Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

2/3/2016
10:30 AM
Adam Ely
Adam Ely
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
100%
0%

Zero Trust: Now A Critical Foundation For Securing Mobile

No longer willing to rely on an OS that doesn't provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Consumers and organizations are beginning to realize that they cannot trust the operating systems of mobile devices to provide security. As mobile OS vulnerabilities and supply chain problems mount, breaches of both consumer and enterprise data are on the rise—through the OS, by direct attacks on applications and over the network.

This issue has the attention of the security world as IT and security professionals come to understand that we’re living in a “zero-trust” ecosystem when it comes to mobile devices and applications. Even up-to-date mobile operating systems don’t provide the security features that developers need.

And most devices aren’t up to date. With an 82.8% market share, according to IDC, Android dominates the mobile device market throughout the world. Data provided to Android developers in December 2015 showed that fewer than 1 percent of Android devices are using version 6.0, released two months earlier, and a full 70% were still using versions 4.4 and below. These numbers mean that most Android users don’t have access to security patches and anti-exploit features that have existed for more than a year. And because handset manufacturers (not Google) control distribution of Android updates, some devices may never be updated.

Interop 2016 Las VegasFind out more about mobile security at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

“You have to assume that your operating environment is one where a significant number of your users are on platforms that can’t be patched,” Facebook CSO Alex Stamos told CIO Journal, noting that Facebook is working hard on building security directly into its own apps. Consequently, because developers cannot inherently trust what they start with—the mobile OS—applications must become capable of safeguarding the assets they contain: the identity of the user, consumer data, enterprise data, and whatever else is of value or precious within the app.

The Zero-Trust Model
For the first time in the mobile world I’m seeing individual developers and organizations that develop mobile apps adopting a zero-trust model for development. No longer willing to rely on an OS that doesn’t provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Developers are researching the nature of the threats: how are apps are being attacked? How are paywalls being bypassed? How are services being appropriated and used for free by attackers? How is consumer data being stolen and resold? The answers are complicated, especially in highly distributed mobile environments where organizations lack control of their endpoints—environments radically different from those of the not-so-distant past when IT professionals could concentrate on the security of servers, desktops, and employee laptops.

The task for today’s developers is to build multiple layers of functionality, both to defend against immediate threats and to protect the distributed mobile ecosystem for the long term, wherever and however its endpoints are dispersed.

The Pillars of Protection
To implement a zero-trust model of app development, companies must start with three pillars of protection:

Security. The first pillar is security, which includes features such as encryption and obfuscation. The goal of this pillar is to build a vault around assets that need to be protected and to ship the vault with the app, no matter where the app goes and no matter what kind of device it’s on. Mobile application security features are designed to protect apps that may run on insecure and high-risk devices, whether they’re gray market, counterfeit, jailbroken—or just out of date.

Self-defense. After a vault is built around an application’s data, the app needs to be able to protect itself. Apps need to be able to make real-time decisions on devices without input from any other components, to protect themselves even when offline, and to guard against malware attacks and reverse engineering. An app designed to be self-defending notices when an abnormal event occurs and can actively shut itself down, send alerts, and take other actions as needed to ensure that an organization knows that a risk has been detected and assets have been protected.

Visibility. The third pillar of protection is visibility (also called “eventing”). Eventing mechanisms produce notifications each time services are called, helping organizations see their risks in mobile and make better decisions about how strong their vaults need to be, what sort of defense capabilities are required, and how many security guards they should deploy. Visibility into the nature and scale of fraud, and the capability to perform forensics if the system is comprised, helps organizations adapt their enterprise mobile security policies.

Organizations that are keeping zero trust in mind throughout the app development life cycle are making themselves much more effective at combating mobile malware, external account compromises, and internal data theft. As they come to understand that their apps exist in a zero-trust ecosystem, they are beginning to mature their processes and evolve security responses to meet the demands of an evolving threat landscape.

More on this topic: 

Adam Ely is the founder and COO of Bluebox. Prior to this role, Adam was the CISO of the Heroku business unit at Salesforce where he was responsible for application security, security operations, compliance, and external security relations. Prior to Salesforce, Adam led ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CVE-2020-15277
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.
CVE-2020-7373
PUBLISHED: 2020-10-30
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is ...