Mobile security is no longer an option – it’s a necessity. The last decade has seen an explosion in the number of people adopting the Bring Your Own Device (BYOD) approach in which they use their personal devices for work.  And, with the current requirements for working from home, triggered by the global spread of the coronavirus, millions more have been forced to employ this measure for the foreseeable future.

But this rapid increase in mobile device usage, combined with their low security level, makes them one of the most common targets for cyber-criminals trying to break through the security of corporate data. According to our 2020 Cyber Security Report, nearly a third of organisations worldwide suffer from attacks directed at mobile devices, and 60% of IT security professionals doubt their companies would be able to avoid a mobile security breach. We can anticipate these figures would rise given the current climate.

Protecting mobile devices, then, must now be compulsory. So, what cyber-threats are we talking about? Here, we share the five leading threats that put the security of mobile devices at risk, with advice on how to optimize their protection.

  1. Malicious apps: Installing apps poses a multitude of security risks such as data leakage, among others. The use of these kinds of programs allow devices to be easily infected with mobile malware (one of the main types of cyber-threats seen in our 2020 Cyber Security Report) such as credential thieves, keyloggers and remote access trojans. Such threats offer cyber-criminals an easy and effective way of launching sophisticated and direct attacks which can propagate from mobile devices to networks. Similarly, other main dangers count on the fact that users tend to accept (without reading) terms and conditions that allow the app to have access to the information stored in devices.
  2. Vulnerabilities of the devices: As highlighted in our report, 27% of companies globally have fallen victim to cyber-attacks in which the security of a mobile device was compromised. Therefore, vulnerabilities in the various components, or the operating system itself (whether Android or iOS), pose a serious risk to data security. Also, besides security breaches, the “weak” security settings of these devices are also potential targets for cyber-criminals, since they give access to all the information stored – putting data security at great risk.
  3. Phishing: Phishing remains one of the threats with the highest success rate. In fact, according to a Verizon study, 90% of all cyber-attacks start with a phishing campaign. It’s therefore no surprise that cyber-criminals tend to exploit the many messaging applications available on mobile devices, in order to direct the user to a fake website. Generally, phishing is carried out through either private or corporate emails, SMS and messaging apps such as Slack, Facebook Messenger and WhatsApp. These allow cyber-criminals to access a vast amount of information, and sometimes gain economic benefits.
  4. Man-in-the-Middle (MitM) attacks: Mobile devices allow people to connect and communicate from anywhere in the world. Each day, millions of messages containing sensitive information are sent, and cyber-criminals take advantage of these with the use of MitM attacks, a method which allows them to intercept the data traffic between a device and a rogue Wi-Fi access point. For example, a cyber-attack of this kind on an online banking service would allow the attacker to easily modify the details of a bank transfer.
  5. Network based attacks: In order to avoid various attacks, it is fundamental to analyse communications that devices receive and send out. The reason is that most variants of mobile malware need to establish a connection with the device’s Command and Control server in order to successfully produce data leaks. Detecting these malicious communication channels therefore makes it possible to block communications, preventing multiple kinds of attacks.

Finally, it’s important for organisations to recognise that the management and protection of mobile devices are not synonymous. Some people wrongly believe that, depending on the operating system installed, the security of a mobile device can be better. While it’s true both Android and iOS provide their own tools to optimise security for the devices that use their software, no operating system is impenetrable on its own. Both are susceptible to suffer from security breaches. Therefore, mobile devices should be treated just like any other point of connection to the corporate network in terms of security, risk management and threat visibility.

So, in order to have the highest security standards, it is essential to comply with some policies such as device encryption and implement solutions such as remote data deletion. Some Mobile Threat Defense (MTD) solutions can also help organisations protect corporate devices from advanced mobile attacks. In addition, they are able to protect employee devices from infected applications, MitM attacks via Wi-Fi, operating system exploits, and malicious links in messaging apps. By taking a more proactive approach to mobile security, organisations are better prepared to prevent and avoid the most sophisticated of cyber-attacks.

Learn more about how Check Point can protect your workforce of mobile threats with our market-leading MTD solution SandBlast Mobile.

 

You may also like