ENISA: sicurezza per gli Smartphone

Interessante report dell'ENISA sulla sicurezza degli smartphone: analisi del rischio e contromisure da intraprendere. Il documento PDF non è eccessivamente lungo (circa 60 pagine) e se non avete tempo, potete solo sfogliarlo e magari leggervi il Summary iniziale (o guardarvi il video) che comunque accludo qui di seguito:

RISKS

• R1 Data leakage: a stolen or lost phone with unprotected memory allows an attacker to access the data on it.
• R2 Improper decommissioning: the phone is disposed of or transferred to another user without removing sensitive data, allowing an attacker to access the data on it.
• R3 Unintentional data disclosure: most apps have privacy settings but many users are unaware (or do not recall) that the data is being transmitted, let alone know of the existence of the settings to prevent this. 
• R4 Phishing: an attacker collects user credentials (e.g. passwords, creditcard numbers) using fake apps or (sms,email) messages that seem genuine.
• R5 Spyware: the smartphone has spyware installed allowing an attacker to access or infer personal data. NB spyware includes any software requesting and abusing excessive privilege requests. It does not include targeted surveillance software (R7).
• R6 Network spoofing attacks: an attacker deploys a rogue network access point and users connect to it. The attacker subsequently intercepts the user communication to carry out further attacks such as phishing.
• R7 Surveillance: spying on an individual with a targeted user’s smartphone.
• R8 Diallerware: an attacker steals money from the user by means of malware that makes hidden use of premium sms services or numbers.
• R9 Financial malware: malware specifically designed for stealing credit card numbers, online banking credentials or subverting online banking or ecommerce transactions.
• R10 Network congestion: network resource overload due to smartphone usage leading to network unavailability for the end-user.

OPPORTUNITIES

• Sandboxing and capabilities: most smartphones use sandboxes for apps and capability-based access control models.
• Controlled software distribution: gives providers the opportunity to have more control over app security by vetting apps submitted for security flaws and removing insecure apps.
• Remote application removal: functionality allowing removal of malware from devices after installation (NB caveats described in this section – e.g. the judgement about whether a particular app is malicious may not be clear-cut).
• Backup and recovery: most smartphones ship with convenient backup and recovery functions to address risks to data availability.
• Extra authentication options: smartphones can function as a smartcard reader, giving additional options for authentication and non-repudiation.
• Extra encryption options: several third-party applications are now offering encryption for smartphone voice calls, on top of the standard encryption provided by mobile network operators.
• Diversity: smartphones are diverse in terms of hardware and software, which makes it more difficult to attack a large group of users with one virus.

RECOMMENDATIONS

We provide a detailed set of measures which can be applied for each risk identified. The recommendations are structured according to the usage scenarios (consumer, employee, high official). In general, recommendations for consumers should be applied to employees and those for employees to high officials. Below is a summary of selected recommendations:

Consumers:

• Automatic locking: configure the smartphone in such a way that it locks automatically after some minutes.
• Check reputation: before installing or using new smartphone apps or services, check their reputation. Never install any software onto the device unless it is from a trusted source and you were expecting to receive it.
• Scrutinize permission requests: scrutinize permission requests when using or installing smartphone apps or services.
• Reset and wipe: before disposing of or recycling their phone, wipe all the data and settings from the smartphone.

Employees:

• Decommissioning: before being decommissioned or recycled, apply a thorough decommissioning procedure, including memory wipe processes.
• App installation: if any sensitive corporate data is handled or if the corporate network is accessible to the smartphone then define and enforce an app whitelist.
• Confidentiality: use memory encryption for the smartphone memory and removable media.

High officials:

• No local data: do not store sensitive data locally and only allow online access to sensitive data from a smartphone using a non-caching app.
• Encryption software: for highly confidential usage, use additional call and SMS encryption software for end-to-end confidentiality.
• Periodic reload: smartphones may be periodically wiped (using secure deletion) and reloaded with a specially prepared and tested disk image.

Molte delle contromisure suggerite sono misure di buonsenso, che i più accorti avranno già intrapreso. Il documento può essere utile in quelle realtà aziendali che prevedono l'uso del telefonino aziendale (cioè TUTTE!) e l'adozione di adeguate policy per il suo utilizzo.

Immagino già che il report sarà utilizzato come base per l'ennesimo documento interno di policy e per una lettera di malleva da far firmare al dipendente sull'uso dello smartphone aziendale ;-)