Sikring af Office 365 på tværs af netværk og devices. Henrik Larsson, Senior Security Consultant, Dubex A/S Aarhus, den 4.

Transkript

1 Sikring af Office 365 på tværs af netværk og devices Henrik Larsson, Senior Security Consultant, Dubex A/S Aarhus, den 4. februar 2016

2 Agenda Cloud! Malware Mobile Management Identity & Access Management

3 Hvad skal vi have ud af dette indlæg? Mine mål med dette indlæg: 1. Give dig nogle tanker så du fremover tænker på sikkerhed ved brug af cloud-services. 2. Give nogle konkrete bud på hvordan du kan forbedre sikkerheden i dit Office 365 miljø. 3. Give dig nogle værktøjer så forretningen kan benytte Office 365 uden at forøge risici. Disclaimer: Dette er ikke en facitliste. I løbet af de næste 25 minutter når vi højst at skrabe en lille smule i overfladen.

4 Hvorfor cloud? Tilgængelighed Grøn energi Økonomi Big data Fleksibilitet Sikkerhed? Skalerbarhed

5 Er cloud sikkert at bruge? Måske Hvem har ansvaret for din it-sikkerhed i cloud? Kan du opnå den ønskede sikkerhed og hvordan? Hvem må tilgå dine data i skyen? Hvor vigtigt er det for dig at vide, hvor dine data befinder sig? Kan du overholde gældende compliance-krav? Sæt dig grundigt ind i udfordringer og begrænsninger i den enkelte løsning. Cloud er ikke en silver bullet i sig selv.

6 Cloud is not evil just because it s cloud Betragt ikke cloud som hverken et onde eller et nødvendigt onde, men tænk den ønskede sikkerhed ind i løsningen fra starten. Sikkerhed i cloud er Shared Responsibility

7 Malware

8 Malware er unikt YOU RE ABSOLUTELY UNIQUE JUST LIKE EVERYONE ELSE Consistent with some other recent vendor reports, we found that 70 to 90% (depending on the source and organization) of malware samples are unique to a single organization. There s another lesson here worth stating: Receiving a never-before-seen piece of malware doesn t mean it was an advanced or targeted attack. It s kinda cool to think they handcrafted a highly custom program just for you, but it s just not true. Get over it and get ready for it. Special snowflakes fall on every backyard.

9 Malware er brug og smid væk A quick look at the types of malware being used shows they are overwhelmingly opportunistic and relatively short-lived. Even though we looked at data over just a six-month period, 95% of the malware types showed up for less than a month, while four out of five didn t last beyond a week.

10 Gartner om Exchange Online

11 Microsoft Exchange Online Anti-Malware FAQ Q. How often are the malware definitions updated? A. Each server checks for new malware definitions from our anti-malware partners every hour. Q. Where does malware scanning occur? A. Malware scanning is performed on messages sent to or received from a mailbox. Malware scanning is not performed on a message accessed from a mailbox because it should have already been scanned. If a message is re-sent from a mailbox, it s rescanned. Kilde:

12 Hvor meget nyt malware? nye malware filer i timen

13 attack vectors 60% Kilde: TrendLabs 2014 Targeted Attack Campaign Report

14 Trend Micro Cloud App Security - Overblik Cloud App Security Advanced Threat Detection Finds zero-day malware and hidden threats Sandbox file analysis in the cloud DLP 200+ customizable templates Discovery and visibility capabilities

15 Trend Micro Cloud App Security Integration Direct cloud-to-cloud integration No impact to Office 365 functionality 5 minute setup API Trend Micro Cloud App Security M X R e c o r d S o f t w a r e U s e r settings

16 Trend Micro Cloud App Security Detektion API Suspicious Files (~3%) antispam antimalware URL scan Doc exploit scan File risk assessment Manual scan feature Sandbox Analysis Microsoft Office 365 Microsoft Azure DC Trend Micro DC Cloud App Security Leverages technology from Trend Micro Deep Discovery:

17 Trend Micro Cloud App Security - Sandbox

18 Trend Micro Cloud App Security - Sandbox

19 Mobile Management

20 Krav til styring af mobile brugeres adgang til Office 365? Hvilke enheder må tilgå data? Hvilke krav er der til enheden? Hvor nemt skal det være at slette data på en enhed? Hvilke platforme skal understøttes? Skal platformen kun understøtte Office 365 eller skal den også understøtte andre apps?

21 Gartner om Enterprise Mobile Management

22 MobileIron App security model Distribute Office 365 apps securely Configure the native and PIM apps on mobile devices so they can connect to Office 365. Securely distribute Office 365 apps to mobile devices through the MobileIron enterprise app store. Protect Office 365 data-at-rest on the device Enforce operating system containerization controls such as data separation, Open In restrictions, and selective wipe to protect Office 365 data on the mobile device. Protect Office 365 data-in-motion to the Microsoft Cloud Securely tunnel data from the device to the cloud through MobileIron Tunnel per app VPN. Block rogue devices and browsers from accessing Office 365 by using Microsoft Active Directory Federation Services (ADFS) to limit authentication paths

23 MobileIron - Distribute Apps Securely IT security requirements for distributing apps: Employees should be able to tap the enterprise app store on their mobile devices to see the catalog of apps authorized by the enterprise for their use. The catalog of apps should be both user- and device-aware: User-aware: The catalog of apps should be different for different employees based on their identity. For example, a Marketing Manager should see different apps in the catalog than a Help Desk Engineer. Device-aware: If the device is not compliant, for example jailbroken, the employee should not be able to download catalog apps. MobileIron security model for distributing Office 365 apps: IT publishes the standalone Office apps through Apps@Work If the customer is using the native and PIM apps on the mobile device, then MobileIron configures those services directly while distributing the other Office apps through Apps@Work.

24 MobileIron - Protect app data-at-rest IT security requirements for data-at-rest: Authentication: Enforce user authentication for the enterprise app on the device so that an unauthorized user cannot access them. Authorization: Ensure that the app will only function if the mobile device is in compliance. Configuration: Automatically push configuration variables (e.g., server name, language, or policies) to the app. This is a better alternative than employees manually entering configuration information because it reduces errors and Help Desk calls. Misconfigured apps also often result in security holes. Encryption: Provide secondary encryption for app data stored on the device. Modern mobile operating systems and devices have encryption built in, but some organizations may require more protection. DLP protections: Prevent data loss from authorized apps to unauthorized apps. DLP protections can include restrictions such as Open In controls embedded in ios to prevent unauthorized apps from opening enterprise documents or Copy/Paste controls to prevent employees from copying text from an authorized app into an unauthorized app. Selective wipe: Delete the app binary on the device when the employee is no longer authorized to use the app or when the device is no longer authorized to run the app.

25 MobileIron - Protect app data-at-rest MobileIron app security model for Office 365 data-at-rest: MobileIron uses native OS containerization controls to secure data-at-rest for Office 365. Using MobileIron, IT can apply the appropriate security policies to Office data on the device and selectively wipe Office data and apps from the device when required. This selective wipe ability allows MobileIron to protect Office data on personally owned (BYOD) devices without compromising the privacy of the employee. Configure native and PIM in the Android for Work container to connect to Office 365. Configure the Android for Work container, which also holds the Office apps, with the appropriate DLP controls, such as screen capture and copy/paste. Selectively wipes the Android for Work container, removing Office , PIM, and business apps if the employee leaves the company or if the device is lost, stolen, or falls out of compliance. Can disable the Android for Work container as a temporary quarantine action if the device falls out of compliance. Configure the native and PIM apps on the ios device to connect to Office 365. Configure /pim as a Managed Account and all Office apps as Managed Apps. Enforce the Open In DLP control for business apps and . Selectively wipes all Office apps plus Office and PIM data from the mobile device if the employee leaves the company or if the device is lost, stolen, or falls out of compliance.

26 MobileIron - Protect app data-in-motion IT security requirements for data-in-motion: IT should have full visibility over which devices are connecting to ActiveSync for access. IT should be able to define policies so that unauthorized or non-compliant mobile devices cannot access the back-end or apps service. IT should be able to protect the connection between mobile devices and back-end services from man-inthe-middle attacks.

27 MobileIron - Protect app data-in-motion MobileIron app security model for Office 365 data-in-motion: If the customer is using Office 365 just for , MobileIron Sentry provides visibility, secure tunneling and access control for traffic. Apps: If the customer is also using Office 365 apps, then MobileIron Tunnel provides secure tunneling and access control for app traffic as well as . IT publishes the Office apps through MobileIron Apps@Work so they are secured as ios Managed Apps, which allows the Office apps to use Tunnel for per app VPN. One exception is voice and video through Skype for Business (aka Lync), because UDP traffic is not currently supported by Apple s per app VPN implementation on ios.

28 MobileIron - Protect app data-in-motion Authentication flow: All Office traffic from the device is forwarded through the Sentry gateway. Authentication with ID/password redirects to ADFS. This ensures that, using the IP address claim restriction for ADFS, the authentication request is coming via the Sentry gateway. Login succeeds and employee is redirected to Office 365 with the appropriate Access Token. Office 365 grants access to the device. Unauthorized devices are not able to access the Office 365 cloud as the Sentry would deny authentication access to ADFS. If the employee is trying to use an Office app that was downloaded from the public app store instead of from Apps@Work, it is not able to get the Tunnel configuration to login as long as ADFS is locked down to internal only. So the employee is able to login to a personal Office 365 account but not to the corporate Office 365 account.

29 Identity & Access Management

30 Hvordan vil du tillade adgang til Office 365? 2-faktor godkendelse? Token, grid card, certifikat eller SMS? Forskellig adgang for forskellige brugere? Brug samme authentication framework til alle applikationer onsite som i skyen.

31 Entrust IdentityGuard

32 IdentityGuard integration User authenticated Open app Re-direct to ADFS 2FA challenge

33 Andre løsninger

34 Business App management?

35 Endpoint Protection i skyen?

36 Firewall i skyen?

37 Hvad skal du gøre når du kommer hjem? På mandag Tænk over om de sikkerhedskrav I stiller til jeres løsninger, også gælder cloudservices Næste uge Sikre at risikovurderingen dækker de konkrete løsninger som benyttes også cloud-services Næste måned Find ud af om de mekanismer som er beskrevet i risikovurderingen, afspejler den tekniske løsning og implementer løsninger hvis de mangler

38 Tak! Læs mere om Dubex på