instances where the user has chosen a third-party email application verses either the native email client or one that's supported by corporate. Certainly a dilemma but as stated earlier, a policy should state what's allowed and not allowed. MDM technology is also improving to the point that Secure apps like a browser, email client and other resources are secured on the client device. A user can still use their email client of choice for personal use but work email is delivered through the secure email client.

While user experience can contribute to the happiness and productivity of the user/employee, privacy can be a huge issue when BYOD is implemented. A 2010 Supreme Court case, City of Ontario v. Quon, looked at the extent to which the right to privacy applies to electronic communications in a government workplaces. This case also looked at Fourth Amendment rights against unreasonable search and seizure. Essentially, a number of police officers were fired for sending sexually explicit message with a city issued device. The city requested an audit of the overages along with the sent messages. The officers sued since the agreement/policy they had with the city allowed them to send personal notes and pay for any overages that might occur. Plus they claimed that their constitutional right was violated along with their privacy under federal communications laws. The court ruled that since they were using city issued devices, the municipality was well within their rights to search since it was work related and it had not violated the Fourth Amendment. If everything was the same but the devices were personally owned by the officers in question, then the city could be in violation and liable.

Within the BYOD policy, organizations should also establish a social contract that communicates how and when IT will monitor the device along with when/how/why a device could be wiped.

As part of the BYOD Policy the User Experience & Privacy Checklist, while not inclusive, should:

· Identify what activities and data must be monitored

· Determine the circumstances when a device wipe must occur

· Determine how employees can self-remediate

· Determine which core services will be delivered to users

· Draft a BYOD social contract with Human Resources

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web,internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

Thursday, October 18, 2012

BYOD Policies – More than an IT Issue Part 3: Economics

Some key policy issue areas include: Liability, Device Choice, Economics, User Experience & Privacy and a trust Model. Today we look at Economics.

Many organizations look at BYOD as an opportunity to reduce some costs. Clearly, not having an equipment cost - $200-$600 per-device - can add up depending on the company's size. It might also make financial sense for a smaller company with few employees. Since the phone is owned by the employee, then they are probably responsible for the bill every month. Depending on their personal contract/plan, excessive charges could arise due to the extra minutes used for work related calls. Often, monthly charges are fairly consistent with established plans, and while there are times when the bill is higher due to an incidental charge to some other overage, many people fail to review their phone bill when it arrives. BYOD could force employees into a higher monthly service plan but it also gives users visibility into their usage, if for instance, the corporate BYOD policy allows for reimbursement. This can drive personal responsibility for how they use their minutes.

While BYOD could reduce the overall expenditure for IT issued devices and many organizations report employees are happier and more productive when they are using the device of their desire (an enablement tool), there might be other areas that costs could increase. While the employee does spend their own money on the device, there are certainly enterprise costs to managing and securing that device. There could also be a snag however when it comes to licensing. Does BYOD also require Bring Your Own License? In many instances, this is an area that IT needs to keep an eye on and often the answer is yes.

Some of the most common enterprise software licensing agreements require licensing any device used "for the benefit of the company" under the terms of the enterprise agreement. That often means that all those BYO devices might require a license to access common corporate applications. This also means that even if the user already has a particular license, which they purchased on their own or it came with the device, the organization might still need to license that device under their enterprise software agreement. This could diminish any cost savings from the BYOD initiative. There are solutions to such as using alternative products that are not restricted by licensing but, those may not have the key features required by the workforce. IT needs to understand if their license agreements are per-user or per-device and what impact that may have on a BYOD policy.

A few questions that the Finance department should determine is: Should the company offer users a monthly stipend? How is productivity measured? Will the management and security cost more than IT (volume) procurement? What are the help desk expenses and policy about support calls. There certainly needs to be discussion around mobile app purchase and deployment for work use. Are there any compliance, additional audit costs or tax implications with a BYOD initiative?

As part of the BYOD Policy the Economics Checklist, while not inclusive, should:

· Investigate the effects of a BYOD reimbursement plan on your ability to negotiate with wireless carriers

· Consider putting logging and reporting in place to monitor after-hours use

· Incorporate a “help desk as a last resort” guideline into your employee BYOD social contract

· Estimate costs for any increased need for compliance monitoring

· Ask Finance about tax implications (cost or benefit) of a BYOD policy

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

Wednesday, October 17, 2012

BYOD Policies – More than an IT Issue Part 2: Device Choice

Some key policy issue areas include: Liability, Device choice, Economics, User Experience & Privacy and a trust Model. Today we look at Device Choice.

Device Choice

People have become very attached to their mobile devices. They customize and personalize and it's always with them, to the point of even falling asleep with the device. So ultimately, personal preference or the 'consumerization of IT' notion is one of the primary drivers for BYOD. Organizations need to understand, what devices employees prefer and what devices do employees already own. That would could dictate what types of devices might request access. Once organizations get a grasp on potential devices, they then need to understand each device's security posture.

About 10 years ago, RIM was the first technology that really brought the Smartphone into the workplace. It was designed to address the enterprise's needs and for years was the Gold Standard for Enterprise Mobility. Management control was integrated with the device; client certificate authentication was supported; Active Directory/LDAP servers were not exposed to the external internet; the provisioning was simple and secure; organizations could manage both Internet access and intranet access, and IT had end point control.

When Apple's iPhone first hit the market, it was purely a consumer device for personal use and was not business centric, like the BlackBerry. Initially, the iPhone did not have many of the features necessary to be part of the corporate environment. It was not a business capable device. It did not support applications like Exchange, which is deployed in many organizations and is critical to a user's day-to-day activities. Over time, the iPhone has become a truly business capable device with additional mechanisms to protect end users. Android, very popular with consumers, also offers numerous business apps but is susceptible to malware.

Device selection is also critical to the end user experience. Surveys show that workers are actually more productive when they can use their personal smartphone for work. Productivity increases since we prefer to use our own device. In addition, since many people like to have their device with them all the time, many will answer emails or do work during non-work hours. A recent survey indicated that 80% of Americans work an extra 30 hours a month on their own time with BYOD. But we are much happier.

A few blogs ago, I wrote about Good Technology’s BYOD survey, found that organizations are jumping on the phenomenon since they see real ROI from encouraging BYOD. The ability to keep employees connected (to information) day and night can ultimately lead to increased productivity and better customer service. They also found that two of the most highly regulated industries - financial services and health care - are most likely to support BYOD. This shows that the security issues IT folks often raise as objections are manageable and there's major value in supporting BYOD. Another ROI discovered through the survey is that since employees are using their own devices, half of Good’s customers don't pay anything for the employees' BYOD devices – essentially, according to Good, getting employees to pay for the productivity boost at work.

As part of the BYOD Policy the Device Choice Checklist, while not inclusive, should:

· Survey employees about their preferences and current devices

· Define a baseline of acceptable security and supportability features

· Do homework: Read up on hardware, OS, and regional variances

· Develop a certification program for future devices

· Work with Human Resources on clear communication to employees about which devices are allowed–or not–and why

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

Tuesday, October 16, 2012

BYOD Policies – More than an IT Issue Part 1: Liability

Enterprises should plan for rather than inherit BYOD. BYOD policies must span the entire organization but serve two purposes - IT and the end users. The policy must serve IT to secure the corporate data and minimize the cost of implementation and enforcement. At the same time, the policy must serve the employees to preserve the native user experience, keep pace with innovation and respect the user's privacy. A sustainable policy should include a clear BOYD plan to employees including standards on the acceptable types and mobile operating systems along with a support policy showing the process of how the device is managed and operated.

Some key policy issue areas include: Liability, Device choice, Economics, User Experience & Privacy and a trust Model. Today we look at Liability.

Liability

In addition to IT, an organization's Legal department needs to be involved with any BYOD policy creation to make sure the liability risk for both the user and company is contained and managed. While employees are an organization's greatest asset (other than Intellectual Property, potentially), they are often the culprits of data exposure, intentional or not. Organizations need to consider employee actions and the corresponding liability. If the employee owns the device, does the liability increase or decrease? Even if liability stays neutral, the overall business risk increases any time corporate data is accessed from personal employee devices, mobile or not.

What happens if personal data on a personal Smartphone is damaged? What happens if it's remotely wiped by corporate IT, if it is lost? These are some areas that must be resolved with the BYOD policy. Some organizations are very clear about lost/stolen policy and users have the choice of opting out. That's just the personal liability.

From a financial liability standpoint, what happens when monthly charges are reimbursed? Often, financial responsibility may dictate legal obligation.

A recent Ponemon Institute and Websense survey showed that mobile devices can be a double-edge sword for enterprises. 77% of the 4640 responses said that the use of mobile devices in the workplace is important to achieving business objectives but almost the same percentage - 76% - believe that these tools introduce a "serious" set of risks. While organizations understand the risks, the survey showed that only 39% have security controls in place to mitigate them. As a result, 59% of respondents said they’ve seen a jump in malware infections over the past 12 months due, specifically, to insecure mobile devices including laptops, Smartphone, and tablets while 51% said their organization has experienced a data breach due to insecure devices.

As part of the BYOD Policy the Liability Checklist, while not inclusive, should:

· Define baseline security requirements

· Assess liability of personal web and app usage

· Evaluate legal ramifications of reimbursement

· Quantify the costs of monitoring and enforcement

· Assess the risk and liability of damaging personal data

There are probably a ton more Liability questions that should be answered but this was intended as a starting point. What other areas should legal be concerned about?

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

Thursday, October 11, 2012

The Evolution of Trade Show Badges

I’ve been to a few trade shows over the years and have noticed a change in the badges we wear at these events. These wear-for-a-week necklaces offer our name, company, job title and our affiliation to the specific conference – speaker, exhibitor and so forth. Some are high-tech also. I have many from years ago that are printed on heavy paper stock to the ones that are on a blank piece of plastic. I even remember the old sticker ‘HELLO’ name badges from some early conferences. These days, many have embedded chips, printed bar codes and QR codes for the booth lead scanners along with verifying that certain people have the proper credentials (full conference vs. expo only) to attend specific sessions. Yes, technology has even infiltrated our trade show badges. I would imagine that a decade from now, the badges would have a little LCD/LED (or whatever the hologram technology is in 10 years) screens on the back of the badge and that would allow you to watch the current keynote right from the badge itself! Now, that would be cool.

I especially like the badges that have a slew of identifiers hanging off the bottom. You’ve seen them, the ones with speaker, alumni, distinguished something, superhero, all hanging like the flags at the U.N. They could double as a tie depending on length and color.

Even the piece that we put around our neck has changed to some extent. The thin rope type seem to be fading into the more flat ribbon type with the sponsor’s name printed down the sides. Those are a lot more comfortable but I can’t seem to keep the name part facing forward. Oh yes, there are those clips with the ball-joint to twist the badge yet mine always seems backwards. Of course those are the single clip kind in the middle but there are also the double clip that does keep the badge forward. Sometimes analysts like to keep their badge flipped so you can’t tell who they are in an attempt to converse and have you potentially spill something that should not be shared with an industry analyst. All mesmerizing stuff, I know.

So as TV’s, smartphones, computers, cars and all those other obvious technology type advances astound, don’t forget about all the other ancillary things we use that are also making advances, albeit not as splashy. And if you’re wondering what events F5 will be at, check out our Events calendar on the newly redesigned f5.com

Resources:

Technorati Tags: F5, data breach report, threats, Pete Silva, security, malware, technology, smartphone, cyber-threat, social engineering, attacks, virus, vulnerability, web, internet, cybercrime, identity theft, scam, data breach

Connect with Peter:	Connect with F5:

psilva's prophecies

Tuesday, October 30, 2012

In 5 Minutes or Less: BIG-IP ASM & Cenzic Scanner

Connect with Peter:

Connect with F5:

Tuesday, October 23, 2012

BYOD Policies – More than an IT Issue Part 5: Trust Model

Monday, October 22, 2012

BYOD Policies – More than an IT Issue Part 4: User Experience and Privacy

Thursday, October 18, 2012

BYOD Policies – More than an IT Issue Part 3: Economics

Wednesday, October 17, 2012

BYOD Policies – More than an IT Issue Part 2: Device Choice

Tuesday, October 16, 2012

BYOD Policies – More than an IT Issue Part 1: Liability

Thursday, October 11, 2012

The Evolution of Trade Show Badges

Search This Blog

Followers

Blog Archive

About Me