As 2018 gets into full gear, it’s important to take a look at what mobile security threats IT managers will be dealing with this year, and to reevaluate how best to handle them.
5. The Classics. Phishing, spyware, malware, device loss and theft: IT managers will have the same problems in 2018 that they had in 2017 and 2016. Hackers continue to use the same techniques because they work. Tweak an application a little, adjust a phishing email and you keep getting results. Admins should already have tools in place to help with these attacks, such as endpoint security suites for mobile devices, user education programs and policies to minimize the damage when a device is lost or stolen.
Just because it’s the same type of threats, though, doesn’t mean that adjustments shouldn’t be made. The new year is a good time to look at what attacks have been successful, why they got through and what lessons can be learned. Now could be the time to change out an ineffective endpoint security suite, or build stricter policies in mobile device management tools.
4. Cryptocurrencies and Financial Data. Cryptocurrencies are not, in and of themselves, a security threat. And your end users may not be participating in the cryptocurrency speculation boom. But threat actors don’t know that, and a broad spectrum attack on financial — Bitcoin or otherwise — is going to increase in 2018. As the hype around Bitcoin and other cryptocurrencies reaches fever pitch, we’re going to see more and more thieves going after Bitcoin wallets and Bitcoin exchanges, in addition to any other financial data they find. Wallets are often stored on mobile devices — and as these wallets skyrocket in value, thieves are looking for any way to grab them, which means new types of spyware and malware, and new opportunities for data leakage.
Reassessing Your Mobile Security?
White Paper
Download this guide to conducting a mobile security assessment for your enterprise. Download Now
While crypto-theft is often similar when it comes to banking malware, this is a category that IT managers should keep on their radar in 2018. Mobile device management tools can help identify users who have cryptocurrency applications, who might need either some training in proper security or a reminder of guidelines that prohibit such risky behavior on corporate devices.
3. Preparing for the Unexpected. With mobile security threats evolving on a daily basis, it can be difficult to exactly pinpoint what the next major threat will be. IT managers should be zooming out and trying to identify the places where their own defenses are weak. Some companies have the attitude that they’re not a target: too small, or too unimportant or not enough secrets. This isn’t true. Everyone is a target, and IT managers have to behave and plan with this in mind.
Mobile security features such as biometric authentication, disk encryption and partitioning that didn’t exist a few years ago should be incorporated into everyday processes, even if there is no clear threat model to worry about.
In mobility, planning for the unknown threat means trying to improve defenses, and at the same time increase detection capabilities. Improving defenses starts with looking at security policy and mobile devices and making sure that what you’re doing today makes as much sense as when the policy was written.
2. Wireless Networks. The risks of wireless networks — both Wi-Fi and carrier — continue to grow, and there’s no end in sight. In 2017, there were serious vulnerabilities in encrypted Wi-Fi that experts had previously said were “defense grade” security. Carrier attacks have been better hidden, but as the costs of tools such as software-defined radios come down, admins can expect more threats here as well. Knowing what the problem will be is impossible, but it’s a near certainty that there will be some major wireless security problem — or a long series of smaller ones. Or both.
Spoofed networks, monitored networks, broken encryption: what’s an IT manager to do? Any assumptions in existing policy that a network is “secure” should be questioned and revisited. That includes carrier networks and corporate Wi-Fi, two places where many IT managers have taken a lax approach to securing traffic.
1. Pre-infected Devices. By now, getting malware on a device is nothing new. But with the broadening of the Android manufacturer base, a shortage of security talent and tightening release timelines everywhere, we can expect more malware in factory-fresh devices.
Organizations that are committed to mobile computing should be carefully balancing the pros and cons of a BYOD strategy. Many IT managers have embraced BYOD to reduce acquisition and support costs, but they’re also taking on significant risk that will keep increasing this year.
Switching to a small set of trusted manufacturers who can deliver unlocked and un-bloated mobile devices may seem like going against the tide, but it does reduce risk. This is a discussion that every IT manager should have every few years, informed by the track record of their existing program and the changing risk environment around them.
Are unpatched security vulnerabilities worth the risk? A recent report shows just how much known vulnerabilities can cost your business.
