1. www.mobilevce.com © 2005 Mobile VCE Securing the Future: Device & Service Security Stephen Hope, FT R&D UK Ltd on behalf of Nigel Jefferies, Vodafone Chair of Core 4 Security Industry Steering Group

2. www.mobilevce.com © 2005 Mobile VCE The Increasing Importance of Security  Security has featured as a growing element in previous Core programmes Core 1 – no work on security Core 2 – agent security Core 3 – security for the Personal Distributed Environment and for Interworked Networks  Strong industrial wish for a dedicated work area Reflecting the recognition of … Increasingly ‘open’ terminals (Java, Smartphones) Increasing internetworking And, hence, increasing vulnerability and importance

3. www.mobilevce.com © 2005 Mobile VCE The Challenge of Consumer Privacy A Future of Ubiquitous Personal Services enabled by Wireless poses new challenges Successful services must deliver user confidence If the user feels threatened, he won’t use them Potential threats to users? Context and behaviour Awareness and concern, regulation Criminal threats Solutions Modify protocols Control gathering of information Management process, audit

4. www.mobilevce.com © 2005 Mobile VCE The Challenge of the Enterprise Traditional perimeter techniques no longer suffice WLAN, BT, Cellular, Ad Hoc create holes in the wall … Systems are needed that detect and react, not just prevent Need to integrate intrusion detection with dynamic adaptation of the system Contact with the Jericho Forum The Jericho Forum is an Industry body comprising enterprise users across finance, aerospace, pharmaceutical, etc sectors, and the IT industry suppliers to these sectors currently lacks significant involvement from the telcos which provide the connectivity between enterprises and to their staff They see ‘de-perimeterization’ as already happening Support research work in this area

5. www.mobilevce.com © 2005 Mobile VCE The Challenge of Establishing Trust What do we mean by trust? The network operator demonstrates trust when he allows a device to access to his network The user demonstrates trust when he accesses a service or downloads software or content Changes as we move to future How do we establish trust in dynamic, ad hoc, networks ? There exists a lack of established trust hierarchies Need to establish trust when delivering new ubiquitous services across heterogeneous networks owned by third parties over which an operator may have minimal control

6. www.mobilevce.com © 2005 Mobile VCE Programme Structure Identity management and user privacy Enterprise security in the mobile world Trust Models Scenarios/ System/ Architecture Scenarios/ System Architecture Programme Structure Exploring funding options with both DTI and EPSRC Have raised issues with Cyber Security KTN

7. www.mobilevce.com © 2005 Mobile VCE Privacy and Trust Assurance Overcome obstacles preventing full realisation of the possibilities of wireless systems Future device relationships will be considerably more complex and dynamic, including ad hoc peer-to-peer, as well as client-server User privacy concerns and regulatory issues Enabling mobile users to enjoy the benefits of ubiquitous services that meet their requirements for privacy Approach Management of multiple user 'identities’ Maintenance of user privacy Establishment of trust relationships for mobile devices Exploit trusted hardware to help establish inter-device trust

8. www.mobilevce.com © 2005 Mobile VCE Enterprise Security Acknowledge the trend of ‘De-Perimeterisation’ Network topology is dynamic with wireless No ‘interior’ Ad Hoc, Peer-to-Peer Centralized IDSs are no longer adequate Approach Develop innovative functionality to enable IDSs to be deployed and managed across corporate networks incorporating dynamic and mobile wireless components Build upon security concepts developed for the Personal Distributed Environment

9. www.mobilevce.com © 2005 Mobile VCE Securing the Future PCs today… Computer vulnerabilities & attacks increasing rapidly… Source: CERT/CC http://www.cert.org Due to: Increasing interconnectedness & user mobility Rapid increase in vulnerabilities being discovered, arising from increasing complexity of the OS & applications Increasingly sophisticated & automation of attack tools “….mobile phones today have the processing power of a PC of 5 years ago”

10. www.mobilevce.com © 2005 Mobile VCE