Mobile
2/3/2016
10:30 AM
Adam Ely
Adam Ely
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Zero Trust: Now A Critical Foundation For Securing Mobile

No longer willing to rely on an OS that doesn't provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Consumers and organizations are beginning to realize that they cannot trust the operating systems of mobile devices to provide security. As mobile OS vulnerabilities and supply chain problems mount, breaches of both consumer and enterprise data are on the rise—through the OS, by direct attacks on applications and over the network.

This issue has the attention of the security world as IT and security professionals come to understand that we’re living in a “zero-trust” ecosystem when it comes to mobile devices and applications. Even up-to-date mobile operating systems don’t provide the security features that developers need.

And most devices aren’t up to date. With an 82.8% market share, according to IDC, Android dominates the mobile device market throughout the world. Data provided to Android developers in December 2015 showed that fewer than 1 percent of Android devices are using version 6.0, released two months earlier, and a full 70% were still using versions 4.4 and below. These numbers mean that most Android users don’t have access to security patches and anti-exploit features that have existed for more than a year. And because handset manufacturers (not Google) control distribution of Android updates, some devices may never be updated.

Interop 2016 Las VegasFind out more about mobile security at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

“You have to assume that your operating environment is one where a significant number of your users are on platforms that can’t be patched,” Facebook CSO Alex Stamos told CIO Journal, noting that Facebook is working hard on building security directly into its own apps. Consequently, because developers cannot inherently trust what they start with—the mobile OS—applications must become capable of safeguarding the assets they contain: the identity of the user, consumer data, enterprise data, and whatever else is of value or precious within the app.

The Zero-Trust Model
For the first time in the mobile world I’m seeing individual developers and organizations that develop mobile apps adopting a zero-trust model for development. No longer willing to rely on an OS that doesn’t provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Developers are researching the nature of the threats: how are apps are being attacked? How are paywalls being bypassed? How are services being appropriated and used for free by attackers? How is consumer data being stolen and resold? The answers are complicated, especially in highly distributed mobile environments where organizations lack control of their endpoints—environments radically different from those of the not-so-distant past when IT professionals could concentrate on the security of servers, desktops, and employee laptops.

The task for today’s developers is to build multiple layers of functionality, both to defend against immediate threats and to protect the distributed mobile ecosystem for the long term, wherever and however its endpoints are dispersed.

The Pillars of Protection
To implement a zero-trust model of app development, companies must start with three pillars of protection:

Security. The first pillar is security, which includes features such as encryption and obfuscation. The goal of this pillar is to build a vault around assets that need to be protected and to ship the vault with the app, no matter where the app goes and no matter what kind of device it’s on. Mobile application security features are designed to protect apps that may run on insecure and high-risk devices, whether they’re gray market, counterfeit, jailbroken—or just out of date.

Self-defense. After a vault is built around an application’s data, the app needs to be able to protect itself. Apps need to be able to make real-time decisions on devices without input from any other components, to protect themselves even when offline, and to guard against malware attacks and reverse engineering. An app designed to be self-defending notices when an abnormal event occurs and can actively shut itself down, send alerts, and take other actions as needed to ensure that an organization knows that a risk has been detected and assets have been protected.

Visibility. The third pillar of protection is visibility (also called “eventing”). Eventing mechanisms produce notifications each time services are called, helping organizations see their risks in mobile and make better decisions about how strong their vaults need to be, what sort of defense capabilities are required, and how many security guards they should deploy. Visibility into the nature and scale of fraud, and the capability to perform forensics if the system is comprised, helps organizations adapt their enterprise mobile security policies.

Organizations that are keeping zero trust in mind throughout the app development life cycle are making themselves much more effective at combating mobile malware, external account compromises, and internal data theft. As they come to understand that their apps exist in a zero-trust ecosystem, they are beginning to mature their processes and evolve security responses to meet the demands of an evolving threat landscape.

More on this topic: 

Adam Ely is the founder and COO of Bluebox. Prior to this role, Adam was the CISO of the Heroku business unit at Salesforce where he was responsible for application security, security operations, compliance, and external security relations. Prior to Salesforce, Adam led ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
DNS Threats: What Every Enterprise Should Know
Domain Name System exploits could put your data at risk. Here's some advice on how to avoid them.
Flash Poll
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If you’re still focused on securing endpoints, you’ve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Tim Wilson speaks to two experts on vulnerability research – independent consultant Jeremiah Grossman and Black Duck Software’s Mike Pittenger – about the latest wave of vulnerabilities being exploited by online attackers