Physical and Mobile Security in Corporate Environment

Physical Security and Mobile Security in Corporate Environment

• Businesses and organizations aim to protect visitors and reduce risks using physical security and safety systems.
• It's crucial to design and maintain these systems to safeguard people and assets from external dangers while lowering risk.

Physical Security and Safety Systems

• Any material or technological implementation in a physical space is for the safety of people/property.
• Examples are video surveillance, cameras, physical security measures, and access control.
• Public and private sectors use a mix of security guards/human personnel and technology.
• They mitigate risks like loss prevention in retail and manage access to sensitive/ restricted areas.

Physical vs. Cyber Security

• Physical and safety systems differ from cybersecurity efforts but are connected.
• Cybersecurity protects confidential info, digital assets, and infrastructure from cyber threats.
• Many digital threats don't involve physical attacks, but rather social engineering.
• Digital attacks can require physical access to critical assets or cloud-based IP endpoints.
• These systems must be protected digitally and from physical security threats.

Key Physical Security Components

• Electronic security includes:
  • Video surveillance (CCTV)
  • Access control systems
  • Intrusion detection
• Cable infrastructure is a vital element
  • Consider cabling for each device, lengths needed, and structural complications.
• IT systems/communications are also needed
  • This includes Wi-Fi access points and network/telecom jacks
• Fire alarm systems are part of security and safety
  • Includes fire/smoke/carbon monoxide detectors and sprinklers
• Building management encompass industry-specific technologies.
  • Includes panic button, nurse call systems, motion detectors, and equipment guard posts

Physical Security Risks in Various Industries

• Systems integrators face complexities due to varying needs/risks based on client orgs.
• Education, healthcare, and government clients have unique needs unlike corporate campuses.
• Large campuses aren't monolithic, but have varying security needs and risk tolerances.
• Planning must be customized based on audience and use cases.
• Universities accommodate seasonal budgets and labor, and have student safety concerns.
• Retail is concerned with loss prevention via cameras, alarms, barriers, and parking lot safety.

Effective Security System Design

• Crucial for combating physical security and safety risks
• Requires collaboration with vendors, integrators, and partners at a deep level
• System Surveyor is a collaborative system design platform for shared visual space and cloud access
• Visualization helps get stakeholders involved since traditional methods feel abstract
• Proper budget estimation is crucial, based on real-world information.
• System Surveyor provides built-in budget estimation tools

Physical Security Needs

• Physical security is as important as online security.
• Physical security is about access control and surveillance.
• Mobile Device Security protects sensitive data stored/transmitted by portable devices.
• The purpose is unauthorized users accessing enterprise networks.
• Equipment includes electronic security systems.

Mobile Security

• Due to changing habits, mobile apps dominate this era, integrating into everyday life.
• Many companies turn to mobile apps due to increased smartphone/tablet use.
• 90% of mobile device time is spent on apps, so mobile app security and vulnerability are crucial.

Data Storage Security

• Data Storage secures validation
  • Sensitive data should not be written on the application log
  • Sensitive data must not be shared with third parties unless necessary
  • The keyboard cache must be disabled
  • Sensitive data should not be exposed through the IPC mechanism
  • User credential is via Key Chain or SQLChipher.
• SSL pinning plays a significant part in building secure mobile apps used on insecure networks.
• Ensure the application uses certificate pinning to avoid man-in-the-middle attacks
• User authentication/authorization is a requirement for all apps (B2C or B2B) for security.
• The execution of an app shouldn't run on a rooted device.
• Secured App Logic means a build should not be able to be reverse engineered.

Mobile Application Security

• More users rely on mobile apps for digital media time, so apps need protection from unauthorized access.
• Mobile platforms provide security controls, but developers must choose from options.
• Common issues:
  • Leaking sensitive data
  • Poor authentication
  • Vulnerable encryption
  • Unencrypted data transmission

Mobile Application Security Testing

• Testing involves attacking a mobile app like a malicious user.
• Security testing understands the application's purpose and data
• Testing with static analysis, dynamic analysis, and penetration testing results in an efficient assessment.
• Testing Includes
  • Interacting with the application and understanding how it stores, receives, and transmits data.
  • Decrypting encrypted parts of the application.
  • Decompiling the application and analyzing the resulting code.
  • Using static analysis to pinpoint security weaknesses in the decompiled code.

Mobile Application Security Tools

• Applying reverse engineering and static analysis to drive dynamic analysis and penetration testing.
• Utilizing dynamic analysis/penetration testing to evaluate security control effectiveness, like authentication.
• Free/commercial tools assess applications using static/dynamic testing.
• A combination of static/dynamic testing with manual review is required
• This mobile application security testing ensures that security controls work as expected.
• It can help discover unexpected edge cases.

Synopsys' Security Testing Methodology

• Synopsys tests using static/dynamic analysis tools built for the mobile landscape.
• The tools are updated and tested to identify issues in code and platform version.
• Testing include issues in back-end services so all application aspects are covered.

Securing Mobile Apps

• Security options:
  • Device encryption
  • VPNs (Virtual Private Networks)
  • Biometrics
  • Password protection
  • Antivirus
  • Data backup
  • Mobile usage policy
  • Latest software updates
  • Strong passwords/encryption

Security Issues Developers Encounters

• Project scope
• Choosing the right technology
• Approaching an App Development Team
• Framing Different Devices
• Highly Responsive
• Approval of your App
• Compatibility Problems
• Outdated Technology Selection
• Lack of Resources and Platforms
• Poor Advertising

Mobile Application Trends

• Smartphones facilitate online activities anytime/anywhere.
• Influenced fields: banking, healthcare, IoT, shopping, and remote work
• Steady increase in mobile app usage
• More mobile phones than humans connected
• The US accounts for ~70% of internet usage via mobile apps
• Mobile apps are globally available on marketplaces such as Google Play Store.
• Organizations embrace mobile app development for employee efficiency in a youthful workforce.

Rising Mobile App Security Concerns

• 100 top google apps store have been prey of hacking
• 56% of the top 100 apple appstore have also been attacked
• Malicious malware increments are up by 163%
• Organizations pursue a BYOD approach(bring your own device), integrating work interests.
• 84% of US users use one gadget for work and personal use.
• Hacked mobile applications can result in:
  • Revenue loss
  • Brand damage
  • Unauthorized access to confidential data
  • Intellectual property theft
  • Fraud cases

Raising Mobile App Security Standards Against Malware tips

• Hackers intentions can include
  • Infect malware to devices
  • Duplicate apps for code
  • data tampering
  • Identity theft
  • Hold business assets/property
  • Take enterprise network

What to do to secure a Mobile App

• Risk-Based Scoring
• Two-Factor Authentication
• Transaction Signing
• Secure Communications
• CrontoSign Support
• Jailbreak & Root Detection
• PIN Management
• Integration with Biometrics
• Device Binding
• QR Code Support
• Secure Storage
• Device Identification
• Geolocation
• Runtime Application
• Self-Protection

Mobile App Hardships

• They include code, business rationale, databases, and APIs.
• Each plays a crucial role in mobile app security standards
• Having strong standards can be a differentiator.

Securing Code

• App security is needed from the start
• Apps are not web applications, where information exists on a server.
• Native application codes are stored directly onto the device.
• Vulnerabilities in source code and network/data security that are comprised of important components must be resolved.

Tips for Securing Code

• Secure with encryption
• Review the code for vulnerabilities or perform an audit.
• Remember file size, performance data.

Securing Sever / Network Connections

• Protect the server with safety precautions
• Verify that any user going from your client back to you through that API should be thoroughly checked.
• Containerize data with encryption
• Virtual private networks, transport layer security , and secure socker layer.

Identification / Authentication / Authorizing

• Apps should make use of technology that will enable the app with a login procedure
• Tips:
  • manage functions to be sure they use API and reduce vulnerability.
  • For encrypted data exchange, JSON web tokens.
• Use openID connective to raise mobile app security
• All data stored locally should be sure with encryption.

Secure Manage API Security tips:

• Make use of identification, authentication, and authorization are the principle safety measures that include a well- manufactured API security stack.
• To test
  • Penetration testing involves intentionally examining a system
• Emulators for browsers, OS and devices will show how to do that in the real world.

Secure Mobile App steps:

• Don’t use jail brokened device
• Try to download from authentic places like the play store.

Native Apps

• Run on a single OS (iOS, Windows, Android, etc.).
• WhatsApp and Waze are examples.
• Technologies: C++, Java, Kotlin, Objective C, Swift, Python, React Native

Pros of Developing Native Apps:

• Fast performance
• Can also perform offline

Cons of Developing Native Apps:

• Limited to single platform
• Building for separate platforms is expensive
• High maintenance.

Web App/PWA

• Web applications run on every supported browser
• Responsive design makes them app-like
• Netflix and Flipboard are examples.
• PWAs are downloadable web applications
• Technology involved HTML, CSS, JavaScript.

Pros of Web Apps

• Affordable since faster
• Easier to develop and deploy since updates are instant
• Do not need approval of any app store

Cons of Web Apps:

• These only runs on some browsers
• User needs powerfull internet connection
• limited featured

Choosing Web App Development

• Web apps are the easiest to test and deploy.
• Fastest to build.
• Use if on a very limited budget
• Use if the manage of multiple platforms is not worth it

PWA

Pros:

• they do not require installment or download
• Versatile and efficient with data
• Fast updates

Cons::

• Hardware issues
• UI may vary
• Do not always have code

Hybrid Apps

• Combine the best parts of each
• They all can be cross
• Examples: Instagram and Amazon.
• These are we apps but wrapped in native shell.
• Frameworks like React Native and Cordova are hybrid-app developers.
• These tech are bound to no platforms

Pros:

-Easy to native features

• Tech is easy
• work without internet

Cons:

• Poor User Experience
• Time is low
• Do not work with browsers