3 Mobile Security Problems That Most Security Teams Haven't Fixed Yet

Allowing malware to be a distraction, when the real threat is mobile phishing: When it comes to modern cybersecurity threats, the conversation has largely been dominated by malware. The deluge of headlines warning of increased attacks across industries with catastrophic consequences serve as a distraction when it comes to mobile security. Wandera's "Mobile Threat Landscape 2020" report found that just 13% of all organizations have experienced a malware incident on a mobile device, compared with the 57% of organizations that have experienced a mobile phishing incident.

And phishing threats continue to evolve, with 81% of attacks now taking place outside of email. Instead, attackers are targeting victims via messaging apps or social media, where they have a better chance of luring users into fake profiles, promotions, and notifications. These tactics make it easier for bad actors to extract personal data and account credentials discreetly, leaving the user oblivious to the breach. Don't be fooled by the constant malware headlines — organizations must remain vigilant when it comes to mobile phishing, as the threat posed by malware pales in comparison.

Misunderstanding application security: Even as the availability of apps for enterprises has increased, the emphasis on mobile app security has not kept pace. While mobile has the potential to make organizations more efficient, it presents a whole new set of challenges by expanding the footprint that IT needs to manage and secure, and the risks go far beyond simple malware.

Currently, there are three areas that mobile businesses are struggling to tackle. First, persistent data leaks, such as the ones British Airways experienced in 2019 due to unencrypted check-in links across mobile platforms. Second, policies that allow apps with excessive permissions, which often lead to users unknowingly expose personal data. As we've learned on numerous occasions with WhatsApp, what's secure today might be vulnerable tomorrow, and apps with excessive permissions require continuous monitoring. Finally, organizations need to set clear policies for governing and monitoring apps, specifically those that are used without direct approval from the IT department. For example, physicians who store sensitive patient data on personal tablets run the risk of exposing that information when they are introduced to untrusted software.

One solution to this issue would be for organizations to consider vetting applications over time, rather than just one initial screening process at the onset. Continuous vetting is a proven method to address all three challenges and ensure your organization stays ahead of vulnerabilities and avoids catastrophe.

Trusting your mobile operating systems: The past year has taught us that even the most current operating systems aren't necessarily the most secure. There is a common misconception that iPhones and Android devices are secure without requiring security software; and yet, both Apple and Google have demonstrated time and again that they are not immune to vulnerabilities. Earlier this year, Apple accidentally reopened a security flaw that introduced jailbreak risks, just weeks after discovering that hackers could remotely retrieve files from an iOS device by exploiting a vulnerability in iMessage.

Similarly, Android device manufacturers are no strangers to controversy, as researchers discover new Android vulnerabilities on a regular basis, even on brand-new devices. Both of these examples prove again that mobile operating systems simply aren't bulletproof. It's time for organizations to implement a layered system of defense in order to mitigate attacks, should they slip through a hole in that organization's mobile operating system of choice.