SANS Mobile Device Security Summit Recap
Just a quick post about the SANS Mobile Device Security Summit that I participated in. Kudos to Kevin Johnson and Tony DeLaGrange from Secure Ideas for helping organize and lead the event. They did a great job! If you’ve been to SANS events in the past I assure you that this was much different. First, there was a great line up which included Rafal Los (HP), Jack Mannino (nVisium Security), Chris Cuevas (Secure Ideas), John Sawyer (InGuardians), Josh Feinblum (The Advisory Board Company) and Daniel Miessler (HP ShadowLabs) to name a few. Having a lineup of great speakers really made the summit flow as well as it did.
What I liked most about this event was that there were plenty of “real world” talks on how enterprises are deploying and managing mobile deployments. Real in the “trenches” types of talks. Here are some of the themes that I heard throughout all the talks:
- Jailbreaking/Rooting is BAD
- The OWASP Mobile Top 10 is going to be just as important as the traditional web application OWASP Top 10
- Mobile Threats are an evolving, moving target. Security teams have to be quick to adapt to new mobile technology
- MDM (Mobile Device Management Solutions) are a requirement
- Apple iOS devices are preferred over Android in the enterprise (seriously, that was the consensus). No one seems to care about BlackBerry or Windows Mobile devices. I think only one speaker mentioned Windows Mobile…
Speaking to the last point I find this pretty interesting. Especially given the fact that Android seems to be beating Apple in regards to market share of devices and app store apps. I also enjoyed hearing about some of the challenges and pitfalls real IT and security departments are facing. Many of the speakers talked about some best practices they’ve developed and problems they’ve had. One of the highlights for me was a talk by Det. Cindy Murphy from the Madison WI Police Department Computer Forensics Unit. She shared some of her experiences with mobile device forensics and how this evidence holds up in court. I highly recommend you check out this summit next year, it’s one not to miss!
I should have my slides from the latest version of my talk that I gave at the summit (Attacking & Defending Apple iOS Devices in the Enterprise) in the next day or so.
*** This is a Security Bloggers Network syndicated blog from spylogic.net authored by Tom. Read the original post at: https://www.spylogic.net/2012/03/sans-mobile-device-security-summit-recap/
