Enterprises continue to fall short when it comes to protecting corporate data on mobile apps and devices, according to the Mobile Security and Risk Review, by MobileIron at the 2016 U.S. Black Hat conference in Las Vegas. Mobile threats are on the rise but only 8 percent of companies are enforcing OS updates and less than 5 percent are using App Reputation or Mobile Threat Detection software.
The second edition of the Mobile Security and Risk Review updates Q4 2015 data and discusses an emerging set of threats and risks, including enterprise compliance failures, compromised devices, and data loss risks. For the first time, the review also identifies enterprise security trends on a geographic regional basis and for the government vertical.
Mobile attacks on the rise
The report outlines several new mobile attacks which have emerged that threaten enterprises. Most are simply re-using old tactics against mobile-specific services, such as SideStepper's use of Man-In-the-Middle (MITM) against MDM, rather than employing new techniques or exploiting new vulnerabilities. However, when attacks against users are successful, they can result in the loss of both personal and business data.
The following mobile attacks either emerged or worsened in the last six months:
• Android GMBot: This spyware remotely controls infected devices in order to trick victims into providing their bank credentials.
• AceDeceiver iOS malware: This malware is designed to steal a person's Apple ID.
• SideStepper iOS "vulnerability": This technique was discovered to intercept and manipulate traffic between an MDM server and a managed device.
• High-severity OpenSSL issues: These vulnerabilities can potentially impact large numbers of applications and services, which could ultimately jeopardize enterprise data-in-motion.
• Marcher Android malware: This malware has evolved to mimic bank web pages that trick users into entering their login information through e-commerce web sites.
Mobile security practices largely unchanged in the face of new threats
Security incidents are often the precursor to a breach because they leave a device or app vulnerable and that can put enterprise data at risk. This quarter saw a number of trends in employee compliance incidents and enterprise security practices, including:
• Missing devices: 40 percent of companies had missing devices, up from 33 percent in Q4 2015.
• Out-of-date policies: 27 percent of companies had out-of-date policies, up from 20 percent in Q4 2015.
• Enforcing OS updates: 8 percent of companies were enforcing OS updates, which was comparable to Q4 2015.
• App reputation software: Less than 5 percent of companies deployed app reputation software, which was comparable to Q4 2015.
• Evernote and Line among most blacklisted consumer apps
The top 10 consumer unmanaged apps most often blacklisted by enterprises changed from Q4 2015 to Q2 2016. New entrants to the top 10 list include Line and Evernote. The top 10 consumer unmanaged apps most often blacklisted in Q2 2016 include:
3) Angry Birds
8) Google Drive
Government organizations struggle to keep pace
Government organizations are known for having some of the most stringent security requirements. Paradoxically, extensive approval processes make it difficult for these organizations to keep pace with change, which can make them more vulnerable.
Globally, government organizations are less prepared to deal with security incidents than the global average.
• 61 percent of government organizations have at least one noncompliant device, compared with the global average of 53 percent.
• 48 percent of government organizations have missing devices, compared to the global average of 40 percent.
• 34 percent of government organizations had devices operating under outdated policies, compared to the global average of 27 percent.
• iOS remains dominant in the enterprise
The share of iOS devices grew from 78 percent in Q4 2015 to 81 percent in Q2 2016. The share of Android devices remained flat at 18 percent during this timeframe.