Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

2/3/2016
10:30 AM
Adam Ely
Adam Ely
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Zero Trust: Now A Critical Foundation For Securing Mobile

No longer willing to rely on an OS that doesn't provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Consumers and organizations are beginning to realize that they cannot trust the operating systems of mobile devices to provide security. As mobile OS vulnerabilities and supply chain problems mount, breaches of both consumer and enterprise data are on the rise—through the OS, by direct attacks on applications and over the network.

This issue has the attention of the security world as IT and security professionals come to understand that we’re living in a “zero-trust” ecosystem when it comes to mobile devices and applications. Even up-to-date mobile operating systems don’t provide the security features that developers need.

And most devices aren’t up to date. With an 82.8% market share, according to IDC, Android dominates the mobile device market throughout the world. Data provided to Android developers in December 2015 showed that fewer than 1 percent of Android devices are using version 6.0, released two months earlier, and a full 70% were still using versions 4.4 and below. These numbers mean that most Android users don’t have access to security patches and anti-exploit features that have existed for more than a year. And because handset manufacturers (not Google) control distribution of Android updates, some devices may never be updated.

Interop 2016 Las VegasFind out more about mobile security at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

“You have to assume that your operating environment is one where a significant number of your users are on platforms that can’t be patched,” Facebook CSO Alex Stamos told CIO Journal, noting that Facebook is working hard on building security directly into its own apps. Consequently, because developers cannot inherently trust what they start with—the mobile OS—applications must become capable of safeguarding the assets they contain: the identity of the user, consumer data, enterprise data, and whatever else is of value or precious within the app.

The Zero-Trust Model
For the first time in the mobile world I’m seeing individual developers and organizations that develop mobile apps adopting a zero-trust model for development. No longer willing to rely on an OS that doesn’t provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Developers are researching the nature of the threats: how are apps are being attacked? How are paywalls being bypassed? How are services being appropriated and used for free by attackers? How is consumer data being stolen and resold? The answers are complicated, especially in highly distributed mobile environments where organizations lack control of their endpoints—environments radically different from those of the not-so-distant past when IT professionals could concentrate on the security of servers, desktops, and employee laptops.

The task for today’s developers is to build multiple layers of functionality, both to defend against immediate threats and to protect the distributed mobile ecosystem for the long term, wherever and however its endpoints are dispersed.

The Pillars of Protection
To implement a zero-trust model of app development, companies must start with three pillars of protection:

Security. The first pillar is security, which includes features such as encryption and obfuscation. The goal of this pillar is to build a vault around assets that need to be protected and to ship the vault with the app, no matter where the app goes and no matter what kind of device it’s on. Mobile application security features are designed to protect apps that may run on insecure and high-risk devices, whether they’re gray market, counterfeit, jailbroken—or just out of date.

Self-defense. After a vault is built around an application’s data, the app needs to be able to protect itself. Apps need to be able to make real-time decisions on devices without input from any other components, to protect themselves even when offline, and to guard against malware attacks and reverse engineering. An app designed to be self-defending notices when an abnormal event occurs and can actively shut itself down, send alerts, and take other actions as needed to ensure that an organization knows that a risk has been detected and assets have been protected.

Visibility. The third pillar of protection is visibility (also called “eventing”). Eventing mechanisms produce notifications each time services are called, helping organizations see their risks in mobile and make better decisions about how strong their vaults need to be, what sort of defense capabilities are required, and how many security guards they should deploy. Visibility into the nature and scale of fraud, and the capability to perform forensics if the system is comprised, helps organizations adapt their enterprise mobile security policies.

Organizations that are keeping zero trust in mind throughout the app development life cycle are making themselves much more effective at combating mobile malware, external account compromises, and internal data theft. As they come to understand that their apps exist in a zero-trust ecosystem, they are beginning to mature their processes and evolve security responses to meet the demands of an evolving threat landscape.

More on this topic: 

Adam Ely is the founder and COO of Bluebox. Prior to this role, Adam was the CISO of the Heroku business unit at Salesforce where he was responsible for application security, security operations, compliance, and external security relations. Prior to Salesforce, Adam led ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9717
PUBLISHED: 2019-09-19
In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c has a complex format argument to sscanf.
CVE-2019-9719
PUBLISHED: 2019-09-19
A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf.
CVE-2019-9720
PUBLISHED: 2019-09-19
A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf.
CVE-2019-16525
PUBLISHED: 2019-09-19
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.
CVE-2019-9619
PUBLISHED: 2019-09-19
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.