| Listen on Google Podcasts | Listen on Mave | Listen on Yandex Music |
Ruslan Rakhmetov, Security Vision
The use of mobile devices (smartphones, tablets) in the corporate environment became commonplace already 5-10 years ago, but since the pandemic started, the use of such devices has become comprehensive. Until then, only technologically advanced companies made it possible to use corporate or personal devices to solve business tasks and process confidential proprietary information. The use of smartphones and tablets not only increases employee efficiency, but also introduces specific cyber risks, the level of which has increased significantly recently (vulnerabilities in mobile OS and applications, hardware, networks and data transfer protocols, as well as malware and spyware for mobile devices). This publication reviews the draft version (draft) of NIST SP 800-124 Rev. 2 (Draft) ‘Guidelines for Managing the Security of Mobile Devices in the Enterprise,’ which provides recommendations for securing mobile devices by outlining possible strategies and technologies to protect them throughout their lifecycle. In a previous article, we looked at the nuances of using BYOD concepts when using personal devices for work purposes, which complements the topic at hand today and can be used in conjunction with each other when building a secure mobile device management process within a company.
NIST SP 800-124 highlights the fact that mobile devices are compact and pervasive among users and frequently used outside of the corporate infrastructure, which presents additional specific threats such as loss, theft, damage, failure due to improper updates, malicious viruses, and privacy violations due to applications or user actions.
NIST Special Publication SP 800-124 lists current threats to mobile devices and technologies, including the following:
1. Cyber threats to the use of mobile devices for enterprise users:
1.1 Exploitation of vulnerabilities in mobile devices, the number of which increases with the variety of device models and manufacturers, firmware, and applications.
1.2 Loss or theft of devices, which is explained by the use of smartphones and tablets on the road, business trips, hotels, in various locations.
1.3 Access to the company's information resources from an insecurely configured device or using unverified applications installed by the user intentionally, accidentally or as a result of a hacker attack.
1.4 Theft of credentials as part of a phishing attack (entering login and password on a web resource controlled by an attacker, a link to which is sent via text message, messenger or email).
1.5 Installation of fake digital certificates as a result of phishing, physical attack, accidental or intentional adoption of a fake security profile, which may lead to false security confirmation of a malicious web resource or application.
1.6 Use of untrusted devices, such as personal or purchased through unofficial channels, which may be rooted, reflashed, or contain software and hardware tabs that reduce device security and allow unauthorised exposure of corporate resources.
1.7 Interception of data transmitted via wireless channels between the device and the company's information systems (Man-in-the-Middle (MitM) attacks). 1.8.
1.8 Malicious mobile software that may be installed by the user intentionally, accidentally or as a result of a hacker attack. Any app installed from outside the corporate app shop should be considered untrusted by default.
1.9 Information leakage due to incorrectly configured device screen lock (weak or missing pin code or unlock password), displaying notifications on a locked screen, performing actions without unlocking the device.
1.10. Violation of employee personal data privacy by collecting sensitive information (geolocation, search queries, access to microphone and camera, etc.) via corporate applications, as well as via third-party applications. If personal data of employees is collected and processed via corporate devices, all legal requirements governing such actions must be met.
1.11. Data leakage due to synchronisation of corporate mobile device data with a third-party cloud service (e.g. Apple iCloud, Google Drive, Yandex-Disk, etc.) or with an untrusted physical device (e.g. personal laptop).
1.12. Risks of ‘shadow IT’: independent use by employees of information systems or services not previously agreed upon by the IT/IS Departments, as a result of the inability to agree on the use of necessary systems or as a result of greater subjective convenience of third-party solutions.
2. Cyber threats to enterprise mobile device management systems (EMM class solutions - Enterprise Mobility Management):
2.1 Exploitation of vulnerabilities in EMM platforms that run on standard software and hardware that potentially contain bugs and vulnerabilities.
2.2 Theft of credentials of EMM-platforms administrators with the possibility of unauthorised access to information about devices, disconnecting them from corporate resources, deleting information from them.
2.3 Unauthorised use of EMM-platforms by an insider with extended authority to obtain device data, allow the use of unauthorised applications or devices, and reduce IS requirements.
2.4 Installing malicious EMM applications (agents) or EMM profiles on devices, which can lead to unauthorised access to device data and functions by an attacker.
To improve mobile device cybersecurity, NIST SP 800-124 suggests the following steps:
1. Conducting IS threat analysis and modelling for mobile devices and the information systems they access. Threat modelling should include identifying assets, vulnerabilities, protection measures, quantifying the likelihood of successful cyberattacks and their negative impact, with further analysis of the need for additional protection measures.
2. Implement mobile technology cybersecurity technologies such as Mobile Device Management (MDM), Enterprise Mobility Management (EMM), Mobile Threat Defence (MTD), Mobile Application Vetting (MAV), Data Loss Prevention (DLP). MDM and EMM systems are designed to manage mobile devices (corporate and personal, used for business purposes), to set up security configurations for such devices, to control and provide access to corporate data based on information about the device security status, to monitor the device IS status (malicious activity, unupdated OS, rooting the device, security of the connected wireless network). MTD class systems can detect malicious activity at the OS or application level, identify vulnerabilities in software or device configurations, and report connections to malicious web services or unsecured networks. MAV class solutions allow auditing the security of applications and software libraries used in an organisation to identify vulnerabilities, unsafe configurations, obsolete components and further remediation of the identified flaws (notification of developers, prohibition to publish a vulnerable application in the corporate ‘shop’, remote shutdown or uninstallation of the application on devices). DLP systems are designed to protect against data leakage, including from mobile devices, so DLP components for Android and iOS are an important component of the corporate cybersecurity system.
3. Control over the life cycle of mobile device deployment and operation, which consists of deciding on the device ownership model (corporate, corporate with personal use, BYOD model), selecting device models and EMM/MDM solutions, conducting risk assessments, configuring devices and EMM/MDM solutions.
4. Conduct a pilot of the selected mobile device security management solution in a lab or test environment with a small group of users. Usability, security functionality, authentication methods, application and management console functionality, performance and audit log details should be evaluated, in conjunction with closing the company's requirements to minimise the cyber risks of using mobile devices.
5. Secure all new mobile devices before issuing to the user and granting access to corporate data. Before a device is handed over to an employee, it must undergo an enrollment process during which the device is subject to a security profile (a set of security settings), the basic settings of which are typically offered by EMM/MDM vendors, but fine-tuned to meet the company's specific IS requirements. Based on the results of the cyber risk assessment of mobile devices, a decision can be made to install additional security solutions (MTD, MAV, DLP) on them.
6. Mobile OS, firmware and application updates should be proactively performed, taking into account the speed of development and application of exploits for new dangerous vulnerabilities (especially 0-day and 0-click classes). EMM/MDM class solutions can inventory OS, firmware and applications to ensure patch management processes are in place.
7. Maintain the security posture of mobile devices by conducting regular assessments of device compliance status against applicable cybersecurity policies, processes, and procedures. Assessments can be conducted passively (by analysing audit logs of EMM/MDM systems and the devices themselves) and actively (by conducting vulnerability scans and pen-tests of the company's mobile infrastructure). Operational processes include checking and installing patches and upgrades; synchronising time on devices and IT infrastructure; receiving, centrally collecting and auditing logs from mobile devices; reconfiguring logical access control systems when necessary; and identifying and logging device and EMM/MDM infrastructure anomalies, including unauthorised changes to security policies or configurations. In addition, it is important to maintain an inventory of devices and applications, revoke or remove dangerous applications, and delete sensitive information when a device is lost, stolen, or transferred to another user.
