Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

2/3/2016
10:30 AM
Adam Ely
Adam Ely
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Zero Trust: Now A Critical Foundation For Securing Mobile

No longer willing to rely on an OS that doesn't provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Consumers and organizations are beginning to realize that they cannot trust the operating systems of mobile devices to provide security. As mobile OS vulnerabilities and supply chain problems mount, breaches of both consumer and enterprise data are on the rise—through the OS, by direct attacks on applications and over the network.

This issue has the attention of the security world as IT and security professionals come to understand that we’re living in a “zero-trust” ecosystem when it comes to mobile devices and applications. Even up-to-date mobile operating systems don’t provide the security features that developers need.

And most devices aren’t up to date. With an 82.8% market share, according to IDC, Android dominates the mobile device market throughout the world. Data provided to Android developers in December 2015 showed that fewer than 1 percent of Android devices are using version 6.0, released two months earlier, and a full 70% were still using versions 4.4 and below. These numbers mean that most Android users don’t have access to security patches and anti-exploit features that have existed for more than a year. And because handset manufacturers (not Google) control distribution of Android updates, some devices may never be updated.

Interop 2016 Las VegasFind out more about mobile security at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

“You have to assume that your operating environment is one where a significant number of your users are on platforms that can’t be patched,” Facebook CSO Alex Stamos told CIO Journal, noting that Facebook is working hard on building security directly into its own apps. Consequently, because developers cannot inherently trust what they start with—the mobile OS—applications must become capable of safeguarding the assets they contain: the identity of the user, consumer data, enterprise data, and whatever else is of value or precious within the app.

The Zero-Trust Model
For the first time in the mobile world I’m seeing individual developers and organizations that develop mobile apps adopting a zero-trust model for development. No longer willing to rely on an OS that doesn’t provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Developers are researching the nature of the threats: how are apps are being attacked? How are paywalls being bypassed? How are services being appropriated and used for free by attackers? How is consumer data being stolen and resold? The answers are complicated, especially in highly distributed mobile environments where organizations lack control of their endpoints—environments radically different from those of the not-so-distant past when IT professionals could concentrate on the security of servers, desktops, and employee laptops.

The task for today’s developers is to build multiple layers of functionality, both to defend against immediate threats and to protect the distributed mobile ecosystem for the long term, wherever and however its endpoints are dispersed.

The Pillars of Protection
To implement a zero-trust model of app development, companies must start with three pillars of protection:

Security. The first pillar is security, which includes features such as encryption and obfuscation. The goal of this pillar is to build a vault around assets that need to be protected and to ship the vault with the app, no matter where the app goes and no matter what kind of device it’s on. Mobile application security features are designed to protect apps that may run on insecure and high-risk devices, whether they’re gray market, counterfeit, jailbroken—or just out of date.

Self-defense. After a vault is built around an application’s data, the app needs to be able to protect itself. Apps need to be able to make real-time decisions on devices without input from any other components, to protect themselves even when offline, and to guard against malware attacks and reverse engineering. An app designed to be self-defending notices when an abnormal event occurs and can actively shut itself down, send alerts, and take other actions as needed to ensure that an organization knows that a risk has been detected and assets have been protected.

Visibility. The third pillar of protection is visibility (also called “eventing”). Eventing mechanisms produce notifications each time services are called, helping organizations see their risks in mobile and make better decisions about how strong their vaults need to be, what sort of defense capabilities are required, and how many security guards they should deploy. Visibility into the nature and scale of fraud, and the capability to perform forensics if the system is comprised, helps organizations adapt their enterprise mobile security policies.

Organizations that are keeping zero trust in mind throughout the app development life cycle are making themselves much more effective at combating mobile malware, external account compromises, and internal data theft. As they come to understand that their apps exist in a zero-trust ecosystem, they are beginning to mature their processes and evolve security responses to meet the demands of an evolving threat landscape.

More on this topic: 

Adam Ely is the founder and COO of Bluebox. Prior to this role, Adam was the CISO of the Heroku business unit at Salesforce where he was responsible for application security, security operations, compliance, and external security relations. Prior to Salesforce, Adam led ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9405
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
CVE-2020-9406
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
CVE-2020-9407
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
CVE-2020-9398
PUBLISHED: 2020-02-25
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVE-2015-5201
PUBLISHED: 2020-02-25
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows r...