James F. Fox MENA Cyber Security Practice Lead Presenters Cyber Security in a Mobile and “Always-on” World Booz | Allen | Hamilton

Let me tell you a story… About a man… … his phone…

… and his Bank. Normally this is a private affair… Normally.

Today is something different Someone is watching Everything on the phone EVERYTHING…

So when the man uses his phone to do a money transfer… …Something different is happening today

Someone is in the middle with a front row seat to everything …This watcher sees what they see… … anything that happens on the phone… … data, SMS, transmissions… …anything. How Did This Happen? This means that they can do whatever the man can do

The man’s phone has been hacked… … and now gives up all of its secrets.

Who does this? But more and more… …it’s a team… …who isn’t? Single Hackers Script Kiddies A better question… …and a Business Hacker, Inc. For All Your Nefarious Needs Over 5,000,000 Hacked

Today hacking is self service …and it is just getting started. About as difficult as buying on Amazon… How-to Guides Custom Made Malware “Renting” Infected Machines Today cyber attack are: Easy to build Uses highly paid specialists Highly distributed Are “For Profit” Today cyber attack are: Easy to build Uses highly paid specialists Highly distributed Are “For Profit”

How can the enterprise protect itself? Mobile App Data In-motion Mobile Backend You need to protect it all. Any vulnerability at any layer creates a path to a successful exploit

Bad actors take advantage of all of the vulnerabilities… Mobile Comms Mobile AppBackend Infrastructure Application Back Doors Decompiling an Application Abuse of a Device Feature Successful Exploit Borrowed or Stolen Device Mobile Web Service Attack …so you have to protect against all of them

Mobile Application Mobile Communication Backend Infrastructure Borrowed or Stolen Device Application Back Doors Mobile Web Service Attack Decompiling an Application Abuse of a Device Feature Successful Exploit We need to develop strategies that address each of the threats Protection or Control

How do they hack a phone? How Can a Phone Hack Happen? Stolen Device Installing a Malicious App Attacks on the Mobile Backend Modifying a Trusted App Abuse of a Device Feature There are 5 ways… … and only one needs to work

There are ten mobile app vulnerabilities to address… Source: OWASP Insecure Data Storage 1 1 Weak Server Side Controls 2 2 Transport Layer Penetration 3 3 Client Side Injection 4 4 Poor Authentication 5 5 Improper Session Handling 6 6 Security Decisions via Untrusted Inputs 7 7 Side Channel Leakage 8 8 Broken Encryption 9 9 Sensitive Data Disclosure 10

Key Mobile Security “Take Aways” 6 Key Points To Remember There is no Silver Bullet to Mobile App Security Use Defense-in-Depth Follow a Stringent Process During App Dev Do not Integrate Mobile Apps Directly into the Enterprise Test, Test, Test… Third Party Code Review & Pen-Testing

James F. Fox MENA Cyber Security Practice Lead Mobile Presenters Thank You!

17