On Friday we released our latest technical newsletter with the fancy title
“Sell Your Own Device – A Field Study on Decommissioning of Mobile
Devices”. It is the result of a field study on decommissioned mobile business
devices bought on eBay and about how stored data may be extracted in different
ways.
As always we love to share plenty of practical advise: At the end of the
newsletter you will find the mitigating controls to securely handle mobile
devices at the end of their life cycle process.
On last year’s TROOPERS11,
Matthias (mluft) and I gave a
talk
on Multifunction Devices. Hardly surprising: It was related to the state of
secure operation of MFDs. It was heavily motivated by experiences we collected
out in the wild. We faced a frightening low level of awareness concerning the
role of MFDs for the overall security picture – in particular regarding the
processing of sensitive data…
However, instead of only showing and proving well-known weaknesses and
vulnerabilities, we decided to adapt ERNW’s
*Seven Sisters *model
in order to match the needs of secure MFD operation and to develop some kind of
guideline. As Matthias already lost some
words on this,
I’m not gonna waste your valuable time by repeating, what has already been said.
However I described our approach and our thoughts on that topic in a recently
published ERNW Newsletter. If
for what ever reason you didn’t see our talk or even didn’t attend
TROOPERS11 at all, have a look on
Newsletter 37 and give us feedback on what you think about the whole topic…
We recently performed a Proof-of-Concept (PoC) implementation of certificate
based auth with iPads in some large environment. So far the focus has been
mainly on WLAN access; VPN and EAS authentication are going to follow in the
next step.
As we figure that the topic might be of interest for some of you, we’ve
extracted a certain, not-too-customer-specific part of the deliverable and
converted it into an
ERNW newsletter.
Special thanks go to Rene Graf for leading the project! 😉
Just wanted to let you know that we sent out
ERNW Newsletter 32
end of last week. As we
promised
it includes the results of research regarding the question “Is browser
virtualization a valid security control in order to mitigate browser based
security risks?”.
Simon did a great job with writing the latest newsletter. It’s a 30-page
document which should help you to have a basis for well-informed decisions when
it comes to the deployment of an application virtualization technology.