Top 10 Security Concerns of Windows Mobile (and how to Overcome them)

Jason Langridge Enterprise Mobility Solution Specialist Microsoft Communications Business Group E-mail: [email_address] Blog: http://blogs.msdn.com/jasonlan ITP205 Top 10 Security Concerns of Deploying Windows Mobile© (And How to Overcome Them)

Microsoft Windows Mobile 5.0 Security Features ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Windows Mobile 6 Security Enhancements ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Exchange 2007 Policies ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Top 10 Security Concerns ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

We Really Don’t Want to Have Incoming Ports Being Opened ,[object Object],[object Object],[object Object],[object Object],[object Object],Perimeter Network Corporate Network Cellular Network/ Internet ISA Server 2004 or 2006 ISA Server Mobile Devices (HTTPS access)

How Can We Stop Un-trusted Devices Accessing Exchange? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

We Have to Implement Two-factor Authentication ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SecureID ,[object Object],[object Object],[object Object]

Certificate-based Authentication ,[object Object],[object Object],[object Object],[object Object],Using Basic Authentication Using Certificate Authentication

Private APN ,[object Object],[object Object],[object Object],Private Network Mobile Operator Network Firewall/ISA Proxy Servers GGSN GIP GGSN Client Addressing e.g. 192.168.32.1 /24 No NAT ISP ISP Internet Direct Private Connection Exchange FE Exchange BE

Do We Really Need to Use ISA Server? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

We Don’t Want to Cache Passwords on The Device ,[object Object],[object Object],Using basic authentication Using certificate-based authentication

There is No Way We’ll Allow This Solution, as You Can Download Attachments ,[object Object],[object Object]

We Must Have On-Device Encryption ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What is Wiped When You Remote- Wipe a Windows Mobile Device? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Exchange 2003 and Windows Mobile 5.0 Yes No Exchange 2003 and Windows Mobile 6 Yes No Exchange 2007 and Windows Mobile 5.0 Yes No Exchange 2007 and Windows Mobile 6 Yes Yes Scenario Device Memory wiped Storage Card wiped

Windows Mobile 6 Remote Kill Functionality

What About Anti-virus? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Infamous Mobile Threats (2004-2006) Copyright 2006 - Trend Micro Inc. RedBrow Cxover 29Dec04 1Feb05 21Nov04 20June04 17Jul04 5Aug04 = Symbian OS = Windows CE/Mobile = Java (J2ME) 8Mar05 7Mar05 12Aug04 4Apr05 6Apr05 18Mar05 15Apr05 4Jul05 8Jul05 19Jul05 21Sep05 2Oct05 23Nov05 10Aug05 2004 2005 2006 19Jul05 23Jan06 28Feb06 15Mar06 30Mar06 3Apr06 18Jun06 31Aug06 Wesber 7Sep06 4Sep06 Vlasco Win CE BRADOR Locknut (Gavno) Skulls Cabir Win CE DUTS Comwar Dampig Qdial Mabir Fontal Drever Hobbes Doomed Boottoon Skudoo Cadmesk Cardtrp Cardblk PBSteal Blanfon Sndtool Flexspy OneJump Romride Mobler Acallno

Couldn’t Someone Perform a Denial of Service (DoS) Attack? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Top 10 Review ,[object Object],[object Object],[object Object]

Resources ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

While You're Here Fill out your session evaluation Enter to win a Windows Mobile ® phone or Zune™ Geek out with a huge rack of servers Enterprise Mobility in Action is in the Expo Hall Meet the geeks The Expert Cabana is packed with MEDC speakers and MVPs

© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Top 10 Security Concerns of Windows Mobile (and how to Overcome them)

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Top 10 Security Concerns of Windows Mobile (and how to Overcome them)

Similar to Top 10 Security Concerns of Windows Mobile (and how to Overcome them) (20)

Recently uploaded

Recently uploaded (20)

Top 10 Security Concerns of Windows Mobile (and how to Overcome them)

Editor's Notes