A lire sur: http://www.infoworld.com/d/security/data-security-in-byod-world-190504?source=IFWNLE_nlt_sec_2012-04-10
The first question to ask: Does it matter whether devices are managed or unmanaged? That answer is a big fat yes. The whole reason we security pros dedicate our careers -- and our company's resources -- to securing organizations is to protect sensitive data. Managing a computer allows the data owners and stewards to lower risk of malicious access to protected data.
[ InfoWorld's Galen Gruman assures IT there's nothing to fear in endpoint diversity. | Understand how to both manage and benefit from the consumerization of IT trend with InfoWorld's "Consumerization Digital Spotlight" PDF special report. | Learn how to secure your systems with InfoWorld's Malware Deep Dive PDF special report and Security Central newsletter. ]
Managed computers can be assured to have:
We manage computers because we want to decrease the chance of malicious events. The consumerization of IT thwarts those good intentions. Some people argue that unmanaged computers aren't that much riskier than managed computers because, after all, managed computers haven't done a particularly good job of stopping computer crime. True, giving up on endpoint security is hardly the answer. Unmanaged computers, bereft of the controls listed above, are going to increase security risk -- full stop.
So how do you keep data secure in an unmanaged scenario?
The easiest solution is to deny unmanaged computers to access protected data. This was the most common response over the last few years. But in nearly every business environment I've visited, with that rule in place, unmanaged devices were still accessing company data, regardless of company policies. Like I said, new paradigms have a life of their own.
Assuming that unmanaged
devices are going to access your data anyway, what's the best way to
protect the data? The simple answer is to prevent the data from being
collected or stored, transiently or permanently, on the unmanaged
device. Attackers will have a significantly harder time compromising
data not on the device.
One way to do this is to use the traditional client-server solution. All the data remains on the server side and only the results are posted to the user -- typically, these days, in a browser. It's a good solution. The only problem is that it still gives a compromised computer direct access to the front-end-rendering system, which usually has code that links it to the middleware and back-end servers. If the unmanaged device is compromised, then the attacker can use that vulnerability to access and compromise all the computers in the chain from front to back.
The better solution for unmanaged devices is to render only screenshots of the data returns, giving the endpoint almost zero access to any of the computers in the chain of delivering the data. We already have tons of these solutions available, in the form of remote desktop presentation software, such as Citrix, Terminal Services, VNC, and so on. Each of these solutions simply presents a remote screen and transmits screen drawn updates in response to transmitted inputs.
If data can be accessed through an unmanaged device as a simple screen draw, there is little an attacker can compromise. Bad guys may be able to capture screenshots and all updates, but they can't obtain direct access to connection strings, HTML code, or other juicy bits of information that would allow them unfettered access to the back-end data.
Truth be told, I don't like remote desktop solutions as they are coded today. Most also give access to remote resources, such as storage devices, printers, shared folders, and so on. A better solution would allow only remote screen draws and inputs to be transmitted between the source and destination. Very little funny business could occur in that scenario.
Even if a bad actor (as in a hacker, not a celebrity) were to steal an unmanaged device, capture the remote connection log-on information, and begin accessing data like a legitimate user, they would get that data only one screen at a time. That's very laborious -- and represents a much less significant breach than a hacker gaining the sort of access that would allow the whole database to be copied with one command.
Currently I'm exploring VDI and other virtual app-rendering methods. They too show promise. I suspect that many readers have already come up with the same solutions, because we're all facing the same problems, and I don't consider myself to be brilliant.
What solutions have you come up with for solving the security problem of unmanaged devices? Share them in the comments below.
This story, "Data security in a BYOD world," was originally published at InfoWorld.com. Keep up on the latest developments in network security and read more of Roger Grimes' Security Adviser blog at InfoWorld.com. For the latest business technology news, follow InfoWorld.com on Twitter.
April 10, 2012
Sure, you'd like every mobile device in your organization to be securely managed -- but it's not going to happen. Here's how to deal with unmanaged devices
The consumerization of IT means that unmanaged devices are being brought into your environment and accessing your data. It's a new paradigm, and like most new paradigms, it's taking hold whether we like it or not.The first question to ask: Does it matter whether devices are managed or unmanaged? That answer is a big fat yes. The whole reason we security pros dedicate our careers -- and our company's resources -- to securing organizations is to protect sensitive data. Managing a computer allows the data owners and stewards to lower risk of malicious access to protected data.
[ InfoWorld's Galen Gruman assures IT there's nothing to fear in endpoint diversity. | Understand how to both manage and benefit from the consumerization of IT trend with InfoWorld's "Consumerization Digital Spotlight" PDF special report. | Learn how to secure your systems with InfoWorld's Malware Deep Dive PDF special report and Security Central newsletter. ]
Managed computers can be assured to have:
- Hardened security settings
- Secure log-on methods
- Strong authentication protocols
- Appropriate access controls
- Enabled host-based firewalls
- Up-to-date antimalware software
- Securely configured software
- Up-to-date, patched software
- Appropriate local and network security boundaries
- Configured and enabled auditing policies
We manage computers because we want to decrease the chance of malicious events. The consumerization of IT thwarts those good intentions. Some people argue that unmanaged computers aren't that much riskier than managed computers because, after all, managed computers haven't done a particularly good job of stopping computer crime. True, giving up on endpoint security is hardly the answer. Unmanaged computers, bereft of the controls listed above, are going to increase security risk -- full stop.
So how do you keep data secure in an unmanaged scenario?
The easiest solution is to deny unmanaged computers to access protected data. This was the most common response over the last few years. But in nearly every business environment I've visited, with that rule in place, unmanaged devices were still accessing company data, regardless of company policies. Like I said, new paradigms have a life of their own.
One way to do this is to use the traditional client-server solution. All the data remains on the server side and only the results are posted to the user -- typically, these days, in a browser. It's a good solution. The only problem is that it still gives a compromised computer direct access to the front-end-rendering system, which usually has code that links it to the middleware and back-end servers. If the unmanaged device is compromised, then the attacker can use that vulnerability to access and compromise all the computers in the chain from front to back.
The better solution for unmanaged devices is to render only screenshots of the data returns, giving the endpoint almost zero access to any of the computers in the chain of delivering the data. We already have tons of these solutions available, in the form of remote desktop presentation software, such as Citrix, Terminal Services, VNC, and so on. Each of these solutions simply presents a remote screen and transmits screen drawn updates in response to transmitted inputs.
If data can be accessed through an unmanaged device as a simple screen draw, there is little an attacker can compromise. Bad guys may be able to capture screenshots and all updates, but they can't obtain direct access to connection strings, HTML code, or other juicy bits of information that would allow them unfettered access to the back-end data.
Truth be told, I don't like remote desktop solutions as they are coded today. Most also give access to remote resources, such as storage devices, printers, shared folders, and so on. A better solution would allow only remote screen draws and inputs to be transmitted between the source and destination. Very little funny business could occur in that scenario.
Even if a bad actor (as in a hacker, not a celebrity) were to steal an unmanaged device, capture the remote connection log-on information, and begin accessing data like a legitimate user, they would get that data only one screen at a time. That's very laborious -- and represents a much less significant breach than a hacker gaining the sort of access that would allow the whole database to be copied with one command.
Currently I'm exploring VDI and other virtual app-rendering methods. They too show promise. I suspect that many readers have already come up with the same solutions, because we're all facing the same problems, and I don't consider myself to be brilliant.
What solutions have you come up with for solving the security problem of unmanaged devices? Share them in the comments below.
This story, "Data security in a BYOD world," was originally published at InfoWorld.com. Keep up on the latest developments in network security and read more of Roger Grimes' Security Adviser blog at InfoWorld.com. For the latest business technology news, follow InfoWorld.com on Twitter.
Aucun commentaire:
Enregistrer un commentaire