BYOD Security Scanning
•
2 gefällt mir•26,483 views
The document discusses the requirements for effective BYOD (Bring Your Own Device) security scanning. It states that BYOD security scanning must be able to identify vulnerabilities, configuration issues, and sensitive data on devices regardless of location. It outlines five key requirements for BYOD security scanning solutions: 1) Integrate with existing business technologies, 2) Not require scheduled scans, 3) Support mobile devices through native apps, 4) Not require device credentials, and 5) Be cloud-based to scan devices anywhere. The document emphasizes that legacy scanning is insufficient for securing mobile endpoints and a new approach is needed to address BYOD challenges.
Empfohlen
Weitere ähnliche Inhalte
Andere mochten auch
Ähnlich wie BYOD Security Scanning
Ähnlich wie BYOD Security Scanning (18)
Mehr von MAX Risk Intelligence by LOGICnow
Mehr von MAX Risk Intelligence by LOGICnow (7)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
BYOD Security Scanning
- 4. ! BYOD!Security!Scanning!What!You!Need!To!Know! ! Copyright!©!2013!iScan!Online,!Inc.! 4! network!scanning!solutions!have!little!or!no!ability!to!assess!tablets,!smartphones,!laptops!or!other! devices!as!they!dynamically!access!the!network,!applications!and!data.! ! ! The!demands!of!security,!risk!and!compliance!management!require!BYOD!security!scanning!to!do!more! than!look!for!common!vulnerabilities.!As!stated!earlier,!scanning!for!secure!configurations!and! identifying!confidential!data!such!as!primary!account!number!(PAN)!credit!card!data!or!personal!health! information!(PHI)!are!also!mandatory!for!BYOD!security!scanning.! ! The!world!of!mobile!connectivity!introduces!new!challenges!for!identifying!risks,!threats,!and!achieving! compliance.!This!mobile!world!also!requires!that!scanning!technologies!adapt!to!today’s!networks.!It!is! not!practical!or!technologically!sound!to!deploy!appliances!and!complex!software!in!an!attempt!to! secure!BYOD!devices!and!other!endpoints!that!are!mobile!and!not!static.!! ! BYOD*Security*Scanning*–*The*5*Requirements** What!should!an!organization!look!for!in!a!robust!Bring!Your!Own!Device!Security!Scanning!solution?! These!are!the!requirements!of!an!enterpriseVclass!BYOD!scanning!system.! 1. Integrates*With*Your*Business* Many!organizations!have!spent!millions!of!dollars!acquiring!and!developing!technology!to! support!remote!and!mobile!workers.!These!solutions!range!from!web!applications!to!traditional! IT!management!for!computing!devices.!To!ensure!seamless!and!effective!scanning,!BYOD! security!scanning!solutions!should!provide!out!of!the!box!integration!with!these!existing! business!technologies!to!initiate!the!scanning!process.!Some!examples!of!these!solutions!are:!! • Endpoint!Management!solutions! • Remote!Monitoring!and!Management! • Single!SignVon! • Web!Application!Portals! • Email!and!Calendaring!Applications! 2. Schedule*Not*Required* Because!BYOD!implies!that!employees!are!free!to!move!on!and!off!the!network!on!their!own! schedule,!it!also!means!that!security!scanning!technologies!cannot!depend!on!network!locations! or!scheduled!times.!Scans!must!be!triggered!by!events!rather!than!by!IP!address!ranges!and! specific!points!in!time.! According!to!Cisco’s!IBSG!2012! BYOD!report,!47%!of!employees! are!considered!“mobile! workers”!but!60%!of!employees! use!a!mobile!device!for!work.!
- 5. ! BYOD!Security!Scanning!What!You!Need!To!Know! ! Copyright!©!2013!iScan!Online,!Inc.! 5! 3. Support*Mobile*Devices*with*Native*Apps* There!is!no!reliable!way!to!assess!a!smartphone!or!tablet!without!the!presence!of!a!native!app! on!the!device.!Providing!a!native!app!assures!that!the!results!derived!from!the!scan!are!accurate! and!upVtoVdate.!To!ensure!global!distribution!and!conformity!to!any!operating!system!API! restrictions,!native!device!apps!should!be!distributed!via!the!device!type’s!authorized! application!store.! 4. No*Credentials*Required* Because!of!the!“Y”!in!BYOD,!it!is!virtually!guaranteed!that!IT!departments!will!not!have! administrative!access!to!these!devices.!This!presents!serious!challenges!for!most!security! assessment!technologies.!Any!solution!that!delivers!BYOD!security!scanning!should!provide! scanning!without!requiring!administrative!credentials!on!the!device.!The!scan!process!should! execute!as!part!of!normal!user!operation!and!should!not!prompt!the!user!for!privilege!escalation! or!interfere!with!their!normal!work.! 5. Built*For*The*Cloud* There!are!many!types!of!mobile!workers!and!BYOD!situations,!and!many!home!office!and! remote!personnel!may!never!actually!connect!directly!to!the!corporate!network.!However,! these!devices!need!to!be!assessed!no!matter!where!they!are!located.!BYOD!security!scanning! solutions!should!provide!the!ability!to!assess!devices!from!the!cloud,!allowing!organizations!to! secure!those!devices!regardless!of!their!location!or!network!connection.! ! ! ! iScan*Online*Delivers*BYOD*Security*Scanning* The!BYOD!phenomenon!is!revolutionizing!vulnerability! scanning!in!the!enterprise!environment.!IT!administrators! who!traditionally!scheduled!vulnerability!scanning!during!off! hours,!now!find!those!routine!scans!are!missing!many!of!the! actual!endpoints!that!access!their!corporate!data!and! applications.!Because!many!devices!are!not!on!the!network! when!scans!are!performed!or!the!scanning!technology! doesn’t!assess!the!particular!type!of!device,!or!because! administrative!credentials!are!required—the!devices!will!be! missed!by!previousVgeneration!assessment!and!remediation! efforts.! ! The!consequences!can!be!dire.!The!2012!Verizon!Breach! Report!indicates!that!60%!of!all!compromised!assets!were!user!owned!devices.!Fortunately,!these!types! of!breaches!are!avoidable!with!proper!vulnerability!detection!and!remediation!of!user!owned!devices.! ! Just!as!BYOD!ushered!in!more!dynamic!and!adaptive!ways!of!computing,!iScan!Online!delivers!scanning! technology,!which!can!be!deployed!in!a!dynamic,!easy!and!cost!effective!manner.!iScan!Online!works!in! the!way!that!users!work,!and!provides!visibility!in!to!the!security,!compliance!and!risk!posture!of!their! devices.!
- 9. ! BYOD!Security!Scanning!What!You!Need!To!Know! ! Copyright!©!2013!iScan!Online,!Inc.! 9! Out*Of*The*Box*Scanning* iScan!Online!provides!out!of!the!box!integration,!including!templates!and!examples!for!a!variety!of! systems!management,!remote!management!and!office!productivity!solutions!including:! ! 1. Microsoft!Active!Directory! 2. LogMeIn! 3. Kaseya! 4. Web!Applications! 5. Email!/!Calendaring! ! ! ! * * Opportunity*Knocks* iScan!Online!BYOD!scans!are!not!based!on!the!outdated!limitations!of!network!discovery,!IP!addresses! or!time!schedules—but!on!the!natural!opportunities!to!assess!a!device.!These!opportunities!present! themselves!based!on!the!types!of!devices!and!scan!deployment!strategies!selected!by!the!organization.! Consider!these!deployment!strategies:! ! • Using!iScan!Online’s!web!application!methodology,!devices!can!be!assessed!during!the!web!app! authentication!process.! • Using!iScan!Online’s!email!/!calendaring!templates,!users!could!simply!be!reminded!to!visit!a! URL!to!initiate!a!scan.! • Using!iScan!Online’s!JavaScript!templates,!scanning!can!be!integrated!into!web!content!filtering! or!other!proxy!based!solutions! ! These!scan!deployment!strategies!highlight!iScan!Online’s!opportunistic!approach!to!scanning.!This! allows!devices!to!be!identified!and!assessed!as!they!are!accessing!corporate!resources,!not!just!based!on! a!schedule!or!block!of!IP!addresses.! ! ! Expert*Tip*#3* iScan!Online’s!out!of!the!box!integrations!addresses!BYOD!Security!Requirement!#1.! Expert*Tip*#4* iScan!Online’s!opportunistic!approach!addresses!BYOD!Security!Requirement!#2.!