Mobile security is complex because of the large number of potential attack vectors – devices can be targeted at multiple levels:
Applications: Malware can be developed and deployed as malicious apps that users unwittingly install on their devices. Mobile security solutions should be able to detect and block downloads of these malicious apps.
Network: Mobile devices and the legitimate apps that run on them can be targeted at the network level. Man-in-the-Middle, phishing, and other attacks take advantage of network connectivity to steal data or deliver malicious content. Mobile security involves blocking these network-level attacks.
OS: Both iOS and Android operating systems can contain exploitable vulnerabilities, which are used for jailbreaking/rooting devices either by users or by malware. This provides an attacker with advanced permissions on the device, breaking its security model. Mobile security incorporates real-time risk assessments, configuration monitoring, and other tools to detect exploitation of device vulnerabilities.
Top Threats to Mobile Security
Mobile devices suffer from a number of potential cyber threats. Some of the most common and impactful include:
Malicious Apps and Websites: Mobile devices can have mobile malware installed on them and access malicious online content.
Mobile Ransomware: Mobile ransomware is one type of malicious app that is becoming more common and impactful as more valuable and sensitive data is stored on mobile devices.
Phishing: Mobile devices have access to a number of different communications media – email, SMS, social media, etc. – making them an ideal platform for performing phishing attacks that steal data or carry malicious content.
Man-in-the-Middle Attacks: Mobile communications do not always use secure technologies, making them vulnerable to interception for eavesdropping or modification of data.
Advanced Jailbreaking and Rooting Techniques: Jailbreaking and rooting provide elevated permissions on a mobile device, enabling an attacker to take a greater range of malicious actions.
OS Exploits: Like any other software, mobile operating systems can contain exploitable vulnerabilities that place them and their users at risk.
Top Hurdles to Effective Mobile Security
Mobile security should be a priority for organizations; however, some common misconceptions about it can cause organizations to compromise the protection of their mobile devices:
Protection vs. Productivity? The belief that business productivity and security are at odds is a common misconception. As a result, some organizations may choose not to implement strong mobile security in an attempt to protect business productivity.
Protection vs. Privacy? Strong cybersecurity requires visibility into potential threats, but mobile devices can also carry personal data, such as photos, videos, and more. The need to balance privacy and security can make finding a mobile security solution difficult.
Can MDM Really Protect? Mobile device management (MDM) solutions are a tool designed to enable remote monitoring and management of mobile devices. However, they do not offer robust cybersecurity protections. The common misconception that MDM is sufficient for security decreases mobile protection and can block deployment of strong mobile security solutions.
Effectively Protecting Mobile Devices
Secure mobile access is an important component of an enterprise cybersecurity strategy. As mobile devices become a more widely-used option for remote work, the data, applications, and systems that they access are at increased risk of compromise by infected devices.
At the same time, mobile security needs to prioritize the needs of the device users, including privacy and usability. Achieving this while providing effective mobile threat defense requires a mobile security solution that implements these core principles of optimal mobile threat defense:
Covering All Attack Vectors: Mobile devices can be attacked via multiple vectors, including at the application, network, and operating system levels. A mobile security solution should provide protection at all of these levels.
Full Risk Visibility into Mobile Risk: Risk visibility is an essential component of enterprise risk management strategies. Mobile security solutions must be capable of providing security teams with an accurate accounting of the risk level of the remote workforce.
Enterprise-Level Scalability: Enterprises may have thousands of devices to manage and secure. Mobile security solutions should be capable of supporting a large and diverse (including both Android and iOS devices) set of devices used for business.
Optimized User Experience: Mobile devices are popular because they increase employee productivity. Mobile security solutions must be designed to have minimal impact on the user experience.
Privacy by Design: Mobile devices used for work may be BYOD and dual-use devices. These devices must be secured in a way that does not compromise the privacy of the devices’ users
