In recent years, hackers and bad actors have relentlessly developed new and sophisticated techniques to penetrate online security systems. Whether concerning the general public, governmental officials, or corporate businesses, the vulnerability of privately-stored data has never been so acute. The exposure of business-sensitive or personal colleague information can inflict untold damage on a company’s functionality, integrity, and reputation. It is therefore vital that appropriate security measures are put in place.
Research has revealed that in 2020, a mammoth 88% of UK-based enterprises were subjected to some form of a data breach. Concerningly, this percentage increases when reviewing hacking activity in several other jurisdictions across Europe. Coinciding with this alarming surge is a change in the focal point of these attacks. Traditional targets, such as desktop operating systems, have been replaced by a contemporary charge toward information held on mobile devices.
As a direct consequence of this re-calibrated approach, criminals are now in effect pursuing the user themselves instead of the basic contents of a hard drive. Knowledge is power – and mobile devices offer a direct portal to a bounty of priceless information.
It’s now possible to perform almost any action on a PC or laptop equally as efficiently on a smartphone. Nevertheless, whilst many are aware of this reality, fewer consider how this fact tangibly increases the likelihood of intrusion. Data storage, application downloads, and network usage are all elements that conspire to offer fresh opportunities to seize information. Whilst anti-virus software has supported desktop security for decades, protection for mobile devices has lacked the equivalent potency.
However, it’s never been so important that individuals, businesses, and legislatures equip themselves to address these looming threats. So, how can these stakeholders ensure their mobile defence technology is fit for the future?
The Evolution of Mobile Threat Defence
Many may assume that promoting mechanisms to protect the integrity of mobile devices is a relatively new phenomenon. However, this school of thought has been prevalent for over a decade. Historically, conversations around smartphone security typically hinged on the IOS vs Android debate. Fast-forward to the present day, and IT specialists are still debunking myths around Apple’s apparent superior ability in addressing threats.
Furthermore, security operators still have to emphasise the proportionate relationship between escalating risk and soaring usage of mobile phones. By extension, the re-defined focus on manipulating the human user, as opposed to focusing independently on the device itself, is a concept that still hasn’t entirely been embedded into the collective psyche. Nevertheless, this movement is only set to accelerate as society becomes increasingly dependent on mobile phones.
This development may allow people to access the world at their fingertips. However, the same scale of opportunity greets those using the information to support their illicit agendas. True, there is a direct correlation between the data access level and the exploitation curve.
Many security experts have captured this obliviousness to changing threats in a single term, “the Mobile Threat Defence paradox”. This theory is further enhanced by the fact that mobile-based attacks are generally subtle and relatively undetectable. Therefore, many individuals tend to disregard their existence. To some degree, this is understandable. If an intrusion cannot be seen, and there is seemingly no direct consequence, how would anyone know there is an issue in the first place? This has created a false sense of security and undermines efforts to warn society of pressing risks.
Indeed, evidence suggests that the requirement for intelligent, mobile security defence systems is more urgent now than ever. According to the latest reporting figures, Common Vulnerabilities and Exposures (CVEs) are on a significant upward trend. At the heart of this new wave of threats is the bourgeoning agility and adaptivity of attackers. Therefore, in response, protective mechanisms must be equally fluid and able to handle a substantial change and ambiguity. The days of one-dimensional attacks, which single-purpose defence systems can address, are long gone.
Now, an appropriate Mobile Threat Defence programme is the only way to meet this rapidly-evolving issue head-on.
Ensuring that your applications remain safe
As the risk intensifies, many businesses enlist the help of mobile security operators. This reduces the likelihood of successful attacks and provides reassurance to colleagues and clients. A key player in this space is Zimperium, a platform dedicated to the real-time protection of BYO and corporate devices. Essentially, they support businesses to trade with peace of mind, distancing themselves from fear of an impending, de-stabilising attack.
A central part of Zimperium’s philosophy is acknowledging and addressing the evolving nature of workplace environments. The coronavirus pandemic served to change the way that employees execute their roles fundamentally. Indeed, a work-from-home bias is now a permanent fixture in the operations of most commercial enterprises. Therefore, as colleagues distance themselves from the secure networks of an office bubble, they’ve become more reliant than ever on their own and corporate-sponsored mobile devices to negotiate work tasks.
However, this presents various risks to the employee, employer, and potentially the client or customer. True, at some stage, a worker will likely require access to secure company information via their personal, handheld device. For this to work, the individual must be set up with the correct permissions to reach the right information without increasing the risk of external infiltration. For example, applications such as the Microsoft Office suite need to be used remotely by workers in their respective domestic environments. Access to which must be controlled, efficient, and not susceptible to an outside breach.
This is where Zimperium’s impressive zero-trust framework enters the fray. Simply put, Zimperium uses this architecture to put the stakeholder in control of their authentication procedure. This enables businesses to have a robust and interconnected network that promotes security across BYO and corporate devices.
Companies should not wait until their data has been compromised before integrating a fit-for-purpose Mobile Threat Defence system. In recent times, high-profile lawyers, journalists, politicians (including state heads), and business tycoons have suffered at the hands of hackers. Last year alone, Apple released seventeen patches to remedy new mass device attacks. If these actors succumb to the continually evolving threat of intrusion, so can anyone.
What are the common areas that hackers target to gain data visibility?
Within the mobile security realm, four main pathways can potentially be exploited for forcibly accessing sensitive data.
One of these is the device itself. Built-in operating systems, profiles and configuration settings can be used as vehicles to gain entry beyond security defences. Applications can be manipulated to leach data from devices in real-time. Although most apps are vetted by their respective gatekeepers, with Google Play and Apple imposing checks to protect the user, some platforms can escape their advances.
Phishing is an exponentially growing threat in this space. Smaller mobile screens make it far more challenging to spot suspicious URLs and page links. This method offers hackers an efficient intrusion strategy, with a simple click potentially facilitating a major, unwanted sharing of information. Finally, the hijacking of public networks can be used as an under-hand tactic to monitor online visits and interaction behaviours.
Synthetic networks, purely controlled by those with unsavoury motives, are re-positioned as mainstream Wi-Fi access points. This means that whilst innocently picking up a morning coffee, device owners can accidentally tap into a rogue network instead of an internet stream sponsored by the outlet they’re visiting.
Zimperium has recently published its comprehensive mobile threat report, which delivers a colossal market risk analysis. Using the statistical evidence presented in probes such as these, businesses can isolate areas of their operation most susceptible to breaches. This way, they can use supporting mobile threat defence systems, such as Zimperium’s Z9 engine, to address security concerns.
Ultimately, this enables organisations to protect their data assets while promoting colleague accessibility and system functionality. The result? Companies have the freedom to optimise profitability, without an over-bearing security system stunting opportunities for commercial growth.
The Mobile Device Management myth
One of the key drivers behind misplaced trust in a mobile’s innate capability to defend itself is the presence of Mobile Device Management systems. Indeed, many corporate and BYO device holders assume that a handset integrated MDM profile is kitted out with a pre-existent security defence mechanism. This simply is not the case. Mobile Device Management set-ups must be flanked with a suitable MTD programme to successfully track threats and take appropriate corrective action.
An MDM system may facilitate the uploading of anti-virus software onto a given device. However, these tools are reactionary and only armed to deal with ‘known’ threats that have already surfaced previously. As operating systems will deploy patches in response to historical breaches of security parameters, the role of anti-virus spyware becomes obsolete in the mobile world.
Conversely, MTD platforms, such as those delivered by Zimperium, can detect ‘behavioural anomalies’ This means that so-called ‘zero day’ attacks can be proactively batted away. Indeed, such is the nature of current threats; devices exclusively fitted with anti-virus and signature-based solutions are no longer suitable for use.
How do Zimperium Mobile Threat Defence systems function?
Unlike many other MTD providers, Zimperium’s risk-detection model is integrated into the device. There is no application that re-directs captured information into a cloud-based server before performing risk analysis and sending resolution instructions back to the device to take action. The Z9 engine deals with the issue on-device, in real-time, and therefore blocks the re-distribution of personal data.
Two significant drawbacks exist in systems that use external clouds to identify and process risks. Firstly, and perhaps most poignantly, if a device has been thoroughly compromised, then an application will be unable to send evidence of breaches to a cloud.
Furthermore, this generates concerns about protecting personal information, particularly in the case of BYO devices. This problem is accentuated on the continent, where tighter controls around the movement of personal data have been implemented. Even in the UK, recent GDPR legislation has curtailed the extent to which sensitive, personal details can be transported.
Zimperium’s MTD programme also works collaboratively with software-based conditions of use. For example, it complements the actions of Microsoft security systems in ensuring that devices are compliant with company policies and procedures. Moreover, the Z9 engine provides reassurance to employers and employees, as it’s mobilised to interact with business data and materials solely. Indeed, personal information, web activity, or financial details are never targeted by Zimperium’s system.
However, perhaps the most impressive element of Zimperium’s suite of services is its ability to present complete, analytical transparency. A stat-packed dashboard allows clients to endlessly probe into the origin of threats, the nature of attacks, and what action was taken to eliminate risks.
Through this platform, companies can push out their conditional access policies and customise warning messages of impending threats to users. Additionally, they can create a fully-immersive risk management strategy, by integrating other hazard-control systems, such as Microsoft Defender, into one security console.
The importance of being relevant
The diversity of risk in modern communication environments has mushroomed emphatically in recent years. Not only is the number of hacking attempts eclipsing any level seen previously, but the scale and intelligibility of attacks are also increasing. Furthermore, criminals and illicit actors are now more regularly focused on breaching the user rather than the device’s integrity.
It’s essential to protect every component of a mobile device appropriately. Whether an operating system, application, or network, bad actors will invariably expose channels to gain unauthorised access to sensitive data.
Businesses must be equipped to deal with evolving threats in the technology sector. Even the simple reality that a mobile screen is much more condensed than a traditional desktop display is a new dynamic that deserves respect and attention.
Companies must also acknowledge that the over-arching risk narrative has materially changed. No longer can signature-based, one-dimensional anti-virus systems address the evolving nature of contemporary risks. Clearly, patches now offer this first line of defence anyway. However, more importantly, Mobile Threat Defence programmes can now quell threats before they fully take shape. Therefore, attacks can be curtailed at the source.
In an environment where external accessibility to networks and software such as Microsoft Office has increased significantly, companies need to embrace effective MTD systems that do not restrict the fluidity and efficiency of their business model.
An enterprise’s approach to compliance can no longer be measured by a ‘tick-box’ exercise, which assesses independent, single-functioning security controls. Now, defence systems must stand up to threats which are fluid, adaptable, ambiguous, and capable of instant attack.
Fortunately, Mobile Threat Defence programmes can help mitigate these types of risks, enabling both BYO and corporate devices to safely and securely access Microsoft Office (and other) applications. Contact Mobliciti if you’d like to find out more.