Mobile

5/8/2017
12:06 PM
50%
50%

DHS Report Outlines Feds' Mobile Security Threats

The US Department of Homeland Security sent Congress a study on mobile security threats facing federal government workers as well as recommendations for protection.

Mobile devices used by federal government workers are potentially at a higher risk of attack than those used by consumers, solely for the mere fact that they are public-sector employees, according to a report presented to Congress last week by the US Department of Homeland Security.

Cybercriminals targeting government workers' mobile devices view them as a potential channel to accessing back-end computer systems rich in data containing sensitive federal government information and private information on millions of Americans, according to the DHS.

While federal workers are at risk to many of the same cybersecurity threats that the average consumer faces, such as ransomware, banking fraud, and identity theft, some of the solutions to address the mobile security problem differ than that of consumers.

DHS recommends developing cooperative arrangements with mobile network operators to detect, defend, and respond to threats – and potentially extending the DHS National Protection and Programs Directorate authority to achieve these objectives. The study also calls for more policy and procedural changes that recognize mobile security should be treated differently than desktop architecture security.

Some of DHS' recommendations are similar to those practiced by the private sector, such as adopting a mobile device security framework that uses existing standards and best practices, and including mobility in a continuous security diagnostics and mitigation program similar to that of network devices.

Read more on the DHS study here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Julian Assange Arrested in London
Dark Reading Staff 4/11/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
The Single Cybersecurity Question Every CISO Should Ask
Arif Kareem, CEO, ExtraHop,  4/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11320
PUBLISHED: 2019-04-18
In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51.1 address.
CVE-2019-11321
PUBLISHED: 2019-04-18
An issue was discovered in Motorola CX2 1.01 and M2 1.01. The router opens TCP port 8010. Users can send hnap requests to this port without authentication to obtain information such as the MAC addresses of connected client devices.
CVE-2019-11322
PUBLISHED: 2019-04-18
An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads to remote code execution via shell metacharacters in a JSON value.
CVE-2019-8999
PUBLISHED: 2019-04-18
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
CVE-2018-17168
PUBLISHED: 2019-04-18
PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by following a link, can be tricked into making unwanted changes to a printer (Disable, Approve, etc).