Strategies for Securing Mobile Devices

Part 2: Strategies for Securing Mobile Devices

With workplace mobility now a way of life and companies investing in cloud-based apps more than ever, security is moving beyond the four walls. Just a few years ago, you could rely on firewalls and endpoint security to protect your assets. Today, protection of employee passwords and related authentication solutions are the key to any cloud-based organization’s security.

In the article, Part 1: How Cloud Apps are Making Business More (and Less) Secure, I covered some of the ways cybercriminals are targeting mobile workers with proximity-based, phishing, and malvertising and malware attacks. Now, I’d like to address what a cloud-based mobile device security strategy should look like.

Mobile Worker Security Strategies

Avoid public Wi-Fi: Company VPNs that give employees secure access to their company network and data are a far better option than public Wi-Fi networks that can be the target for hackers setting up a fake network service.  Free Wi-Fi hotspots from both AT&T and Comcast Xfinity have been targeted in the past and put users at risk of having their login credentials stolen via a proximity-focused attack.  Make your secure VPN the first choice for remote workers or have them use their cellular service.

Implement two-factor authentication: This is an extra security measure in which you set up another way to log into an app besides entering a password. Typically you have to enter a code that the app texts via SMS or the phone app. This makes stealing a user’s password worthless. Cloud-based services like Google’s G Suite and Microsoft’s Office365 support two-factor authentication that is simple to put in place. You just need to make sure you enforce it for all of your employees.

Two-factor authentication helps with both proximity attacks and phishing attacks because it gives users an added layer of protection against being hacked by attackers who have managed to steal their credentials. We find that the majority of phishing victims are reusing the same weak password on multiple sites and do not have any additional authentication method.

Expand your user education program: To help avoid phishing attacks, you should train employees to not click on suspiciously formatted emails or unfamiliar links or download unknown apps no matter what device they’re using. Ensure your education program has some focus on phishing e-mails that redirect users to the app store for their device. Be especially wary of those e-mails offering free versions of paid apps. It’s almost always a scam.

Invest in Malware protection:  The mobile device malware infection rate reached 1.35 percent in October 2016, which was the highest recorded since Nokia started its global Threat Intelligence Report in 2012. Smartphones were the top target and phishing was the number one vector. The best defense against malware on mobile devices is the same as with computers. Invest in anti-malware software to stop phishing clicks, downloads of malware, and active malware communication.

Automate software updates: Your IT team should also make sure employee mobile devices are updated as frequently as possible with software patches and systems updates. Don’t say no or I’ll do it later. Do it now.

IT managers can take an active role in security for mobile and bring your own device (BYOD) initiatives by following these simple guidelines above. Don’t trust the security of your organization to your employees.

By Todd O’Boyle

James Corbishly
Teams Sprawl in the Remote Workspace As working from home has become the new everyday norm, with more employers embracing the remote-work model as a new and likely permanent fixture of the employment world, there ...
Derrek Schutman
Implementing Digital Capabilities Successfully Building robust digital capabilities can deliver huge benefits to Digital Service Providers (DSPs). A recent TMForum survey shows that building digital capabilities (including digitization of customer experience and operations), is the ...
Threat Security
Azure Red Hat OpenShift: What You Should Know What Is Azure Red Hat OpenShift? Red Hat OpenShift provides a Kubernetes platform for enterprises. Azure Red Hat OpenShift permits you to deploy fully-managed OpenShift clusters in ...
Alex Tkatch
Best Practices for Designing and Executing a Product Launch Nothing in entrepreneurial life is more exciting, frustrating, time-consuming and uncertain than launching a new product. Creating something new and different can be exhilarating, assuming everything ...
Yuliya Melnik
DevOps Services Outsourcing The sooner you release your unique idea to the public, the higher the chance that it will receive the lion's share of the audience's attention. Delays in development can lead competitors to ...

SECURITY TRAINING

  • Isc2

    ISC2

    (ISC)² provides IT training, certifications, and exams that run online, on your premises, or in classrooms. Self-study resources are available. You can also train groups of 10 or more of your employees. If you want a job in cybersecurity, this is the route to take.

  • App Academy

    App Academy

    Immersive software engineering programs. No experience required. Pay $0 until you're hired. Join an online info session to learn more

  • Cybrary

    Cybrary

    CYBRARY Open source Cyber Security learning. Free for everyone, forever. The world's largest cyber security community. Cybrary provides free IT training and paid IT certificates. Courses for beginners, intermediates, and advanced users are available.

  • Plural Site

    Pluralsite

    Pluralsight provides online courses on popular programming languages and developer tools. Other courses cover fields such as IT security best practices, server infrastructure, and virtualization.