Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to How Aetna Mitigated 701 Malware Infections on Mobile Devices
Similar to How Aetna Mitigated 701 Malware Infections on Mobile Devices (20)
Recently uploaded
Recently uploaded (6)
How Aetna Mitigated 701 Malware Infections on Mobile Devices
- 1. © 2017 Aetna Inc. Strategy and Tactics for Securing Mobile Devices in Financial Organizations
- 2. © 2017 Aetna Inc. Quick Housekeeping • There will be time for Q&A at the end • Ask questions using the GTW chat pane • The webinar is being recorded • All attendees will receive a copy of the slides/recording Join the discussion #MobileThreatDefense
- 3. © 2017 Aetna Inc. Meet Your Speaker Brian Heemsoth Director of Software & Mobile Security Aetna
- 4. © 2017 Aetna Inc. Mobile Threat Landscape Physical Malware Vulnerabilities Network
- 5. © 2017 Aetna Inc. Physical Threats Addressed by MDM, MAM & Containerization PlatformsPhysical Malware Vulnerabilities Network
- 6. © 2017 Aetna Inc. Malware Got 200+ devices? You probably have malware!Physical Malware Vulnerabilities Network iOS Malware Pegasus | Malicious Profiles | AceDeceiver | YiSpecter | XcodeGhost Android Malware Quadrooter | Stagefright | Hummingbad | Accessibility Clickjacking Targeted Malware Exaspy, Ransomware, Repackaged Apps Annoying Malware Adware 1 in 5 of your devices allow installation from third-party app stores Third-party stores are 72xmore likely to deliver malware Malware as a Percentage of Downloaded Apps Google Play Store Samsung Amazon Aptoid 0.06% (1 in 1600 apps) 0.11% (1 in 900 apps) 0.77% (1 in 130 apps) 4.41% (1 in 23 apps)
- 7. © 2017 Aetna Inc. Malware Got 200+ devices? You probably have malware!Physical Malware Vulnerabilities Network Man in the Middle WifigatePineapple arpspoofdnsspoof SSL stripping SSL decryption Content manipulation 92% of users click on “Continue” compromising their Exchange identity (username and password) Source: Skycure Threat Intelligence 32.5 PERCENT of executive devices were exposed to network attack within a quarter
- 8. © 2017 Aetna Inc. Vulnerabilities Organized & directed effort from hackersPhysical Malware Vulnerabilities Network do not have latest OS version installed 33% of Devices with Stored Sensitive Info Do you know which of your devices are upgradable? - Without relying on Apple or Google? - How much risk can be averted by simply updating? ? ? ?
- 9. © 2017 Aetna Inc. Pain Points in Regulated Industries • Data accessed outside corporate firewalls − Greater use of mobile devices − Flexible working hours and locations • Accessing regulated data on unmanaged devices − Agents/Doctors manage their own devices − Better access to customer data means better service in the field • New regulations NEWS ITEM: New York State Imposes New Cybersecurity Regulation for Financial Services New requirements: 1. Employ a CISO 2. Annual reports
- 10. © 2017 Aetna Inc. Customer Data at Risk Source: Skycure Source: Skycure 1 in 5 organizations suffered a mobile security breach 8% of all healthcare breaches came from mobile devices 16% of all financial breaches came from mobile devices
- 11. © 2017 Aetna Inc. Mobility @ Aetna • Approximately 10k mobile devices − 60% BYOD; 40% corporate-owned/managed − Phones, tablets, iPods • Use cases: − Mobile productivity (email, calendar) − Chat/collaboration − Enterprise managed third-party applications − Internally developed employee applications • Established MDM & MAM Platforms
- 12. © 2017 Aetna Inc. Aetna: Key Risk Factors Compromise of data in containerized applications by “screen scraping” iOS/Android malware Compromised Aetna Credentials & Data (malicious networks) Malware on BYOD & Corporate Devices Unpatched OS Vulnerabilities Device Currency Pegasus AceDeceiver SVPENG
- 13. © 2017 Aetna Inc. Aetna’s Solution • Implemented Skycure Mobile Threat Platform • Deployed to all BYOD & Corporate Devices • Mandated compliance dates • Integrated monitoring into Security Operations Center • Phase 2: Integration into MDM platforms to allow for proactive management of access to Aetna resources from impacted devices (in progress)
- 14. Title of Presentation DD/MM/YYYY© 2017 Skycure Inc. 14 9,314 Devices 53,612,964 Network Tests Performed 523,143 Access Points 53,458 Networks 9,724 Active Users 4,097,982 Apps Scanned
- 15. Title of Presentation DD/MM/YYYY© 2017 Skycure Inc. 15 24 High criticality malware infections mitigated 460 Instances of credentials/data protected on high risk networks 701 Total malware infections mitigated 23.97 High risk vulnerabilities addressed per-device
- 16. © 2017 Aetna Inc. Risk Visibility The Foundation to addressing risk is having Visibility Source: Screenshots from the Skycure platform at Aetna
- 17. © 2017 Aetna Inc. Malware Security 3,365,558 Android Apps Scanned Source: Screenshots from the Skycure platform at Aetna Installed from unknown third party application store Since implementation 14 critical severity malicious Android applications have been identified. Unauthorized system setting modification, process manipulation, audio recording
- 18. © 2017 Aetna Inc. Network Security 30,105,599 Networks Tests Performed on 34,918 Networks, Accessed From 319,338 Access Points 3,607 devices connected to a network which posed a threat (6.4% of the networks). These network threats include secure traffic description, content manipulation, suspicious/fake hotspots, and unknown threats (suspicious network behavior). Skycure automatically opens a VPN and adds another layer of encryption when applicable. Source: Screenshots from the Skycure platform at Aetna 61% 39% 39% of Aetna’s devices were exposed to network threats 32685 2233 Safe Networks Threatning Networks September 2, 2016 3,607 of 9,304 devices were exposed (39%)
- 19. © 2017 Aetna Inc. Network Incidents Map The above map shows the distribution of tests that concluded with network threats according to the geolocation associated with the network. Source: Skycure
- 20. © 2017 Aetna Inc. Vulnerabilities 1,941 devices are running an operating system with high risk. We use CVSS - open standard for scoring vulnerabilities. You can see the reasoning for each of those in the system. Most of Aetna’s devices are iOS, which is usually better when it comes to security updates. However, we still see many of them running OS versions with major known vulnerabilities Source: Screenshots from the Skycure platform at Aetna
- 21. © 2017 Aetna Inc. Total & Overall Risk Trends While we are managing to maintain less than 10 devices at risk at any given time, we are also constantly improving the overall risk by decreasing the total number of medium risk devices. In the following graph you can see that decrease (Medium-risk devices are marked with Orange). We constantly collect device risk and at the peak time (April 3rd) we had 9 devices at high risk – Currently we have 0 devices with high risk, as we are constantly addressing these. Source: Screenshots from the Skycure platform at Aetna
- 22. Skycure Overview
- 23. © 2017 Aetna Inc. New York Life Testimonial Steve Johnson Head of Data Protection & Cybersecurity Services Enterprise Technology Group "Our people need access to data and other corporate resources on mobile devices, but we are mindful of the need to protect our systems, especially regulated data," said Johnson. "Our agents can securely access a client’s information before a meeting, which allows them to make smarter policy recommendations," Johnson explained.
- 24. © 2017 Aetna Inc. Skycure Mobile Threat Defense • Always ON protection • Whole device, all vectors • No “Sideloading” Seamless experience Privacy Minimal footprint • Advanced security • Risk-based mgmnt • Automation and integration Security Visibility IT Satisfaction PUBLIC APP CLOUD SERVER • Crowd-sourced • Threat aggregation from third parties • Skycure research 1 Million+ Global Threats Identified https://maps.skycu re.com THREAT INTELLIGENCE
- 25. © 2017 Aetna Inc. Skycure – High Level Overview Leading Product & ResearchCustomers #1 Mobile Threat Defense SolutionStrategic Partners CONSUMER GOODS RETAIL MANUFACTURING TECHNOLOGY FORTUNE 50 PHARMACEUTICAL COMPANY 250+TV channelsFORTUNE 100 HEALTHCARE COMPANY FORTUNE 500 FINANCIAL SERVICES COMPANIES
- 26. © 2017 Aetna Inc. Q & A
Editor's Notes
- Before I give the solution overview, let me quickly walk you through who Skycure is. We are the leader in Mobile Threat Defense with more Fortune 500 companies as customers than all the other players combined. Given our strength in research, we have been featured in all leading print, digital, and broadcasting media including more than 250 radio and TV channels including the super prestigious NBC’ The TODAY show. We partner with all major EMM market leaders and security VARs. Lastly, Skycure technology constantly gets rated as the #1 Mobile Threat Defense solution by analysts and evaluators.