Cybersecurity on corporate devices

Most common threats on mobile devices

Below, we detail some of the most common security threats to mobile devices:

• Phishing. In computers, phishing is usually spread through fake messages with malicious attachments or links. In the mobile world, however, most phishing attempts originate on social media, text messages or apps. One variant is smishing, which involves stealing a user's credentials when they click on a malicious link received via SMS.
• Malware and ransomware. The most common mobile malware is malicious apps created to damage, interrupt or gain illegitimate access to a device. Of all the types of malware, ransomware stands out as the most common variant. Its costs go up every year.
• Rooting and jailbreaking. As mentioned, jailbreaking and rooting are methods that allow users to gain administrator access to their mobile devices so they can download malicious apps or enhance the permissions of the applications.
• Man-in-the-middle attacks. These intercept the traffic in a network to obtain confidential data in transit, or to alter the information being sent. Mobile devices are particularly vulnerable to these attacks, since unlike web traffic (which uses an SSL/TLS encryption protocol), mobile applications can transfer sensitive data without any encryption.
• Spyware. This is a type of malware that monitors a user's activity and provides access to data such as the device location, browser history, phone calls, photos and videos, etc., in order to engage in identity theft, financial fraud, and more.
• Malicious web apps and sites. These are malware-infected programs that attack as soon as you enter a website or download an app.
• Non-secure Wi-Fi networks. Using public or non-secure Wi-Fi networks increases the risk that the outgoing or incoming traffic of the mobile device will be intercepted and its information compromised.

Eight key aspects to keep in mind...

Companies should apply all the measures needed to identify attacks early and respond appropriately to limit their impact. Below, we present eight key aspects to consider to prevent and/or neutralise the security risks affecting mobile devices. These are:

• Application security and endpoints. MAM (Mobile Application Management) and MDM (Mobile Device Management) systems make it possible to audit and manage the software used by mobile devices, and apply the criteria required by the company. Elsewhere, CASB (Cloud Access Security Broker) solutions protect the security of cloud applications by linking with corporate facilities and networks, applying security regulations and managing the use of cloud resources.
• Access controls based on the user and the device. User identity and access management (IAM) systems are used to regulate user information privileges. This means that data can be added, edited, deleted or copied from the mobile terminal.
• Advanced security elements such as antiviruses, virtual private networks (VPN), gateways, firewalls, IPS, and so on will help enhance the security of devices. Gateways, for example, allow secure network connections to be established between two devices or between a device and the Internet, ensuring that the connection complies with the company's cybersecurity policies, regardless of the location and type of device used.
• Email security: Email is one of the main tools used by cybercriminals. Because of this, maintaining a rigorous corporate email security policy is essential. This includes enabling advanced protection capabilities that identify and deal with threats and protect confidential information via encryption, thus avoiding the loss of data.
• Managing permissions on mobile apps. The permissions given to mobile applications determine their level of operation. However, granting permissions to an application with vulnerabilities can give cybercriminals access to confidential data on the device.
• Encrypted connections. Companies can extend their corporate network to make it accessible to users from anywhere by using virtual private networks (VPN), which can be used to encrypt connections between devices and any network (including public Wi-Fi networks). Multi-factor authentication (MFA) systems are currently the most effective method to enhance security.
• Password management. The organisation's policy can and should require employees to change passwords regularly and use robust combinations that, at a minimum, contain letters, symbols and punctuation signs. A different or additional option to passwords is setting up a lock screen to require the user to use their fingerprint or facial recognition to unlock the device and access its content.

These actions represent a major advance in protecting personal and company devices against cyberattacks and malware. However, they should also be supplemented with a complete IT architecture that provides central control of the different security solutions.

Five tips for the right mobile security strategy

The secure management of mobile devices can make the difference when determining the risks facing an organisation. Here are five tips to successfully set up an efficient but secure corporate network.

1. Establish a clear and comprehensive mobile security policy that lays out guidelines for users of mobile devices to follow. These security policies should include elements such as mandatory settings, usage practices or measures to prevent data theft or leaks, and coordinating the systems for remotely monitoring and controlling the devices.
2. Regularly update the operating system and mobile applications. Mobile operating systems, as well as mobile applications, are constantly tested by their creators to correct security vulnerabilities and optimise their operation. Because of this, having obsolete versions means being exposed to cyberattacks that could put the company's operations at risk.
3. Regular backups and remote data wipes. It's essential that all mobile devices be set up to make backups that can be stored in company facilities or in the cloud. Ideally, remote data wiping should also be configured, which would allow deleting any data on the device even if it is not physically accessible.
4. Avoid installing programs directly on devices. Malware affects hundreds of thousands of mobile phones every day, and one of the main ways is through installed apps. Ideally, the applications should be migrated to a web (or cloud) environment that eliminates the need to install and reinstall software on the terminals.
5. Train employees on cybersecurity and security threats. When it comes to using company devices, it is important to invest time and resources to raise awareness of cybersecurity. For example, not clicking on suspicious links, not downloading content from unreliable sources, using secure passwords, doing backups, using an antivirus... And, of course, training must include management too, and include training for specialists in mobile cybersecurity.

In conclusion

As we can see, managing the security of mobile devices for use on corporate networks involves serious planning by organisations and poses a huge challenge to IT departments. You need to be aware of this and implement measures to reduce risks.

In short, it's important to realise that having mobility devices that can access data requires extra security. Security that will make it possible to use solutions that should be almost mandatory, easy to implement and that guarantee adequate security for both the network and for each of its elements.