Implementing Security for Mobile Computers in C#

Creator QR in C# Implementing Security for Mobile Computers

Regardless of whether you use hardware alarms or boot protection mechanisms, you should implement protection for data that is stored on a laptop computer. On network servers, discretionary access control lists (DACLs) are the primary method of protecting files. Unfortunately, access control lists (ACLs) are of little use when a computer is in the possession of an attacker. Unlike network servers, whose physical security can be protected by network administrators, laptop computers can be easily stolen. An attacker can remove the hard drive from a laptop and install it in a computer on which the attacker has administrative privileges. The attacker can take ownership of the files and folders on the laptop computer s hard drive and read the files and folders.

You might have seen the advertisements that promise, based on increased security technologies built into the laptop, that mobile computers will be much more resistant to information disclosure even if critical components, such as hard drives, are removed from them. As security expert Bruce Schneier would note, a distinct smell of snake oil is in the air. Presumably, the information stored on the laptop would not be permanently rendered inaccessible or encrypted when a potential security compromise is detected this would carry a major risk to the user if he, or his four-year-old daughter, should accidentally trip one of the theft sensors. So what is the truth of the matter Although not entirely snake oil, a skilled engineer with good knowledge of hard drive architecture and the Advanced Technology Attachment (ATA) specifications can likely retrieve the hard drive power-on password stored on the disk. Of course, there is an easier way; professional data recovery companies already retain the people with these skills and the necessary equipment, such as clean rooms. Retrieving the data might cost no more than a few hundred to a few thousand dollars. These security technologies certain raise the bar, most likely too high for the petty criminal or 15-year-old kid down the street, but it is unlikely they will stop the determined, well-funded attacker. To lessen this risk, you can use EFS to secure the information on a laptop. When you use EFS properly, the only way to retrieve the information contained in the files is by performing a brute force attack on the encryption algorithm. In Windows 2000 and Windows XP, EFS uses the 56-bit DESX algorithm. Although computationally feasible, this algorithm is difficult to break. Windows XP and Windows Server 2003 also allow you to use the 3DES algorithm, which is presumably computationally infeasible and thereby makes performing a brute force attack virtually impossible, given current hardware constraints.

Part III:

The other data protection issue to address with laptop computers is their logical security. Unlike desktop computers, which are protected from untrusted networks by firewalls and routers, laptop computers might be connected to untrusted networks on a regular basis. For example, a user might use the high-speed connection in her hotel room to create a virtual private network (VPN) connection to the corporate network. By doing this, the user creates a relatively unprotected, authenticated route to the corporate network from the Internet, not to mention she places the data stored locally on her laptop in danger. To prevent this situation, users can use personal firewall applications, such as Windows Firewall in Windows XP.

Securing mobile devices, such as devices running Windows Mobile 2003 (collectively known as SmartPhones), Pocket PCs, and Pocket PC Phone Edition devices, is similar to securing laptop computers. Mobile devices should have user passwords to prevent unauthorized users and attackers from accessing them. For example, Pocket PC 2002 supports both four-digit passwords and alphanumeric passwords for protecting access to the device. Each time an incorrect password is attempted, a time delay is activated before the logon screen will reappear. The delay increases exponentially upon each successive incorrect attempt. In addition, if the mobile device will be connecting to the Internet or untrusted networks, such as public 802.11b wireless networks, you should ensure that the device securely transmits authentication packets and data. For example, Pocket PC 2002 supports connecting to Web sites that have Secure Sockets Layer (SSL) connections enabled and wireless networks that use WEP. Although few viruses or Trojan horses resulting in significant damage that specifically attack the Pocket PC platform or other types of mobile devices have been reported, because these types of mobile devices are increasingly being connected to IP networks for long periods of time, as with laptop computers, you must install and maintain antivirus software on mobile devices and ensure that all security updates are applied as soon as they are released. You might have certain users in your organization who have especially high security requirements, such as those needed to safeguard information that, if disclosed, could lead to the loss of life. You should avoid storing any important information persistently on the laptops of these users. You should also require these users to create a VPN connection to the corporate network and then use Terminal Services to connect to a computer on the network to access information. Furthermore, you should disable the option of storing cached credentials by setting the number of cached credentials to 0 in the registry and restarting the computer. When you prevent credentials from being cached on the laptop, the user will not be able to log on to

20: