Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

3/26/2020
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Mobile Security Problems That Most Security Teams Haven't Fixed Yet

Mobility must be included in the security operations workflow so that company data is protected regardless of where remote workers are located.

Workplaces continue to expand beyond the walls of the traditional office building and out into unsecured environments, increasingly relying on mobile devices. But as mobile usage increases, so do the security risks. According to the "Verizon 2020 Mobile Security Indes Report," 67% of organizations say they are less confident in their security than their other IT assets, and 33% admit to having suffered a compromise involving a mobile device.

Even as enterprises begin to allow more and more access to sensitive information via mobile devices, there remain three mobile security problems that most security teams have yet to fix.

  1. Allowing malware to be a distraction, when the real threat is mobile phishing: When it comes to modern cybersecurity threats, the conversation has largely been dominated by malware. The deluge of headlines warning of increased attacks across industries with catastrophic consequences serve as a distraction when it comes to mobile security. Wandera's "Mobile Threat Landscape 2020" report found that just 13% of all organizations have experienced a malware incident on a mobile device, compared with the 57% of organizations that have experienced a mobile phishing incident.

    And phishing threats continue to evolve, with 81% of attacks now taking place outside of email. Instead, attackers are targeting victims via messaging apps or social media, where they have a better chance of luring users into fake profiles, promotions, and notifications. These tactics make it easier for bad actors to extract personal data and account credentials discreetly, leaving the user oblivious to the breach. Don't be fooled by the constant malware headlines — organizations must remain vigilant when it comes to mobile phishing, as the threat posed by malware pales in comparison.
  1. Misunderstanding application security: Even as the availability of apps for enterprises has increased, the emphasis on mobile app security has not kept pace. While mobile has the potential to make organizations more efficient, it presents a whole new set of challenges by expanding the footprint that IT needs to manage and secure, and the risks go far beyond simple malware.

    Currently, there are three areas that mobile businesses are struggling to tackle. First, persistent data leaks, such as the ones British Airways experienced in 2019 due to unencrypted check-in links across mobile platforms. Second, policies that allow apps with excessive permissions, which often lead to users unknowingly expose personal data. As we've learned on numerous occasions with WhatsApp, what's secure today might be vulnerable tomorrow, and apps with excessive permissions require continuous monitoring. Finally, organizations need to set clear policies for governing and monitoring apps, specifically those that are used without direct approval from the IT department. For example, physicians who store sensitive patient data on personal tablets run the risk of exposing that information when they are introduced to untrusted software.

    One solution to this issue would be for organizations to consider vetting applications over time, rather than just one initial screening process at the onset. Continuous vetting is a proven method to address all three challenges and ensure your organization stays ahead of vulnerabilities and avoids catastrophe.
  1. Trusting your mobile operating systems: The past year has taught us that even the most current operating systems aren't necessarily the most secure. There is a common misconception that iPhones and Android devices are secure without requiring security software; and yet, both Apple and Google have demonstrated time and again that they are not immune to vulnerabilities. Earlier this year, Apple accidentally reopened a security flaw that introduced jailbreak risks, just weeks after discovering that hackers could remotely retrieve files from an iOS device by exploiting a vulnerability in iMessage.

    Similarly, Android device manufacturers are no strangers to controversy, as researchers discover new Android vulnerabilities on a regular basis, even on brand-new devices. Both of these examples prove again that mobile operating systems simply aren't bulletproof. It's time for organizations to implement a layered system of defense in order to mitigate attacks, should they slip through a hole in that organization's mobile operating system of choice.

Mobile deployments represent a new set of security challenges for which organizations haven't yet accounted. Few have policies in place to ensure that effective adoption of mobile devices doesn't compromise the security of the corporate data used on these devices. Moving forward, organizations must establish formal documentation guiding employees on how to securely work remotely. Additionally, they should incorporate mobility into the security operations workflow so company data is protected no matter where workers are physically located. The NIST Guidelines for Managing the Security of Mobile Devices in the Enterprise is a step in the right direction, but we still have a long way to go, and now is the time to get started.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Security Lessons We've Learned (So Far) from COVID-19."

Michael J. Covington, Ph.D., is a seasoned technologist and the Vice President of Product Strategy for Wandera, a leading provider of mobile security. Michael is a hands-on innovator with broad experience across the entire product life cycle, from planning and R&D to ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Attacker Dwell Time: Ransomware's Most Important Metric
Ricardo Villadiego, Founder and CEO of Lumu,  9/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20902
PUBLISHED: 2020-10-01
Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.
CVE-2019-20903
PUBLISHED: 2020-10-01
The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.
CVE-2020-25288
PUBLISHED: 2020-09-30
An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitra...
CVE-2020-25781
PUBLISHED: 2020-09-30
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
CVE-2020-25830
PUBLISHED: 2020-09-30
An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php.