Protect Mobile Protects Consumers--and Enterprises?

Deutsche Telekom announced a new service yesterday called Protect Mobile. How it works can be summarized by their headline: Security is now a job for... the network!

The service, developed in collaboration with Check Point Software, provides protection against network-based mobile threats. Here's a brief description of the service:

Protect Mobile protects smartphone owners from Internet dangers at home and abroad: the protective shield in the Deutsche Telekom mobile communications network identifies and deflects viruses, worms, and trojans automatically. In addition, Protect Mobile blocks dangerous websites within the Deutsche Telekom network. Apps are checked for security issues before they are downloaded. Whether during online banking, surfing the web or on social networks, with Protect Mobile, users are effectively protected against cyberattacks both on the go and in their home Wi-Fi network.

The protection is performed by the network upon enrollment (for under a euro per month). A mobile app, available from the App Store (iOS) and Google Play (Android) complements the network protection by displaying error messages, warning of risks and providing specific instructions regarding what the user should do in case of an error or a threat. Once the user is outside of the Deutsche Telekom network, the app provide on-device protection and raises alarms in case of threats and identifies them transparently. The primary goal of the app was ease of use.

This seems like a reasonable approach to providing mobile security across a broad swath of users. The security is strongest when using the Telekom network and the home Wi-Fi network. Presumably, protection when using non-Telekom Wi-Fi networks, such as in coffee shops, hotels, and airports, is provided via the Protect Mobile app. For most consumers, other than those who might be targeted by an attack, this level of protection is adequate and would prevent most mobile-based consumer threats such as financial fraud, ransomware, and identity theft.

But for enterprises within the Deutsche Telekom coverage area, if all of an enterprise's employees used Protect Mobile, it would provide relatively strong protection against most network- and device-based attacks. Does this constitute enterprise-class mobile security? Not exactly. As we've pointed out here, here and here, the stalker economy and data leakage are app-based threats--not network or device. Those kinds of threats put enterprise data at risk. For comprehensive protection, an enterprise would have to add protection against app-based threats to protect their data--and also to prepare for GDPR compliance in May.

Interpreting Mobile Malware Headlines for Enterprises

Another week, another onslaught of scary mobile malware headlines. Whether it's a fake app on an app store (WhatsApp this week), a triple whammy attack, or just a theoretical exploit that hasn't yet occurred in the wild, the headline informs us that millions if not billions of users are at risk.

But are enterprises at risk? Yes, but rarely from mobile malware.

JR Raphael posted an interesting article at CSO that suggests we may be asking the wrong question if we're asking what's the best Android security app to protect ourselves from mobile malware attacks. In suggesting why third-party security is rarely the right answer, Raphael lists several points, including this:

Even if you do happen to encounter Android malware, it's highly unlikely to compromise corporate data

Mobile malware represents a threat, but mostly to the individual user. Not to the enterprise. Why? It's mostly because the major mobile platforms, Android and iOS, are really quite secure. As a result, attackers have limited options. The major mobile attack vectors are:

• ransomware
• trojan or fake app
• spyware
• toll and ad fraud

Toll and ad fraud are mostly an annoyance, but the other attacks can result in a ransom payout (or lost data), financial fraud, or identity theft. Such attacks can cause my privacy to be violated or my bank account to be emptied, but represents no threat to my enterprise's finances or infrastructure. Unlike in the enterprise desktop environment, cross-platform attacks that jump from the compromised endpoint into the soft underbelly of the enterprise infrastructure are rare and relatively unsophisticated. Therefore, while mobile malware represents a serious threat to consumers, there are no known cases where a mobile malware has led to a major enterprise breach.

It's unfortunate that we use the same term for mobile and desktop attacks. "Malware" in the mobile context refers to attacks with a blast radius of one; "malware" in the desktop context is an existential threat, with a potential enterprise-wide blast radius. Protecting against such exploits has been and continues to be the top priority of any enterprise, and we've seen cases where a enterprises business prospects are harmed and executives' careers are damaged.

So does this mean there's no threat resulting from mobile use in the enterprise? Hardly. As noted in prior posts, employee use of mobile devices in the workplace can lead to data leakage of privacy and corporate data that could reveal confidential initiatives, plans and strategies. But malware is not the threat here, it's mostly legitimate public store apps gathering far more data than most people realize. Stay tuned as we develop those concepts in future posts.