Two good sessions today, one on the state of vulnerability management in IPv6 and the second on the security issues with BYOD.
The vulnerability management session was interesting in that while Microsoft, all Linux variants, Cisco, HP, Juniper, Check Point and other OS and network device vendors have been implementing IPv6 capabilities into their products, the vulnerability management vendors have been sleeping. They are just coming to the realization that customers would like to be able to perform vulnerability tests for IPv6 enabled hosts on their networks. I mentioned in my post yesterday that the primary issue with performing vulnerability scans on IPv6 is the scarcity of the addresses in an IPv6 address space. It is simply not possible to scan all of the addresses in a single IPv6 subnet to find hosts and to then probe for vulnerabilities in a reasonable amount of time. The vendors are working on models to do this; however, no final “best practice” solution is available yet. Some suggestions which were presented are to scan active IPv4 addresses to find the hosts and then check if they are running IPv6, to perform SNMP walks on the routers or switches to determine which hosts are running IPv6, review the CMDB for known hosts or review log files on network and other devices.
In the BYOD session, the primary discussion revolved around identifying the threats to mobile devices in general, but only two possible models for supporting BYOD emerged. The primary threats to mobile devices as seen by the panel are:
- Bridging from a mobile device into the enterprise network
- ActiveSync vulnerabilities
- Rouge base stations which can eavesdrop on calls
- Lack of granular controls for many of the mobile OS’
- Poor password usage since users find it difficult to type in complex strong password
The two models which were discussed for supporting a BYOD model are to either require the user to accept corporate policy controls (e.g. encryption, virus scanner, etc.) on their personal device by installing an enterprise MDM solution or to implement local virtual containers on the devices. The container solution would solve the problem that if a user leaves the company, only the corporate container can be wiped and the personal container can remain in place.
In both situations, a security policy should define what applications will be made available to users who bring their own devices. This policy should be based on the criticality and security requirements of the applications as well as the usability of the applications. For example, does it make sense to allow access to spreadsheets from iPhones when they really cannot read or manipulate them in any practical manner?