Zero Trust: Now A Critical Foundation For Securing Mobile

Consumers and organizations are beginning to realize that they cannot trust the operating systems of mobile devices to provide security. As mobile OS vulnerabilities and supply chain problems mount, breaches of both consumer and enterprise data are on the rise—through the OS, by direct attacks on applications and over the network.

This issue has the attention of the security world as IT and security professionals come to understand that we’re living in a “zero-trust” ecosystem when it comes to mobile devices and applications. Even up-to-date mobile operating systems don’t provide the security features that developers need.

And most devices aren’t up to date. With an 82.8% market share, according to IDC, Android dominates the mobile device market throughout the world. Data provided to Android developers in December 2015 showed that fewer than 1 percent of Android devices are using version 6.0, released two months earlier, and a full 70% were still using versions 4.4 and below. These numbers mean that most Android users don’t have access to security patches and anti-exploit features that have existed for more than a year. And because handset manufacturers (not Google) control distribution of Android updates, some devices may never be updated.

Find out more about mobile security at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

“You have to assume that your operating environment is one where a significant number of your users are on platforms that can’t be patched,” Facebook CSO Alex Stamos told CIO Journal, noting that Facebook is working hard on building security directly into its own apps. Consequently, because developers cannot inherently trust what they start with—the mobile OS—applications must become capable of safeguarding the assets they contain: the identity of the user, consumer data, enterprise data, and whatever else is of value or precious within the app.

The Zero-Trust Model
For the first time in the mobile world I’m seeing individual developers and organizations that develop mobile apps adopting a zero-trust model for development. No longer willing to rely on an OS that doesn’t provide the security features they need, developers are taking steps to secure apps, defend data, and protect users.

Developers are researching the nature of the threats: how are apps are being attacked? How are paywalls being bypassed? How are services being appropriated and used for free by attackers? How is consumer data being stolen and resold? The answers are complicated, especially in highly distributed mobile environments where organizations lack control of their endpoints—environments radically different from those of the not-so-distant past when IT professionals could concentrate on the security of servers, desktops, and employee laptops.

The task for today’s developers is to build multiple layers of functionality, both to defend against immediate threats and to protect the distributed mobile ecosystem for the long term, wherever and however its endpoints are dispersed.

The Pillars of Protection
To implement a zero-trust model of app development, companies must start with three pillars of protection:

Security. The first pillar is security, which includes features such as encryption and obfuscation. The goal of this pillar is to build a vault around assets that need to be protected and to ship the vault with the app, no matter where the app goes and no matter what kind of device it’s on. Mobile application security features are designed to protect apps that may run on insecure and high-risk devices, whether they’re gray market, counterfeit, jailbroken—or just out of date.

Self-defense. After a vault is built around an application’s data, the app needs to be able to protect itself. Apps need to be able to make real-time decisions on devices without input from any other components, to protect themselves even when offline, and to guard against malware attacks and reverse engineering. An app designed to be self-defending notices when an abnormal event occurs and can actively shut itself down, send alerts, and take other actions as needed to ensure that an organization knows that a risk has been detected and assets have been protected.

Visibility. The third pillar of protection is visibility (also called “eventing”). Eventing mechanisms produce notifications each time services are called, helping organizations see their risks in mobile and make better decisions about how strong their vaults need to be, what sort of defense capabilities are required, and how many security guards they should deploy. Visibility into the nature and scale of fraud, and the capability to perform forensics if the system is comprised, helps organizations adapt their enterprise mobile security policies.

Organizations that are keeping zero trust in mind throughout the app development life cycle are making themselves much more effective at combating mobile malware, external account compromises, and internal data theft. As they come to understand that their apps exist in a zero-trust ecosystem, they are beginning to mature their processes and evolve security responses to meet the demands of an evolving threat landscape.

More on this topic: