Hello Switzerland Magazine article on Consumerization

March 22nd 2012 
Update 1: The article is now online . Scroll through to page 13. 
Update 2: This trend is often called BYOD (Bring Your Own Device)



I have an article in the Spring 2012 edition of the Hello Switzerland magazine.  It discusses the impact of "consumerization"  in companies and organisations. This is where staff members use their own devices (smartphone and tablets) to access corporate information.

The article itself is pitched at a fairly high level. The main message is that consumerisation is a trend which is increasing. While offering many advantages, consumerisation also has its risks. The important thing for organisations to do is to recognise that this risk exists --and then to manage it.



Note: On Friday 2nd March, 2012 at 7pm, I am giving a BERNnet talk on Smartphone and tablet security in Bern. This is aimed primarily at normal end users. More information on BERNnet (PDF)

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

Developing Securely for SmartPhones - A few Key Principles

At AppSecEU last week, I attended Dan Cornell's (Denim Group)  presentation  on Security Testing Mobile Applications. You can view the slide deck on the Denim Group blog.

Basically, Dan demonstrated how you can "root" the smartphone and then reverse engineer the application to do whatever you want. Slide 6 shows a "Generic Mobile Application Threat Model" for a SmartPhone app connecting to an enterprise application.  It shows the following threats:

1. Malicious User
2. Malicious User (bypassing Mobile Client)
3. Malicious Mobile Application
4. 3rd Party Services (Possibly Malicious)

Nr. 2 is where a malicious user bypasses the smartphone completely and attacks the enterprise web services which the smartphone uses.

Nr. 3 is a malicious application which is installed on the smartphone and can interfere with other installed applications.

Nr. 4 is where the smartphone connects to 3rd party services which have been compromised.

Key Principles

So what  are the lessons when developing enterprise type apps for smart phones? Here are a few thoughts. These are based in part on a short conversation I had with Dan after his talk*.

1. Treat the smartphone as an "untrusted device".
2. If possible, don't store confidential information on the phone. 
3. Develop your web services securely, as an attacker may discover the web services and attack them directly - bypassing the smartphone completely.
4. Your web services should validate any input data and perform the necessary authorisation, access control, business logic checks etc.. Any validation performed on the phone should be repeated by the web service
5. Use SSL to prevent man-in-the-middle type attacks.

* These may not be an accurate reflection of Dan's views!

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot