Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:00 PM
Connect Directly
E-Mail vvv

3 Mobile Security Problems That Most Security Teams Haven't Fixed Yet

Mobility must be included in the security operations workflow so that company data is protected regardless of where remote workers are located.

Workplaces continue to expand beyond the walls of the traditional office building and out into unsecured environments, increasingly relying on mobile devices. But as mobile usage increases, so do the security risks. According to the "Verizon 2020 Mobile Security Indes Report," 67% of organizations say they are less confident in their security than their other IT assets, and 33% admit to having suffered a compromise involving a mobile device.

Even as enterprises begin to allow more and more access to sensitive information via mobile devices, there remain three mobile security problems that most security teams have yet to fix.

  1. Allowing malware to be a distraction, when the real threat is mobile phishing: When it comes to modern cybersecurity threats, the conversation has largely been dominated by malware. The deluge of headlines warning of increased attacks across industries with catastrophic consequences serve as a distraction when it comes to mobile security. Wandera's "Mobile Threat Landscape 2020" report found that just 13% of all organizations have experienced a malware incident on a mobile device, compared with the 57% of organizations that have experienced a mobile phishing incident.

    And phishing threats continue to evolve, with 81% of attacks now taking place outside of email. Instead, attackers are targeting victims via messaging apps or social media, where they have a better chance of luring users into fake profiles, promotions, and notifications. These tactics make it easier for bad actors to extract personal data and account credentials discreetly, leaving the user oblivious to the breach. Don't be fooled by the constant malware headlines — organizations must remain vigilant when it comes to mobile phishing, as the threat posed by malware pales in comparison.
  1. Misunderstanding application security: Even as the availability of apps for enterprises has increased, the emphasis on mobile app security has not kept pace. While mobile has the potential to make organizations more efficient, it presents a whole new set of challenges by expanding the footprint that IT needs to manage and secure, and the risks go far beyond simple malware.

    Currently, there are three areas that mobile businesses are struggling to tackle. First, persistent data leaks, such as the ones British Airways experienced in 2019 due to unencrypted check-in links across mobile platforms. Second, policies that allow apps with excessive permissions, which often lead to users unknowingly expose personal data. As we've learned on numerous occasions with WhatsApp, what's secure today might be vulnerable tomorrow, and apps with excessive permissions require continuous monitoring. Finally, organizations need to set clear policies for governing and monitoring apps, specifically those that are used without direct approval from the IT department. For example, physicians who store sensitive patient data on personal tablets run the risk of exposing that information when they are introduced to untrusted software.

    One solution to this issue would be for organizations to consider vetting applications over time, rather than just one initial screening process at the onset. Continuous vetting is a proven method to address all three challenges and ensure your organization stays ahead of vulnerabilities and avoids catastrophe.
  1. Trusting your mobile operating systems: The past year has taught us that even the most current operating systems aren't necessarily the most secure. There is a common misconception that iPhones and Android devices are secure without requiring security software; and yet, both Apple and Google have demonstrated time and again that they are not immune to vulnerabilities. Earlier this year, Apple accidentally reopened a security flaw that introduced jailbreak risks, just weeks after discovering that hackers could remotely retrieve files from an iOS device by exploiting a vulnerability in iMessage.

    Similarly, Android device manufacturers are no strangers to controversy, as researchers discover new Android vulnerabilities on a regular basis, even on brand-new devices. Both of these examples prove again that mobile operating systems simply aren't bulletproof. It's time for organizations to implement a layered system of defense in order to mitigate attacks, should they slip through a hole in that organization's mobile operating system of choice.

Mobile deployments represent a new set of security challenges for which organizations haven't yet accounted. Few have policies in place to ensure that effective adoption of mobile devices doesn't compromise the security of the corporate data used on these devices. Moving forward, organizations must establish formal documentation guiding employees on how to securely work remotely. Additionally, they should incorporate mobility into the security operations workflow so company data is protected no matter where workers are physically located. The NIST Guidelines for Managing the Security of Mobile Devices in the Enterprise is a step in the right direction, but we still have a long way to go, and now is the time to get started.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Security Lessons We've Learned (So Far) from COVID-19."

Michael J. Covington, Ph.D., is a seasoned technologist and the Vice President of Product Strategy for Wandera, a leading provider of mobile security. Michael is a hands-on innovator with broad experience across the entire product life cycle, from planning and R&D to ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-18
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php p...
PUBLISHED: 2021-01-18
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...