MOBILE DEVICES are powerful, ubiquitous, continually connected to sensitive data, and poorly protected. Channel pros should think opportunity.
Mobile phone hacking is still at an early stage, according to Dionisio Zumerle, a senior director and analyst at Gartner, who notes that as recently as late March “an iOS zero-day exploit that can give full remote access to an iPhone is worth between $2 and $3 million dollars,” an indication of the rarity of such cybercrime. Still, that same month Google was caught with its Play Store screens down, when SimBad, a new strain of malicious adware, was found installed on more than 210 Android apps that were downloaded nearly 150 million times before it was removed.
Security vendors are also sounding alarms about mobile phishing attacks. These come at phones through links in texts, social media, or in URLs too small or shortened to visually raise suspicion. According to Verizon’s Mobile Security Index 2019, 42 percent of respondents who had experienced a mobile-related compromise said it involved phishing.
“Most attacks require at least some user interaction to install an app, accept a profile, or open a URL,” says Zumerle.
User education, then, should be part of a mobile protection plan, suggests Jim Krantz, president of KrantzSecure, a New York MSP with a strong security emphasis. Krantz offers third-party online security training for his professional services clients. “It’s monitored for completion so the CSO knows who’s gone through it,” he says. He also performs periodic phishing attacks to test employees and offers follow-up classes for those who fail.
Mobile users engage in risky behavior using Wi-Fi and sideloading (transferring files between a computer and a mobile device) as well. According to Verizon’s report, about 4 percent of devices encounter a hotspot known to be affected by man-in-the-middle attacks like SSL Strip every month. Sideloaded apps bypass Google’s or Apple’s vetting entirely, as they are installed directly via USB or wireless link.
Channel pros offering mobile security should ensure customers have updated devices, a complex passcode, and remote wipe capability, Zumerle says. He also recommends jailbreak/rooting detection and app sideloading inhibition. “Most of these things can be achieved via a unified endpoint management (UEM) tool,” he says. UEM vendors include AirWatch, Citrix, IBM, Microsoft, MobileIron, and Sophos.
While UEM enforces acceptable use policy, another category of tool, mobile threat defense, goes a step further: prevention, detection, and remediation of attacks. Vendors in this space include Check Point, Lookout, Symantec, Wandera, and Zimperium.
Don’t leave it to Google, Apple, or private app stores to keep your clients’ mobile devices out of harm’s way. Where there’s risk, there’s opportunity.