Mobile security strategy must go beyond malware monitoringDate: Apr 01, 2014
In this video presentation, Andrew Hoog, CEO and co-founder of viaForensics, looks at the threats to mobile devices and what can be done to battle them effectively.
The first step is not to get stuck fighting the last war. The threat of malware is well known now, but it’s far from the only threat to personal devices carrying sensitive data.
The number and lethality of attacks on mobile devices are increasing for a variety of reasons. First, they’ve simply become ubiquitous, with most enterprise employees using personal devices as work tools. In addition, smartphone and tablet owners, because they are working on the go, traverse many networks in the course of a day. If any of these networks lack good encryption, your data is at risk.
Increasingly, too, people are storing more sensitive data on those devices, even though most have limited security control. IT pros in the enterprise have difficulty monitoring every employee’s network activity, especially since there are few enterprise-ready mobile security tools available. A mobile device is, in short, a rich target for hackers and other thieves.
Mobile device security is everyone’s job, Hoog argues: From the manufacturers, who must try harder to make their products less vulnerable, to app and OS developers, wireless carriers, enterprise executives and their employees.
What can a security pro do? Mobile presents a new paradigm. Whereas the desktop computer was fortified against the threats thanks to host-based sensors, border gateway filtering, full-disk encryption, multifactor authentication, and complex password schemes, mobile devices simply aren’t equipped with anything approach this level of defense.
Mobile devices are not just smaller versions of a PC. The same defense strategy just doesn’t work on a handheld device. Instead, Hoog argues, you need take a proactive, mobile-oriented defense that goes beyond focusing on mobile malware protection. Assume a proactive, defensive posture; treat a mobile device as an attack platform. (For instance, if an employee travels abroad, make sure there’s no sensitive company data riding onboard.) Increase visibility and proactive monitoring by enterprise IT pros. Mobile devices and apps must be monitored. IT must know what employees are doing on their phones, where is their data being sent, is it being encrypted. Monitor and analyze behavior too: Does a particular employee for instance send a large file to Dropbox just after the quarterly financial report internally posted?
Enterprises have no choice but to adapt to new security requirements, or risk data breaches and violations of compliance and regulatory statutes, not to mention a loss of customer trust and revenue. Move beyond just monitoring for malware. Hostile actors will continue to evolve their strategies; you must evolve too, and avoid fighting the last war.
Andrew Hoog is CEO and co-founder of viaForensics. As a mobile security researcher and computer scientist, he has spoken at major banking, security and forensic conferences and regularly provides briefings for senior government officials. He is the author of two books on security, iPhone and iOS Forensics and Android Forensics, and has two patents pending in the areas of forensics and data recovery. Mr. Hoog holds a Bachelor of Arts degree in computer science from Saint Louis University and is completing a Master of Business Administration degree from University of Chicago’s Booth School of Business.