Mobile Financial Services:Are There Any Hard Problems?

Ron Moritz

SVP, eTrust Security Solutions

Computer Associates

Welcome to WirelessGPRS

MMS

SMS

Smart Phones

LinuxBlackberry Symbian

PocketPC Palm

CDMA20001XRTT

WPA

802.1x

802.11g802.11b 802.11a

GSM

Bluetooth

Mobile Gateway

WEP

Tablet PC

TDMA

WCDMA

EDGE

Hot Spots

WiFi

802.20

UMTS

Win XP

Wireless eMailThe Next Killer App

WAP

802.11hCentrino

Warchalking

Wireless Defined

• Confusion

• Too many choices

• Not enough education

• Lack of standards

• Security vulnerabilities

Mobility Solution Core Components

1. DevicesiPaqPalmBlackberrySmart Phone…

2. NetworkAT&TSprintPCSCingular…WLAN

+

4. ApplicationsLoBeMailSiebel, SAP, Portal SoftwareMiddleware

5. Support ServicesHelp DeskDevice rolloutTrainingDevelopment

+

6. Additional Services and s/w:User Data Back Up and RestoreExchange Managed ServiceDevice Maintenance and Break FixDevice Provisioning and ConfigurationApplication Hosting Application Development

3. Connectivity Server Security (Firewall,VPN, Access control, PKIAuthentication)

+

0. Business PlanNeeds AssessmentWhat? Where?Why?How? How much?

+

+

Business Benefits Realization

New Risks or Replay of Old?

• Does wireless really introduce new security risk or is it simply highlighting the existing defects in our current network?

• End device has limited resources (power, processing, storage) limiting security capability.

• WiFi users may not be sufficiently focused on security concerns.

• Because of unique aspects of wireless nets, there are new vulnerabilities and security concerns regarding C.I.A.

Data versus Voice People

• Converged networks – just say no!• There are data people• There are voice people• The idea of bridging between the

cellular and the WLAN is nice but does not really fit the sociology of how people interact with technology

• LAN/Telephony integration that is acceptable in the wired world may not be real (yet) in other platforms

Cell Phone – What You Have

• Engage the wireless device in strong authentication

• Carrier can send one-time token to cell phone or other wireless device

• Find other creative ways to enhance data security with wireless

New Solutions Are Required

• Wired and wireless nets both have many of the same vulnerabilities

• But, the solutions developed for wired nets may not be possible or implementable in wireless nets

• For example, management of policies and services in wireless net

• And, current protocols for managing authentication are insufficient in wireless world

• So, need new ways to manage configuration, security policy, intrusion detection, and response

No Physical Isolation of Nodes

• Wireless communication more susceptible than wired communication to security attack:• Disruption (jamming, DDoS)• Observation (evesdropping, traffic

analysis)• Misuse (theft of service)

Unique Attacks on Wireless Net

• Capture and abuse of control channels• Spoof at or near boundary of network

cells to capture traffic• Direct attacks at wireless power source• Attacks directed at the database or

service needed for maintaining configuration and/or security policy management

• Traditional intrusion detection techniques may not be possible in wireless network

Crucial to Financial Services

• NAPs are like roaches – if you see one you probably have hundreds

• Scan for them• IBM wireless security auditor• Netstumbler• Grasshopper

• Attacks on wireless may threaten individual privacy and enable identity theft

Crucial to Financial Services

• Integration of wireless security into larger systems, networks and systems of systems• Devices whose security is crucial to

the network are in the hands of individuals who lack expertise or interest in security

• Must improve the embedded security of these systems so security of the nodes is easy

Security Situational Awareness

• Visualize health of WLAN• Network topology is in constant flux

as nodes are added, moved, removed

• Intermittent connectivity, node and link failure, and compromises must be detected

• Monitor and represent the status of the wireless network to understand security posture

• Discovery possible through CA Unicenter

•Detect rogue devices

•Manage performance and configuration

•Topology and alerts

Manage Wireless Networks

Shields and Cloaks

• Location-aware policy enforcement• When do you want to be visible?• When do you want shares hidden?

• User-friendly administration• Don’t depend on level of security

expertise of the user• Help engage user in his/her destiny• Help user understand location vis-à-

vis network they’ve engaged

• Deliver software and manage performance and configuration

Automated Software Delivery

•Deliver software

•Manage performance and configuration

•Remote wipe, lock, and reload

Manage Mobile Devices

Key CA Partnerships

• MPAC• Preferred enterprise partner in Microsoft’s

Mobility Partner Advisory Council

• UCLA WINMEC• Wireless Internet and Mobile Enterprise

Consortium• Founding member

• SUNY Stony Brook Center of Excellence for Wireless Technology• Founding member• Ongoing research

CA Resources

• White papers at www.ca.com/cto• Technology Innovations at CA• Enabling Mobile eBusiness

Success• The Future of Wireless Enterprise

Management• Who’s Watching Your Wireless

Network?• Enterprise Portals: The

Workplace of Tomorrow