Many of us, especially those of a certain age, are still haunted by the dentist scene in the 1976 movie Marathon Man. Dustin Hoffman’s character writhes in agony as his Nazi war criminal interrogator drills into his unanesthetized teeth, repeatedly asking, “Is it safe?”

While such extreme methods are hardly appropriate for cyber defense, establishing the security status of user mobile devices often feels just as daunting. Why does this matter?

When users attempt to access an application, it’s crucial to know their device’s security status. A compromised device poses a real risk of becoming an entry point for account takeovers, malware infections, or data theft.

Hidden identity

You’d think verifying a device’s security status would be straightforward. Ideally, you’d confirm that security software is active and reporting a good security status, with no indicators of compromise, an up-to-date operating system, and secured with a passcode or biometric authentication. However, the privacy models employed by iOS and Android complicate the connection between security software signals and access requests, making it generally impossible.

The main issue is that neither iOS nor Android allows third-party apps to share a unique device identifier. Consider your email client, CRM app, or browser requesting access to company data. While these apps can provide user credentials and undergo authentication, they cannot confirm the device’s identity. Even if a security solution is mandated, and the app signals the device’s safety, there’s no guarantee it’s the same device trying to access corporate applications. Moreover, enforcing the installation of security applications is unfeasible without a unique identifier.

One exception exists for devices enrolled in a mobile device management system, which can share a unique device identifier and sync it with security software signals. But what about the millions of employee-owned devices routinely accessing corporate data? A recent Samsung survey found that only 15% of organizations provide smartphones to all employees, with 46% adopting a hybrid approach and 39% fully relying on BYOD.

Device identity with managed and unmanaged devices

The Limitations of MAM

Many organizations use Mobile Application Management (MAM) to manage BYOD challenges by focusing on the application rather than the device. MAM is supported by productivity suites like Microsoft365 and Google Workspace, but most popular SaaS applications do not support MAM. This leaves organizations facing difficult choices: compromise on digital transformation by limiting SaaS app usage to company devices or compromise on security by allowing access from devices with unknown security statuses.

Extent of support for MAM across popular enterprise apps

Corrata to the rescue

Fortunately, help is on the way. In 2024, Corrata will launch a new version of our popular Mobile Threat Defense (MTD) solution that works seamlessly on both managed and unmanaged devices. Corrata’s innovation eliminates the need for IT departments to depend on employee diligence in installing MTD on personal phones. With Corrata’s solution, installation of MTD can be enforced as a precondition for accessing any business application, securing unmanaged devices like never before.

Corrata’s solution for securing BYOD access

For CIOs, this represents a myriad of possibilities. It marks the end of having to choose between security and digital transformation. Access can be granted to any application from any mobile device, potentially reducing the corporate device fleet and delivering cost and administrative savings. More importantly, it offers measurable risk reduction for organizations worldwide.

Interested in how Corrata’s forthcoming solution for BYOD can benefit your business? Join our beta program to learn more.

The post Is it Safe ? appeared first on Corrata.

Digital transformation, often regarded as a hackneyed phrase, fails to fully express the revolution spurred by the combination of cloud computing, ubiquitous connectivity, and advanced mobile devices. Consider that most banking and e-commerce transactions now occur on mobile devices rather than desktops. Tradespeople, taxi drivers, and delivery personnel commonly use mobile apps for payments, receipts, and order recording. Complex tasks like fault troubleshooting in power plants or completing safety training en route to construction sites are now efficiently managed via mobile technologies. Digital technologies are sweeping across every industry, every business process, and all aspects of our daily lives like a flood.

A pivotal factor enabling these changes is the technologies that ensure devices are secure. Device management, alongside endpoint security, plays a critical role. Device management controls configuration, while endpoint security protects against malware and other threats. A managed device, identifiable to an organization through a unique identifier, shares this identifier with the endpoint security product, allowing signals to be passed to conditional access systems.

The Reluctance to Enroll and the Persistence of BYOD

Despite these advances, we are far from a world where every device used by every employee in every organization is enrolled in a device management system like Intune, Workspace ONE, or Ivanti Neurons. The reasons vary. In some cases, it’s just not seen as a priority, especially in smaller organizations with limited resources and less focus on information security. Even in organizations with high security standards and well-developed information security programs, device enrollment is not always the chosen approach. This is often due to employee resistance, especially where personal devices are involved, as culture and privacy concerns may oppose mandatory enrollment. Thus, while device management options range from complete control to managing a partitioned segment of the device, for some organizations, securely supporting BYOD is essential.

Furthermore, users such as non-executive directors, contractors, freelancers, and consultants, who work with multiple organizations, cannot enroll their devices in a single organization’s system, limiting their flexibility.

Enter Mobile Application Management (MAM)

Mobile Application Management (MAM) has been the preferred solution for managing risk in a BYOD context. MAM secures individual applications rather than the entire device. Features like remote data wipe, restricted copy-paste, and setting access requirements (e.g., password complexity) enhance security. MAM is widely supported by applications such as Microsoft Outlook, OneDrive, SharePoint, and the entire Microsoft 365 suite, as well as Google Workspace, including Gmail and Drive. Additionally, various MDM vendors support open standards for app development, particularly useful for bespoke organizational apps.

Why MAM is Broken

However, the burgeoning use of enterprise SaaS applications has exposed MAM’s limitations, especially in medium and large businesses that use dozens to hundreds of SaaS applications. A recent study by Corrata on Okta’s top 50 enterprise SaaS applications revealed that only 12% support MAM. Major applications like Workday, SAP Concur, HubSpot, and Dropbox lack MAM support, leading organizations to either disallow these apps on BYOD devices or overlook the associated risks – neither approach is satisfactory for security, user experience, or productivity.

Extend of support for MAM across popular enterprise apps

A significant challenge with BYOD devices is browser access. SaaS applications, typically designed for optimal browser use, lead employees to bypass MAM and access apps via browsers. Some organizations respond by blocking browser access or restricting it to managed devices, but this can be overly restrictive.

Furthermore, MAM assumes the underlying platform’s safety, but checks on the operating system’s integrity or jailbreak status are often superficial. MAM alone doesn’t ensure protection from malware or other threats, a gap that only an endpoint security solution can fill.

Endpoint Security to the Rescue

The good news is that these limitations can be addressed by deploying an endpoint security solution alongside MAM on BYOD devices. Mobile Threat Defense (MTD) products, like Corrata, are tailored for mobile security, offering features such as anti-phishing protection, secure communications, and endpoint detection and response. They perform sophisticated security checks to ascertain device safety and, crucially, can block compromised devices from accessing corporate applications. MTD offers superior protection over MAM and covers all applications, not just those MAM-compatible.

However, MTD’s success hinges on privacy-first solutions. Users need assurance that their personal data, from browsing activity to message content, remains private. Fortunately, solutions offering such privacy are gaining acceptance, especially as employees become more aware of personal mobile security risks. A robust mobile security solution benefits both the company and the employees.

Every Employee, Every Device, Many Applications

While there’s a place for corporately managed devices for privileged users and certain high-security applications, BYOD can provide adequate security for many apps. Leveraging MTD, we can now extend appropriate security levels not just to a few apps but to the majority transforming our workplaces.

The post No MAM appeared first on Corrata.

As a CISO, Security Architect, Risk Manager or Security Analyst, it’s your job to identify the best way to mitigate information security risk within your organization. Sometimes this will involve implementing a technical solution to protect against a new or growing threat. You will have come to this decision after examining the range of alternative approaches to addressing the threat and, in the case of a technical solution, having assessed multiple vendor offerings. 

But for many, this is the easy part. It’s essentially a technical issue, a question of diligence and expertise, likely conducted with peers who share your deep understanding and engagement with cybersecurity risks and technologies and the tradeoffs involved in any such decision. Now the time comes to bring your proposal to the upper management, perhaps the executive team or the Board. Now you need to articulate in terms that the non-technical will understand why your organization needs to spend time, money and resources on the project, aka – make the business case.

What then is the business case for investing in mobile endpoint security?

Why we need a mobile endpoint security solution now

The first question you must answer is, ‘Why now ?’ In other words, what has changed in the information security environment that makes it urgent to implement mobile endpoint security today? After all, employees have been using smartphones since the advent of the iPhone.

The reason why mobile endpoint security is a business priority today is straightforward. The move to cloud means that mobile users now have access to the same business systems that are available on traditional laptops and desktops. In the past, laptops and desktops had access to a much wider range of applications because they were joined to the corporate network either directly or through a VPN. Today that distinction is disappearing: all devices access cloud or SaaS applications on the same basis. 

This gives us our first argument for the need for mobile endpoint security:

“More and more of our business applications will be accessible directly from our employees’ phones and tablets:

– We are now using the Microsoft 365 suite, including Outlook, Teams, OneDrive, Word and Excel, all of which are accessible from employee mobiles.

– In the last two years, the organization has adopted a wide range of SaaS applications.

– We expect that the number of SaaS applications used by the business will continue to increase.”

Parity of protection

Your senior management is very aware that the organization has a range of security solutions in place to protect traditional endpoints. What they may not appreciate is that these solutions do not operate in the mobile environment. Web content is not filtered, mobile phishing messages are not blocked, and phones are not scanned for malware infection. 

This leads us to the second argument in support of mobile endpoint security – parity of protection:

“While we have an endpoint security solution deployed on desktops and laptops, we don’t have an equivalent protection on employee mobile devices. This means we have no protection against malicious content, phishing over sms and other messaging applications, and mobile malware.“

Mobile Devices are not invulnerable

85% of mobile phishing attacks are outside email. SMS, WhatsApp, and other messaging, social and collaboration platforms are all being targeted with increasingly sophisticated phishing attacks.

Based on data from the hundreds of organizations using Corrata, we know that most employees receive a mobile phishing message at least once a month. We also know that one in five devices have poor security configuration, making them susceptible to malware infection. And one third, access websites with weak encryption leaving employees exposed to data loss. Nothing in your mobile device management system addresses these threats. 

This leads us to the third argument in support of mobile endpoint security – heightened risk:

“There are a range of risks which are not addressed by the built-in security on iOS and Android or by our mobile device management system. These include:

– Targeted phishing attacks sent directly to mobiles over SMS, Whatsapp, Slack and other messaging and collaboration platforms.

– Attacks which bypass our multi-factor authentication by stealing authentication cookies. A successful attack would allow unauthorized access to our business systems over a prolonged period.

– Malicious software which allows attackers to read messages and other content sent to and from our employees’ phones.

– Poor encryption of data in transit leading to unauthorized disclosure of company and customer information sent to and from mobile devices.

– Non-compliance with acceptable use policy which restricts access to inappropriate content

– Failure to keep phone software up-to-date and other poor security configurations.”

How mobile endpoint security helps

You’ve made a strong set of arguments for the need to do something about the mobile security gap. You now need to introduce the solution. This means explaining what a mobile endpoint security solution will do. In doing this, it’s important to remember that your audience will assume it’s like the endpoint security solution with which they’re familiar – this might be a traditional anti-virus solution or a more modern EDR solution. Mobile endpoint security incorporates virus scanning and malware detection and response but also next-generation firewall, web-filtering, and anti-phishing features:

“The mobile endpoint security solution we’re proposing will protect us by doing the following:

• Blocking links to phishing sites, malware download sites, sites which are contrary to our acceptable use policy, and other malicious sites. It provides the equivalent of the web filtering we currently have on our desktops and laptops.
• Detecting any malware present on a device. Any device with malware installed is automatically prevented from accessing our business applications. This is equivalent to the [anti-virus, endpoint protection, or endpoint detection and response] software on our laptops and desktops.
• Preventing any data being sent to or from our phones without proper encryption. This ensures that our data cannot be snooped on by bad actors monitoring WiFi or other networks. This is equivalent to the protection provided by using a VPN.
• Assigning a security score to each device. Employees are prompted to keep their devices up to date, to remove any risky applications, and to correct any poor configurations. Devices with low scores can be automatically prevented from accessing business applications. This is equivalent to features provided by our endpoint protection software on laptops and desktops.”

No negative impact on employees

Having convinced your executive team of the need for a solution and the practical protections it will deliver, your final step is to address two common objections. The first relates to employee acceptance. Your senior managers will be only too aware that employees don’t like being surveilled. They also love their phones and don’t want anything interfering with the smooth functions of their devices. So it is important to be able to reassure your executives that the solution respects employee privacy and does so in a transparent and easy-to-communicate manner.

This means a solution that doesn’t track location, scan images or other content, read messages, or record browsing history.

You should also be able to offer the reassurance that your chosen solution runs unobtrusively in the background without impacting the normal operation of the device. Employees are only required to interact with the app in the rare case that their manual intervention is required to resolve a security issue.

Easy to deploy and needs little ongoing management

The second concern will be around the impact on the, undoubtedly stretched, security operations team. The good news is that mobile endpoint security focuses on preventing attacks: blocking phishing and malware download sites, preventing unencrypted communications, and disabling malware. Alerts and escalation requirements are generally minimal, and mature solutions will integrate with your existing security operations stack. 

The final clincher: quick and easy to deploy (and hence no upfront professional services costs), a single all-inclusive annual fee with no hidden extras.

In conclusion: you should approach your senior management with confidence. Mobile Endpoint Security is a cost-effective, easy to deploy and manage technology which addresses a gap in your defences which, unless addressed, will only get larger.

Best of luck! 

The post Making Your Case appeared first on Corrata.

Last year we reported that poor security configuration on a number of popular websites (including the German tabloid Bild, Spanish banking group Santander, and Irish telecommunications provider Eir) left visitors accessing the websites vulnerable to hacking. The issues we uncovered related to the way in which Transport Layer Security (tls) was implemented on these sites.

Today the vast majority of websites use encryption to ensure that sensitive data exchanges between users and the website remain confidential. This confidentiality depends on the use of an internet protocol known as Transport Layer Security (tls). Https is the implementation of tls used when browsing websites. Its use is traditionally signaled by the appearance of the lock symbol at the top left-hand corner of the browser address bar. A misconfiguration meant that visitors accessing the site with iPhones or iPads used out-of-date tls code or cipher suites, which meant that their communications with the site, though ostensibly secure, were, in fact, vulnerable to interception and manipulation (Interestingly, Google recently announced that it would no longer use the lock symbol – read more here).

Poor Encryption & Practices

You could, of course, argue that in our previously documented cases, at least the data had been encrypted, albeit poorly. More recently, we have uncovered cases of users being asked to submit data to websites without any encryption at all. One such case involving telecommunications provider Eir, is described in detail in this incident report. (Following our disclosure of the vulnerability, Eir promptly resolved the issues). The link to the offending page originated in an account-related email. Not only was the link to an unencrypted page, but the site failed to redirect the user to an encrypted version, potentially allowing a malicious actor to impersonate the Eir site. In addition, the page prompted the user to enter an email address. If this email address is related to a valid Eir account, the response provided details relating to the account in plain text.

Eir are not alone: a number of other high-profile websites and applications display similar weaknesses. 

As we encounter these poor encryption practices, we report the issues to the website or application owners in line with our responsible disclosure policy. This enables those responsible to rectify the problem and safeguard users.

The issues we have uncovered relate to the failure to use encryption on pages where customers are asked to upload personal information. This matters because, in today’s cloud computing era, we all place huge reliance on tls to ensure that our internet communications remain confidential. In fact, we have come to expect this and act accordingly. Google reports, for instance, that 97% of traffic in the US using the Chrome browser is encrypted. 

So today, users would be excused for not double-checking a site to confirm that it is using tls on all data input pages.

Full Protection with Benefits

Corrata does not routinely scan websites looking for poor or absent encryption. The discovery of these incidents is a by-product of the security we provide to our customers. When our mobile security product is installed on a device, it continuously checks for vulnerabilities, disables malware, and blocks access to phishing sites and insecure communications. Over the last 18 months, we’ve introduced new features which check for poor encryption and identify attempts to upload data without encryption. Our customers can configure Corrata to prevent the transmission of sensitive information over such vulnerable channels, keeping personal and corporate data safe from interception.   

It’s important to grasp that, when data is sent over the internet unencrypted, in ‘plain text’, or poorly encrypted, it’s susceptible to being read and manipulated by anyone else on the network. The era when the vast majority of sensitive organizational data traveled over networks under corporate control has long passed.

In today’s cloud-centric world, security professionals are acutely aware they must build security on the basis that much of their organizations’ information will routinely traverse networks which are fundamentally insecure. The rapid adoption of SaaS and the internet enablement of in-house applications means more and more data is exposed to the risks that these networks present. Given this reality, adopting technology that keeps your data safe regardless of the quality of protection offered by your service providers is critical.

The post Popular Websites Failing To Protect Data Uploaded By Customers appeared first on Corrata.

As an IT leader in a legal firm, you don’t need to be told about how important Information Security is to your sector. Legal firms face unique challenges. They not alone handle client funds but also handle sensitive and highly confidential information. Handling of sensitive information is not the exception in legal firms, it’s the rule.

The range of potential attackers targeting legal firms is comparable to that facing governmental organizations, including nation-states, serious organized crime gangs, and hacktivists. Attackers are motivated not just by financial gain but also by political, ideological, and nation-state concerns. Incidents such as the release of the Panama and Paradise papers send a chill through the bones of legal firm Information Security staff everywhere. 

Risks are particularly acute for firms whose clients are in sensitive or controversial sectors such as energy, life sciences, capital markets, and high technology.  

Recent trends

Experts point to a range of recent trends which are heightening the risk profile of the legal industry:

• Clients challenge the technical capabilities of firms insisting that they support their preferred collaboration and data storage systems.
• The legal supply chain is becoming more complex: outsourcing, disaggregation of the delivery of legal services, and the increased use of specialist firms. Not alone must legal firms collaborate securely with their clients, but they must also do so with a range of other legal providers.
• Remote working has become the norm, and with it, the requirement that documents and systems be accessible from anywhere at any time in a manner which delivers both security and ease of use.
• Complex and often conflicting privacy regulations. For example, firms working with US clients may well need to take growing state-level privacy laws into account in their operations.

Supply chain attacks have raised awareness across all sectors that your data is only secure when the third-party suppliers you rely on have effective information security management systems. Clients demand insight into their legal service providers’ cybersecurity controls, processes, and procedures. They are acutely aware that the information they share with their lawyers is highly sensitive and need reassurance that it is being handled and protected appropriately. Firms need to credibly answer clients’ requests about their cyber security practices and their information security management system. Increasingly clients demand certifications such as ISO 27001 and SOC 2.

All of these factors point to the unique importance of information security to the reputation of legal firms. Partners are only too aware that a single incident can destroy a reputation carefully built up over countless years, and there are plenty of ready, willing, and able competitors just waiting for an incumbent to slip.

Information security leaders within legal firms are not complacent, and neither are their management. PWC UK’s Annual Law Firm Survey revealed that the top 100 firms have increased their spending on cybersecurity by an average of 39% in the last year.

The rise of mobile risk

But what if that spend is not properly allocated? Today many legal firms have no protection in place against the rising threats facing mobile users, even though we are now seeing a 50/50% split between mobile and desktop traffic – a significant change from the 25/75 split in 2015. As the profession embraces cloud computing, the exposure that mobile represents begins to align with the exposure with traditional domain-joined devices.  

Today, the vast majority of medium and large legal firms have mobile device management systems in place. In fact, many have had these systems in place for many years. However, the clue is in the name: these are management systems, not security systems. They don’t defend against the three principal risks facing mobile users today. 

The first of these is the risk of credential theft either via phishing attacks or malicious applications. 77% of leading law firms reported experiencing a phishing incident in 2022. These attacks are widespread and increasingly sophisticated. Not alone can they steal usernames and passwords but also authentication cookies and codes. MFA is not a panacea.

Advanced spyware is the second significant risk facing law firms, particularly those dealing with clients in sensitive sectors. Multiple scandals have raised awareness of security agencies’ use of the Pegasus iOS spyware to mount targeted surveillance on politicians and civil rights activists. Today there is mounting concern that similar sophisticated technology is being deployed more widely. Such malware bypasses the in-built security protections in iOS and Android and cannot be detected by anti-virus software. But the threat is real and can lead to a fundamental compromise of any data on the phone and create a gateway to all of the data in the organization.

The third risk is from intercepted communications. Lawyers use their smartphones and tablets continuously on networks which are not under their organization’s control. This can be anything from a home network to the free Wi-Fi provided in hotels or coffee shops or, indeed, the cellular network itself.  Without robust and continuous encryption, these communications are at risk of interception by determined adversaries.

A better set of solutions

It is, unfortunately, true that the first generation of mobile security solutions promised more than they delivered. Many were designed and based on replicating the limited features found in traditional anti-virus solutions. They failed to take into account the unique benefits (for example, sandboxing and the app store distribution model) and challenges (for example, smishing and user privacy expectations) of the mobile environment.

The good news is that there are easy-to-deploy, privacy-sensitive solutions available today. Mobile Threat Defence technology has moved on since the term was first coined by Gardiner back in 2016. Today leading-edge mobile threat defense solutions protect against SMS and other mobile-specific phishing attacks, are able to detect sophisticated malware and against communications which are inadequately encrypted. And what’s more, the leading solutions can do all of this without the need to collect privacy-sensitive information such as location or the contents of files on the device.

In Conclusion

I would urge legal firm IT leaders to carefully consider the benefits of deploying MTD. If you’ve previously looked at mobile endpoint security solutions, now is a good time to look again and if not, then take a look for the first time. You’ll be pleasantly surprised by the protections available, the positive user experience provided, and the ease of management and deployment. And you never know, but your partners might even thank you! 

The post Courts, Contracts, Cloud And Collaboration appeared first on Corrata.

You’re vulnerable, you know

In November, it was reported that a vulnerability in the Android operating system had been discovered, which allowed the passcode to be bypassed. This was a pretty explosive finding. In effect, it meant that anyone could, by following a few simple steps, unlock a phone to which they had access. Devices are mislaid every day, and passcodes exist to ensure that, should they fall into the wrong hands, our data will remain secure. And it’s not just lost phones – housemates, colleagues, intimate partners, children, and many others have ready access to our phones when we leave them lying on a table, desk or anywhere else.

These kinds of high-severity vulnerabilities are not confined to Android devices. In October, Apple released an urgent upgrade for iOS to address a severe vulnerability that Apple announced “may have been actively exploited”. This followed a similar urgent update in August. In these cases, the vulnerability was one which required considerable technical skill to exploit but did not require physical access to the device.

The discovery of security holes in mobile operating systems is more common than is generally appreciated.

The graphs below show the number of CVE’s discovered in iOS and Android in recent years.

Graph 1: iOS Vulnerabilities By Year [Source: cvedetails.com]

Graph 2: Android Vulnerabilities By Year [Source: cvedetails.com]

While many of these vulnerabilities are relatively minor, they do nonetheless confirm that mobile operating systems are not the impenetrable fortresses that some assume.

Your mobile’s secure… until it isn’t

The architecture of mobile operating systems has given them considerable advantages over the traditional operating systems on laptops and desktops. They have a range of built-in features which makes them hard to hack. Application sandboxing is the single most important reason why mobile operating systems are more secure than their desktop/laptop equivalents. Apple’s documentation summarises sandboxing very well:

“All third-party apps are “sandboxed”, so they are restricted from accessing files stored by other apps or from making changes to the device. Sandboxing is designed to prevent apps from gathering or modifying information stored by other apps. Each app has a unique home directory for its files, which is randomly assigned when the app is installed. If a third-party app needs to access information other than its own, it does so only by using services explicitly provided by iOS and iPadOS.”

Access to system functions is tightly restricted, and any sensitive capability (for example, tracking location) requires explicit user permission. Application sandboxing is a major departure from traditional operating systems. In macOS or Windows, software downloaded to the device has unrestricted access to a wide range of system functions and to all of the files on the device. But even with sandboxing, there are gaps and holes that can be exploited. For example, attacks against the Safari Webkit rendering engine are popular because it has access to a range of system functions unavailable to standard applications.

The software distribution model for iOS and Android is also a security strength. In iOS, in particular, it is very difficult to inadvertently install an app which has not been through the App Store vetting process.

Android remains more open. The latest statistics from Google’s Android ecosystem security report suggest that in June 2022, Potentially Harmful Apps (a broad category that includes spyware, toll fraud and phishing apps) represented .05% of Android app installs. When Corrata’s Mobile Security is initially rollout out, we typically find between one in every one hundred and one in every two hundred devices have malware installed.

A third area where mobile operating systems have improved on their traditional predecessors is in ensuring the integrity of the operating system itself. In the early days of iOS, it was not uncommon for skilled users to exploit vulnerabilities to ‘jailbreak’ the phone (technically gain superuser privileges) to customize the device in some way (for example, by installing apps without going through the App Store). Rooting is the term for the equivalent process on Android. Some manufacturers allow rooting (in much the same way that a skilled user can replace the Windows operating system that ships with a pc) but others do not (thus requiring a vulnerability). The risk to an organization when a device is jailbroken or rooted is that the inbuilt security protections they expect to operate can no longer be relied upon.

And this illustrates well the reason why patching vulnerabilities is so important. If the operating system is vulnerable, then you can no longer rely on sandboxing, file encryption and other protections to work.

The challenges with vulnerability patching

Apple, as both the phone manufacturer and owner of the operating system, has always had complete control over the delivery of patches to its phone. In the past, the patch process for Android was problematic.

However, this has much improved, particularly with the introduction of monthly security updates, which can be implemented without the need for an overall system upgrade. So now the question is not whether patching is possible but rather how you ensure that mobile devices used by your employees are kept up to date.

The key challenge is that, in many circumstances, you are reliant on end users to perform the upgrade. And even where you have control over the update process (for example, with supervised iOS devices), we may be concerned about user pushback when updates introduce significant changes to user experience. And remember, of course, that many organizations allow unmanaged user-owned devices (BYOD) to access critical data on their mobiles, including email, file sharing, and line of business apps.

A zero-trust approach to Operating System hygiene

Lock down, and protect your systems with conditional access policies

In our experience, the most effective way to ensure operating system hygiene is to use conditional access policies. Conditional access is a key part of the zero-trust security model. With this model, access to corporate systems, be they on-premises, cloud-hosted or hybrid, is conditional on the security status of the user, device, and network from which the access request is coming. We can, for example, use conditional access to restrict access to the most sensitive information to managed devices, with a high-security score only allowing unmanaged devices to access less sensitive data. And even this access can be made conditional on the device running up-to-date software.

A general policy that requires users to be running up-to-date software to access corporate systems has, in our experience, been effective. Updating system software is simple today and only a minor inconvenience to the end user. The dangers of running out-of-date software are increasingly understood by the general public, making it easier for Info Sec teams to communicate a no-tolerance policy to unpatched devices.

And while there may be a minority of older devices which can no longer be patched, replacing these is a price worth paying for the peace of mind that successful patchwork brings.

The post Patchwork appeared first on Corrata.

On May 13th the Financial Times reported that a recently discovered vulnerability in the hugely popular messaging app WhatsApp had allowed attackers to inject commercial spyware onto mobile devices. The hack involved the installation of a sophisticated and powerful spyware known as Pegasus, developed by the Israel-based NSO Group. The attack, which exploited a previously unknown software vulnerability in the WhatsApp mobile application, enabled the attacker to instal spyware via a WhatsApp voice call. Once installed, the spyware could collect sensitive information that was then fed back to the attacker.

This is the second high profile security incident in involve Pegasus. The previous attack was revealed by the human rights and technology organization Citizen’s Lab in August 2016 and exploited a trio of vulnerabilities, dubbed Trident, in the iOS operating system. In that case, despite the fact that the attempted spying was ultimately thwarted, future research identified evidence of the spyware in operation in at least 45 countries.

iOS and WhatsApp hacks…targeting mobile phones

It is no surprise that these kind of attacks are today targeting mobile phones. We expect that our mobile conversations are secure to use them for even the most sensitive secrets. Attacks like this against WhatsApp give pause and beg the question – what do I need to do to keep my organization’s mobile devices secure?

While company have a range of tools aimed at thwarting mobile phone hacks at their disposal, people are questioning their effectiveness against the latest cyber attacks. So let’s examine how today’s tools would have worked when confronted by a modern threat such as the iOS and WhatsApp hacks.

Anti-virus

We are all familiar with anti-virus (AV) programs from the PC world. Such programs are also available for mobile devices. However because of the way Apple and Google have designed their operating systems, AV programs can often do little to detect malware. Apple bans AV programs from its app store and while Google, with a more open attitude, allows AV programs for Android, its efforts are focused on its in-house virus scanning efforts known as Google Play Protect.

How mobile anti-virus works

Anti-Virus software checks all apps on your phone against a list of known malware. If it finds a previously unseen app it will copy and analyze it to see if it has suspicious code.  

Why anti-virus wouldn’t have protected you from the iOS and WhatsApp hack

Anti-virus protection would have been ineffective against the iOS and WhatsApp hacks for three reasons. Firstly, an anti-virus program is only effective if the malware is contained within an app. Secondly, the program can’t stop you from installing the malware; neither can it remove it. Finally, it is easy for malware developers to trick anti-virus programs into thinking their code is benign – if they detect that the app is being analyzed, the malware changes its behavior to look benign, leaving the anti-virus virtually useless.

Mobile Device Management

Companies use Mobile Device Management (MDM) systems to configure and manage their employees’ mobile devices. They enable IT departments to do things such as distribute applications to employees’ devices over the air. MDM’s can also enforce basic security rules such as requiring a device to be encrypted and to have a strong password. They do not secure devices against cyber-attacks and would have offered no defense against Pegasus.

Mobile Threat Defense

In the early years of this decade, a range of startups launched products to address the limitations of mobile anti-virus. Leading IT analysts Gartner call this product category “Mobile Threat Defense” or MTD for short. MTD is typically deployed alongside a Mobile Device Management system.

How MTD works

MTD products collect information about devices, apps and networks to identify potential risks. Businesses can then use their MDM systems to block high risk devices from accessing corporate applications and data. However, MTD products suffer from two severe limitations: (i) they have a very limited view of device network traffic and, (ii) they have no way to instantly disable malware. The first makes it difficult for them to detect malware infection and the second limitation means they cannot prevent its operation once installed.   

Would MTD have protected you from the iOS and WhatsApp hacks?

The short answer is no. None of the settings that MTD monitors would have disclosed that devices contained Pegasus malware. Therefore, the malware would have been free to operate without any interference from the MTD solution.

Corrata’s approach

At Corrata we have pioneered a different approach to securing mobile devices against cyber threats. Our approach is about protecting the device rather than simply monitoring it. Our vision is to act like an immune system for your mobile device that protects against attacks.

How Corrata’s solution works

Corrata’s solution is based on our patented SafePathML technology. SafePathML creates the equivalent of an enterprise grade firewall installed on each device. Once installed, the firewall has complete visibility and control over all network traffic to and from the device. Corrata reviews every server in real time that a device attempts to connect to. Using dynamic rules (we call this Smart Policy Protection), Corrata blocks connections to suspicious hosts. This stops devices connecting to malware download servers. Corrata will detect well disguised malware once it attempts to communicate with its command and control infrastructure. Corrata instantly blocks connection attempts which prevents the malware from sending any data back to its owners.

How Corrata would have countered the iOS and WhatsApp hacks

In the WhatsApp case, hackers disguised the Pegasus malware as an inbound VOIP call.  Corrata’s solution detects these connection attempts and blocks them. Corrata’s software would then flag these connection attempts as suspicious and report them instantly to information security teams. This means that Corrata detects the infection and disables its operations.

NSO, like others who operate malware, constantly change their server infrastructure and make significant efforts to avoid detection. Security solutions which rely on lists of known malicious domains and IP addresses don’t work against such actors. In contrast, Corrata uses its Smart Policy Protection feature to spot these suspicious connections.  Smart Policy Protection uses a combination of device traffic analysis, global internet categorization data, and information about domain registrations to identify newly created malware servers.

Reflection 

These hacks have raised awareness of the vulnerability of mobile devices and helped to dispel complacency around the threats. For those of us involved in providing tools to secure devices, the important issue is to make sure that our software offers the best possible protection against the most determined attackers. The alternative of simply bombarding info sec teams with more dashboards to explore and alerts to triage is not an approach which is sustainable. In contrast, Corrata’s mission is to provide protection which evolves  in response to changes in the threat environment. Or in simpler terms an immune system for mobile.

To find out more about Corrata’s Security and Control solution and how it can keep your mobile devices safe from all cyber threats, visit www.corrata.com.

For more industry news, insights and analysis – follow us on Twitter and LinkedIn!

The post iOS and WhatsApp Hacks, which approach to mobile security is best? appeared first on Corrata.