Mobile Security is Endpoint Security

The most unprotected and largest security gap in your organization

Mobile Endpoint Security Issues for CISO’s

Today, roughly 60% of an organization’s endpoints are mobile with very little if any security. While security and IT teams wouldn’t consider leaving laptop/desktop computers unprotected, thousands of mobile endpoints are accessing organization information with little security. This is where mobile endpoint security comes into play. This vulnerable endpoint has access and stores the same information as a traditional laptop or desktop endpoint, and yet is often left out of the conversation when it comes to information security.

The most disparate and difficult security challenge for CISOs is ensuring that the thousands of endpoints in their organization are secure. The adoption of laptops created an enormous boost to productivity as organizations grew and expanded and their security was addressed with traditional solutions like endpoint protection platforms (EPP) and virtual private networks (VPN). But times are changing and the distributed workforce is increasingly mobile, and with that, the endpoints used for productivity have changed as well. In fact, 87% of enterprises rely on their employee’s ability to access mobile business apps from their personal smartphones.

As it turns out, there are 7 primary mobile endpoint security issues CISOs face. While the first three are similar to traditional endpoints but need to be secured differently, four are unique to mobile:

  • Corporate email
  • Corporate apps
  • Ransomware
  • Microphone / camera
  • Executive locations / calendars / contacts
  • Entry point to network
  • Username / passwords

Privacy Focused, Enterprise Mobile Security

Zimperium has identified the primary attack vector used to compromise a mobile device, enabling an attacker to access organizational information or the corporate network. These attack vectors, or mobile menaces, are constantly evolving in their complexity, targeting even the latest mobile devices due to their often unprotected state and access to:

2_icon_os_exploit_MobileEndpoint

OS Exploit: The most serious and impactful attack. OS exploits target old or vulnerable mobile device operating systems. Updated devices are more immune to attack but not completely safe and can still be vulnerable to zero day attacks.

2_icon_rogue_MobileEndpoint

Rogue Profile: This often comes in on the back of another app (like a VPN app) installing various escalated rights and permissions.

2_icon_phishing_MobileEndpoint

Phishing: This attack disguised as something legitimate like an email, sms, or application and often appears to come from a friend, a business you often work with (like a bank), etc. Once you activate the phish, various attacks can be launched.

2_icon_wifi_MobileEndpoint

Bad Wi-Fi: A bad Wi-Fi, also called rogue Wi-Fi or rogue access point, looks like a legitimate Wi-Fi but is actually controlled by the attacker. Once a device connects to the bad Wi-Fi, the attacker can monitor and direct traffic at their discretion which often leads to an exploit being delivered to compromise the device.

2_icon_MITM_MobileEndpoint

Man in the Middle: Often abbreviated as MiTM, this attack inserts itself between the mobile device and the intended destination. The attack uses something familiar (like a website or online banking) as it sits in the middle with the user not knowing they are being attacked.

2_icon_malicious_MobileEndpoint

Malicious App: These are apps that often look like a normal app (like a flashlight app) but behind the scenes are stealing information.

2_icon_risky_MobileEndpoint

Risky Apps: These apps are not necessarily malicious but have privacy and/or mobile app security issues as a result of how they were developed.

“Security and risk management leaders who need to strengthen their mobile security posture should adopt MTD products to improve their overall security hygiene.”

– Gartner 2021 Guide For Mobile Threat Defense

How to Secure Mobile Endpoints

There is no question mobile devices represent a significant security risk to an organization. The question is what can be done to reduce the risk that represents 60% of an organization’s endpoints?

A mobile endpoint security solution must be able to:

  • Detect device compromise
  • Analyze all apps for leaky/malicious behavior
  • Block surveillance or traffic interception
  • Prevent unauthorized camera/mic access
  • Stop phishing attempts
  • Ensure end user privacy

Zimperium delivers on these needs and is the only company that can provide machine learning-based, on-device, enterprise-class mobile security for all of your iOS, Android and Chromebook devices.

Sign Up For Our Newsletter

Get the latest Mobile Security News and Updates in your inbox

Get started with Zimperium today