10 Mobile Security Threats Leaving a Hole in Your Network

Mobile devices have completely changed our daily lives, both workday and personal time. The average person spends at least four hours on their mobile phones or tablets daily, with just over 54% of all global website traffic traversing over mobile devices (source). 

Becoming increasingly powerful, mobile devices are supplementing and sometimes replacing desktops or laptops. Mobile security threats pose a unique security challenge for businesses, especially as employees can often use their personal devices for work tasks.

Inadequate security policies are introducing hundreds to thousands of poorly protected and monitored devices onto the corporate WiFi. Cybercriminals have zeroed in on this weak security point and are deploying targeted malware attacks to take advantage of it.

10 Key Mobile Security Threats To Businesses

This article covers ten mobile security threats that every business owner and security administrator should consider.

1. Out-of-Date OS and Security Patches

Although mobile phone Operating System (OS) updates are intended to improve user experience, this often goes beyond performance and can involve security too. 

Updates happen frequently, and users sometimes click through the reminders and put off the install. That is a mistake because it’s essential to stay up to date with the latest OS version. Such updates often include critical security patches.

These updates protect both iOS and Android devices from the most current threats. Ignoring updates means you are leaving your mobile device vulnerable to malware attacks. 

All staff need to be trained to check that their phone’s OS is up to date by navigating to general settings and selecting “system updates” or “software update.” If there is one available, don’t ignore or postpone it. 

2. Unsecured Third-Party Apps

A third-party mobile app from a respected supplier can be secure and support business operations like emails, calendars, text-to-speech, payment processing, and more.

However, employees using inadequate or suspicious third-party apps in the workplace pose a significant security risk. This personal use risks the enterprise because those apps do not fall under the enterprise security framework. These apps aren’t properly vetted by the IT department and are often installed without their knowledge. 

In addition, employees often install them on their personal mobile devices and use them to access company networks via Bring Your Own Device (BYOD). Thus, supporting third-party apps is a growing security challenge for IT departments. Even worse, if the corporate security policy allows, these third-party apps may end up being installed on corporate mobile devices.

3. Malicious Apps

Mobile malware is rising, along with malware-related attacks such as ransomware. As employees search for and install apps to the mobile devices they use for work, they are opening themselves and their employer to possible risk.

While Android OS is more vulnerable to malware attacks, Apple iOS can also be impacted, even with its ‘closed’ Appstore. Two dangerous types of malware, XcodeGhost and YiSpecter, have been identified in apps available through the iTunes App Store.

This can mean personal email and financial accounts are compromised for the individual user. An organisation is also at risk if the employee uses the infected mobile device to access enterprise networks. 

4. Lack of Antivirus Protection

Most individuals have antivirus programs on personal laptops or desktop computers, and most businesses ensure their user devices are fortified with such protection. 

However, handheld mobile devices benefit from antivirus protection as well. These apps protect against viruses and attempted hacking. Some software, such as Panda’s free antivirus software, for example, has VPN features for additional protection. Microsoft Defender is also a worthy option.

Remember that smartphones and tablets are pocket-sized computers that can store as much personal and business data as a desktop workstation or laptop. Therefore, mobile devices should be protected by the most up-to-date antivirus software.

5. Poor Spyware, Malware, and Ransomware Protection

One of the most significant failures in IT security is the lack of proper spyware, malware, and ransomware protection on mobile devices. Whether legitimate or illicit, spyware surveys activities that leave technology users open to data breaches and misuse of their private data.

Malicious spyware can infect an entire network. Spyware enters your computer or mobile device, gathers personal data, and forwards it to a third party without your knowledge. It remains hidden as it records information and tracks your activities. Some types of spyware can also activate the camera and microphone in your phone.

Ransomware compromises a user’s device via malware from a downloaded app, link, or email. The attack encrypts user data so they can no longer access it. Such ransomware typically spreads to other computers if the device is already connected to a corporate network, replicating the damage on each device, server, and data backup storage system. 

At some point, a ransom demand is made in return for unencrypting the data. You may decide to pay the ransom, though you may not recover your files.

Your company’s IT security team should have protocols in place to guard against these types of attacks. Explain to staff that if they are using personal mobile devices to access enterprise networks, they are inadvertently putting the company’s data at risk. 

Staff should also be aware that they can contact their IT department to understand how to better protect their mobile devices against spyware, ransomware, and other types of malware. 

6. Jailbroken Phones

‘Jailbreaking’, sometimes called ‘rooting’ your phone, is when you unlock your phone, removing the safeguards the manufacturers put in place. People do this so they can access the mobile carrier of their choice along with applications sold on app stores other than the manufacturers. While it’s tempting to jailbreak your phone to access other app stores, doing so introduces unnecessary mobile security threats.

Unofficial app stores are not vetted, and many apps sold on that platform are likely malicious. Downloading one of them may lead to one of the malware attacks mentioned earlier. For these reasons, you should never root your phone or purchase one already jailbroken.

7. Not Using the Screen Lock Feature

One of the simplest ways to protect the data on your mobile device is to set your lock screen. It may be convenient to deactivate this setting; however, it is the first line of defence in keeping strangers from accessing your phone. 

Most phone apps keep you logged in, so all a stranger needs to do is open the app for full access to your accounts, including your calendar, email, e-commerce, and banking accounts. Setting your lock screen to kick in after a minute of idle time prevents that from happening. 

8. Unsecured WiFi & The Evil Twin

The convenience of mobile devices is that we can access the internet from just about anywhere. Most businesses offer free WiFi as a courtesy, which is certainly welcome for those who need to conserve their cellular data. While these open WiFi networks are convenient and efficient, you must remember that they are not secure.

Cybercriminals may have set up a phoney WiFi network to intercept your data using the Evil Twin technique. This method creates a similar WiFi network that looks like the official WiFi of the store or coffee shop, but with the name spelt slightly differently. 

Once you are connected, the hacker can use a man-in-the-middle technique to access your data while connected to the WiFi. Always ask the store staff for the exact wireless network name.

When you use any public WiFi, it is recommended that you connect via a Virtual Private Network (VPN) to secure your data. Your employer likely has one available that you should use anytime you use your mobile device for work. If your device is for personal use, you should use a private VPN because it provides a private connection, even on a public network.

9. Insecure Bring Your Own Device (BYOD)

BYOD seems like a good idea at first glance, saving the company the cost of purchasing mobile and other devices. The problem, however, is the security challenge that BYOD presents. With phishing and malware attacks on the rise, managing devices with different operating systems and versions is adding fuel to the fire.

Security for BYODs is problematic because it requires keeping up with troubleshooting, security patches, and other software updates on multiple devices. The company’s IT department doesn’t monitor personal devices closely, and those devices are not always part of the corporate network. This is where personal devices become a liability because they risk network security.

10. Lack Of End Point Protection (EPP)

Endpoint devices like laptops, desktops, and mobile devices are becoming prime targets for malware and ransomware attacks. Preventing these entry-point devices from being compromised by a malicious cybercriminal attack is paramount for overall network security.

End Point Protection (EPP) is a complementing suite of security services designed to support end-user endpoint devices, especially mobile devices. EPP uses a combination of advanced security measures like antivirus, anti-ransomware, phishing detection, and end-to-end encryption to ensure the security of your endpoint estate. 

Some additional EPP features include the following:

• Malware protection
• Web filtering
• Zero Trust Agent (ZTNA) with Multi-Factor Authentication (MFA) 
• Centralised management
• Centralised logging and reporting
• Dynamic security fabric connector
• Vulnerability agent and remediation
• SSL and IPsec VPNs with MFA

Endpoint Detection Response (EDR) is an extension of EPP that integrates continuous real-time monitoring with the endpoint data collection and rules-based automated response and analysis. EDR detects and investigates suspicious activities. It utilises automation to help cybersecurity teams to respond to threats.

An EDR security solution’s main tasks are collecting and monitoring activity data from endpoints. It analyses this data to identify threat patterns. Once it identifies a potential threat, it responds automatically to remove or otherwise contain those threats while also notifying security personnel.

Conclusion

As the remote work culture continues to flourish, IT security teams worldwide continue to combat the associated security challenges mobile devices impose upon enterprise networks in the form of mobile security threats.

Mobile devices provide a convenient and efficient way of working for remote and in-office employees. However, organisations must remain vigilant in securing these devices, including BYOD phones and tablets.

From anti-malware, anti-phishing, SEO poisoning, and 2FA to SASE and cloud-based air-gap immutable backup storage, Securus has a security solution to suit your requirement and budget. 

If you would like to discuss your network security requirements in more detail with one of our cyber security professionals, please don’t hesitate to get in touch.

Further Technology Articles