How To Secure Mobile Devices

Although mobile malware is still in its early stages, the number and the severity of the threats have been growing exponentially over the past few years and are showing no signs of relenting anytime soon. The vectors for infection are very similar to those that have been used to infect PCs. Threats can exist on websites or within search results, emails, seemingly innocuous downloads, text messages and insecure public WiFi hotspots. The most common method of infection (right now) is via app installation. AppRiver's Troy Gill, security analyst, takes a look at the most common types of infections, and how IT solution providers can guard against them. —Jennifer Bosavage, editor

Cyber crooks are infecting popular mobile platforms through malicious applications and, unfortunately, no mobile platform is immune from the destruction it can cause. Although some form of malware has been found in all popular operating systems, the majority of them are now being found in the Android market.

Android’s open source software is something that gives the platform great appeal, but it is also the basis of its vulnerability. Users may enjoy the freedom to acquire apps both inside and outside the Android Market, but it doesn’t come without risk. The Android Market allows developers to upload apps without first running through an established screening process like one that you might find at Apple’s App Store or when using RIM’s application for BlackBerry. As a result, Google detected more than 50 malicious apps within the Android Market, downloaded to approximately 260,000 Android mobile devices. (Google later remedied the infections remotely via an auto installed software update.) However, more malicious apps continue to be found, the brunt of which are in the Android market.

While Google’s remote ’kill switch’ might have been effective at removing the rogue apps, it was reactionary in nature and not a permanent solution to the underlying security problem. What’s more, human nature is typically the weakest link in security. Many of the dangers surrounding malicious apps can be avoided with more scrutiny placed on apps from the start.

Though the most recent malware outbreak was found on the Android platform, it is important to remember that there is malware readily available for every platform.

There are many ways to tighten security on mobile devices. Today, BES and (provisionable) ActiveSync devices can be configured for policy management to effectively enhance mobile device security. For example, BES has hundreds of policies that can be controlled and used to help lock down devices via passwords, password policies, device encryption, remote data wipe, Web browsing, Installed applications and application specific settings, controlling device hardware (Bluetooth, camera, gps, etc), employee monitoring, (txt, gps) or Smart cards.

Additionally, here are some other key points to keep in mind (and share with your users) when securing mobile devices:

• Reputable Source: Avoid downloading apps from unknown sources and instead seek out official marketplaces
• Review the Reviews: If you are downloading an app from an established marketplace, learn what others are saying about the app in the reviews
• Permissions: Be aware of the permissions an app is asking for during install
• Safe Browsing Habits: Remember, the same dangers that exist on the Web (i.e. black hat SEO poisoning, social media, email and SMS) can also exploit a mobile device. Remain vigilant about all Web surfing activity.
• SMS or VM Phishing: SMS and voicemail are common vectors of attack for phishing scams. Always call the institution directly and verify the information whenever responding to a questionable voicemail or text.
• Password Protection: Lost or stolen phones likely contain personal information, such as stored logins to banking or social media sites, and could provide someone with access to sensitive information. Minimize this threat by password protecting your mobile device.
• VPN Access: When accessing corporate network resources via smartphone, use a SSL VPN connection to secure the session.
• WiFi Hotspot Security: Nearly all smartphones are now equipped with WiFi functionality, making them highly vulnerable to attacks. There are various tools available that allow even the least talented hacker to exploit WiFi hotspots and intercept Web traffic. Avoid accessing any password protected site or one where you will give any personal information (i.e. Facebook, Banking, Paypal) when connected to an unsecured WiFi hotspot, such as those in a coffee shop or at the airport.
• Remote Wipe & Encryption: Use encryption software on smartphone devices to protect data in the event a device is lost or stolen. Consider using a remote wipe to brick the device remotely.
• Use Security Apps: While the offerings are not as robust as the anti-virus offerings available for PCs, there are still some very good security apps available on the market for mobile devices.
• Update: Always remember to keep mobile device operating systems and software up-to-date.

Smartphones have placed the power of personal computers in the palms of our hands. But it takes smart usage and strong security practices to keep personal data out of the wrong hands.