Enterprises too complacent in the face of rising mobile threats

Enterprises continue to fall short when it comes to protecting corporate data on mobile apps and devices, according to the Mobile Security and Risk Review released by MobileIron at Black Hat USA 2016. Mobile threats are on the rise but only 8% of companies are enforcing OS updates and less than 5% are using App Reputation or Mobile Threat Detection software.

“The velocity of mobile attacks is increasing but the latest data shows that enterprises are still not doing the things they could be to protect themselves,” said James Plouffe, Lead Architect, MobileIron. “This lack of security hygiene demonstrates that enterprises are alarmingly complacent, even when many solutions are readily available.”

Mobile threats and attacks on the rise

The report outlines several new mobile attacks which have emerged that threaten enterprises. Most are simply re-using old tactics against mobile-specific services, such as SideStepper’s use of Man-In-the-Middle (MITM) against MDM, rather than employing new techniques or exploiting new vulnerabilities. However, when attacks against users are successful, they can result in the loss of both personal and business data.

The following mobile threats either emerged or worsened in the last six months:s

• Android GMBot: This spyware remotely controls infected devices in order to trick victims into providing their bank credentials.
• AceDeceiver iOS malware: This malware is designed to steal a person’s Apple ID.
• SideStepper iOS “vulnerability”: This technique was discovered to intercept and manipulate traffic between an MDM server and a managed device.
• High-severity OpenSSL issues: These vulnerabilities can potentially impact large numbers of applications and services, which could ultimately jeopardize enterprise data-in-motion.
• Marcher Android malware: This malware has evolved to mimic bank web pages that trick users into entering their login information through e-commerce web sites.

Mobile security practices largely unchanged

Security incidents are often the precursor to a breach because they leave a device or app vulnerable and that can put enterprise data at risk. This quarter saw a number of trends in employee compliance incidents and enterprise security practices, including:

• Missing devices: 40% of companies had missing devices, up from 33% in Q4 2015.
• Out-of-date policies: 27% of companies had out-of-date policies, up from 20% in Q4 2015.
• Enforcing OS updates: 8% of companies were enforcing OS updates, which was comparable to Q4 2015.
• App reputation software: Less than 5% of companies deployed app reputation software, which was comparable to Q4 2015.

iOS devices are still dominant in the enterprise (81%), and Dropbox, Facebook, and Angry Birds top the list of unmanaged consumer apps most often blacklisted by companies. They are followed by Skype, Line, Box, OneDrive, Google Drive, Twitter, and Evernote.

Government organizations struggle to keep pace

Government organizations are known for having some of the most stringent security requirements. Paradoxically, extensive approval processes make it difficult for these organizations to keep pace with change, which can make them more vulnerable.

Globally, Government organizations are less prepared to deal with security incidents than the global average.

• 61% of Government organizations have at least one non-compliant device, compared with the global average of 53%.
• 48% of Government organizations have missing devices, compared to the global average of 40%.
• 34% of Government organizations had devices operating under outdated policies, compared to the global average of 27%.