Increasingly businesses are relying on mobile devices to get work done. The benefits are undeniable but mobile presents a major risk to corporate IT security. Mobile attacks are growing exponentially and the threat landscape changes on a daily basis. What then are the top threats that businesses should be aware of?

Vulnerable legitimate apps

Legitimate apps that are downloaded from official app stores pose significant threats. Over 75% of the top iOS and Android apps have permissions to access user data. Poor programming often results in apps inadvertently leaking sensitive user information. A version of the Starbucks iOS app for example was found to transmit user data including customers’ usernames, e-mail addresses, passwords and location data.

Jailbreaking

Jailbreaking removes security limitations and is never safe for devices on a corporate network. It permits root access to the operating system file allowing downloads of applications not permitted through official app stores. Jailbreaking provides all apps, including malicious ones, with access to data owned by other applications.

Outdated Operating Systems

There are more than 11,000 different combinations of Android devices and Android Operating Systems. This fragmentation across both Android and iOS creates a security issue. There’s an ongoing race between vendor patching of known vulnerabilities and hackers trying to exploit them. A device running an outdated Operating System is by definition vulnerable and presents a significant risk of being compromised.

Malware and malicious apps

Mobile malware is malicious software designed to steal personal information or gain control over the device. Most mobile malware spreads via malicious apps that exist on the device and gains extensive permissions. Google’s Android platform is most vulnerable to malware however the iOS platform is not completely safe either.

Compromised mobile hotspots

With over 5.8 million hotspots expected by the end of 2015, free Wi-Fi has become ubiquitous, but also a prime target for exploitation. Attackers may create a spoof Wi-Fi network or simply connect to the same legitimate Wi-Fi that the victim is using. All communications end up passing through the attacker-controlled network device, meaning they can intercept passwords, credit card details and other sensitive information.

Phishing

Phishing is one of the oldest means of internet attack. Authentic-looking emails or websites are presented, and vulnerable users are deceived into volunteering sensitive information such as their as username, password and credit card number to the hackers. Smartphone users are three times more likely to share their account login and password credentials on malicious phishing sites. This is because users are constantly checking email accounts on their mobile device and are often multi-tasking. The small screens of mobile devices also make it difficult for users to accurately determine the legitimacy of URLs.

What businesses can do to protect themselves, their staff and their corporate data?

There are several security solutions to address different mobile threats that enterprises face today. App reputation lists for example provide information on the risks associated with apps. However, the constantly changing mobile threat landscape means a list based approach has limitations. Similarly, anti-virus solutions and malware scanners are reactive to the latest attacks but cannot adapt to the changing and interconnected threat landscape.

App wrappers and enterprise app stores adopt a whitelist approach allowing employees to only download pre-approved apps. These solutions can lead to a negative experience – they are typically not feasible for BYOD devices and employees also expect more control over corporate-owned devices. Secure containers can be effective in protecting some corporate data, but do not provide any protection outside of the container and typically also result in a negative user experience.

Utilising algorithms to detect patterns that signal malicious or risky behaviour is proving to be an effective solution. Predictive solutions like Wandera Secure offer a multi-level approach to mobile security, scanning all data on both the device and in the cloud in real time. This technology can correlate data processed from these multiple sources to determine severity and deliver a recommended remediation plan for each identified threat.

This article has been contributed by Eldar Tuvey, CEO of Wandera, the Mobile Data Gateway.