Workplaces continue to expand beyond the walls of the traditional office building and out into unsecured environments, increasingly relying on mobile devices. But as mobile usage increases, so do the security risks. According to the "Verizon 2020 Mobile Security Indes Report," 67% of organizations say they are less confident in their security than their other IT assets, and 33% admit to having suffered a compromise involving a mobile device.
Even as enterprises begin to allow more and more access to sensitive information via mobile devices, there remain three mobile security problems that most security teams have yet to fix.
- Allowing malware to be a distraction, when the real threat is mobile phishing: When it comes to modern cybersecurity threats, the conversation has largely been dominated by malware. The deluge of headlines warning of increased attacks across industries with catastrophic consequences serve as a distraction when it comes to mobile security. Wandera's "Mobile Threat Landscape 2020" report found that just 13% of all organizations have experienced a malware incident on a mobile device, compared with the 57% of organizations that have experienced a mobile phishing incident.
And phishing threats continue to evolve, with 81% of attacks now taking place outside of email. Instead, attackers are targeting victims via messaging apps or social media, where they have a better chance of luring users into fake profiles, promotions, and notifications. These tactics make it easier for bad actors to extract personal data and account credentials discreetly, leaving the user oblivious to the breach. Don't be fooled by the constant malware headlines — organizations must remain vigilant when it comes to mobile phishing, as the threat posed by malware pales in comparison.
- Misunderstanding application security: Even as the availability of apps for enterprises has increased, the emphasis on mobile app security has not kept pace. While mobile has the potential to make organizations more efficient, it presents a whole new set of challenges by expanding the footprint that IT needs to manage and secure, and the risks go far beyond simple malware.
Currently, there are three areas that mobile businesses are struggling to tackle. First, persistent data leaks, such as the ones British Airways experienced in 2019 due to unencrypted check-in links across mobile platforms. Second, policies that allow apps with excessive permissions, which often lead to users unknowingly expose personal data. As we've learned on numerous occasions with WhatsApp, what's secure today might be vulnerable tomorrow, and apps with excessive permissions require continuous monitoring. Finally, organizations need to set clear policies for governing and monitoring apps, specifically those that are used without direct approval from the IT department. For example, physicians who store sensitive patient data on personal tablets run the risk of exposing that information when they are introduced to untrusted software.
One solution to this issue would be for organizations to consider vetting applications over time, rather than just one initial screening process at the onset. Continuous vetting is a proven method to address all three challenges and ensure your organization stays ahead of vulnerabilities and avoids catastrophe.
- Trusting your mobile operating systems: The past year has taught us that even the most current operating systems aren't necessarily the most secure. There is a common misconception that iPhones and Android devices are secure without requiring security software; and yet, both Apple and Google have demonstrated time and again that they are not immune to vulnerabilities. Earlier this year, Apple accidentally reopened a security flaw that introduced jailbreak risks, just weeks after discovering that hackers could remotely retrieve files from an iOS device by exploiting a vulnerability in iMessage.
Similarly, Android device manufacturers are no strangers to controversy, as researchers discover new Android vulnerabilities on a regular basis, even on brand-new devices. Both of these examples prove again that mobile operating systems simply aren't bulletproof. It's time for organizations to implement a layered system of defense in order to mitigate attacks, should they slip through a hole in that organization's mobile operating system of choice.
Mobile deployments represent a new set of security challenges for which organizations haven't yet accounted. Few have policies in place to ensure that effective adoption of mobile devices doesn't compromise the security of the corporate data used on these devices. Moving forward, organizations must establish formal documentation guiding employees on how to securely work remotely. Additionally, they should incorporate mobility into the security operations workflow so company data is protected no matter where workers are physically located. The NIST Guidelines for Managing the Security of Mobile Devices in the Enterprise is a step in the right direction, but we still have a long way to go, and now is the time to get started.
Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Security Lessons We've Learned (So Far) from COVID-19."