Apps, not malware, should be your biggest mobile concern
Connecting state and local government leaders
A two-pronged approach to mobile security focuses on enforcing security from the center while showing users the security risks at the endpoints of their mobile devices.
Network security would be relatively simple if it weren't for end users. But just when IT staff are feeling like they are getting network security somewhat under control, employees and bosses alike are demanding access from a dizzying array mobile devices running on a variety of operating systems.
NowSecure, until recently known as viaForensics, is taking an unusual two-pronged strategy to mobile security that focuses on enforcing security from the center while informing users about security risks at the end points of their mobile devices.
The key piece, though not the only piece, in NowSecure's strategy is NowSecure Mobile, a free application available for download by Android and iOS devices. Once installed, the application scans a phone's applications and displays an overall security score. What's more, the app lists the applications that are insecure and shows the countries and companies installed apps are sending data to.
"It's a real eye-opener for most users," said Andrew Hoog, CEO of NowSecure. "They end up seeing their data going to the United States, Ireland, China. People have no idea that our phones are citizens of the world and are sending data everywhere."
In fact, Hoog said, while malware seems to make all the news and is a real problem on computers, it is really insecure applications that are the biggest threat to mobile security.
"Key vulnerabilities come up on a fairly regular basis," noted Hoog. His team recently analyzed the most popular 100 apps for iOS and Android and found that 75 percent of the iOS apps and nearly 60 percent of Android apps had at least one high-risk security flaw. "That's a pretty staggering number," he said.
When people are alerted to vulnerabilities, Hoog said, most are eager to fix them. "We're turning end users into the front line of mobile security," he said.
Informing end users, however, is only one part of what NowSecure Mobile does. The application can also be configured to send reports to an organization's security staff. The security score for devices is then aggregated, giving managers a quick heads up on problems. "As they're looking out across all of their devices, they can spot an endpoint with a security problem, so they can get that fixed and minimize the risk," said Hoog.
The vulnerability data collected by NowSecure Mobile also gives Hoog's team a real-time feed of threats cropping up around the world, so they can develop response strategies.
NowSecure also offers software for enterprise clients to detect vulnerabilities in applications they are developing or considering adopting.
While partitioning and containerization of applications are frequently employed security strategies, Hoog argues that administrators shouldn't depend on those strategies alone.
"I do a corporate espionage demo where I show how to break into a person's phone over the network and compromise it to steal all the data," said Hoog. "One of the first things I do when I compromise the phone is I look to see whether that person is running a containerization strategy. If they are it's a beacon to me as the attacker that all the good stuff exists there."
Hoog said that one way to attack the container is to copy it to a server and attempt to brute force it. Alternatively, and even easier, is to simply wait for a user to log into the container. "The moment you authenticate the container – because you want to download an email or look up a contact – I immediately suck out all the data," he said. "Containers are fine, but in a fully targeted attack they really are not going to protect you."
And partitions aren't bulletproof either. Hoog's team worked on one such implementation for two weeks and came up with five successful ways to get around it.
In addition to app vulnerability detection, Hoog said the future of enterprise mobile security lies in anomaly detection.
"If somebody is successful in attacking your phone they still have to do something to your phone," he said. "The path of the future is creating a baseline profile of a device and then employing anomaly detection."
Of course, in a BYOD environment, many users are likely to be leery of the boss generating that baseline and then monitoring activities on the phone.
NEXT STORY: NIST revises guidance on security, privacy assessments