A Lightweight Approach to Mobile Security

In a post last week, I summarized some of the reasons that mobile security is hard for enterprises. The Gartner-defined approach known as Mobile Threat Defense, or MTD, has been widely agreed to as the best practice for mobile security. This approach, while comprehensive, represents heavy lifting for most enterprises. Let's unpack that before exploring what might represent a more reasonable, lightweight approach for getting started with enterprise mobile security.

MTD, as defined, has the following four general requirements:

1. Device behavioral anomalies — MTD tools provide behavioral anomaly detection by tracking expected and acceptable use patterns.
2. Vulnerability assessments — MTD tools inspect devices for configuration weaknesses that will lead to malware execution.
3. Network security — MTD tools monitor network traffic and disable suspicious connections to and from mobile devices.
4. App scans — MTD tools identify "leaky" apps (meaning apps that can put enterprise data at risk) and malicious apps, through reputation scanning and code analysis.

Most vendors propose to address requirements 1, 2, and 3 above with on-device apps, or agents. Item 4, app scans, is generally addressed through an Enterprise Mobility Management (EMM) integration or a proprietary MDM server, either of which must be deployed and managed by the enterprise IT staff (although many enterprises may already have an EMM deployed).

Requirements 1 and 2 are focused on malware detection. As I've outlined in prior posts, while mobile malware represents a real risk to individuals due to the threat of identity theft, financial fraud, ransomware and spyware, it is only a negligible enterprise threat. Requirement 3, network security, has been highlighted by vendors as critical to preventing WiFi-based man-in-the-middle (MiTM) attacks with real-time detections for SSL stripping and rogue access points. But, again, such attacks are far more of a threat to individuals than enterprises. Think about it this way: A MiTM attack against mobile devices is essentially the same as a MiTM attack against laptops, which have been used in coffee shops, hotels, airports and other public spaces for more than a decade prior to the wide adoption of smartphones. How many enterprises were breached due to MiTM laptop attacks against enterprises? None that have been publicly reported. And how many commercial solutions exists to protect laptops against MiTM attacks? None that I can find. The evidence suggests that the need for protection against mobile MiTM attacks is vendor-generated hype rather than a response to real risks to enterprises. And feedback from enterprises attempting to deploy network security approaches suggest that the current generation of products in this space are rife with false positives--a huge burden to IT staff, and something that leads to loss of trust from users.

Because MTD requires enterprises to deploy a mobile app on all users' mobile devices, it imposes challenges from both an operational and employee relations perspective (enterprises routinely receive push-back from employees due to concerns about corporate surveillance as well the many questions they will have regarding the app). Furthermore, MTD solutions remediate risks by requiring employees to delete apps that violate corporate policies their personal devices, even if those apps are not used at work. For example, an employee or contractor might be required to permanently delete a gaming, social network or messaging app that the individual might otherwise use and enjoy often. That's a tough sell, and can lead to employee resentment and dissatisfaction--and creative attempts to circumvent controls.

In summary, MTD is a heavyweight approach to mobile security due to the fact it's orthogonal to the existing security infrastructure, requires a complex integration with EMMs, introduces a new system that requires management and operational responses, and involves convincing all employees, contractors and other users to deploy a mobile app that performs on-device security functions (hopefully with minimal battery drain) and which may require employees to delete beloved apps from their personal device. This is the reason MTD can be characterized as requiring heavy lifting for enterprise mobile security.

An App-Centric, Lightweight Approach to Mobile Security
Are there other approaches to securing mobile devices in the enterprise that don't require mobile apps deployment or EMM integrations? Unfortunately, there are no commercial products that I'm aware of. I therefore believe there's an opportunity for vendors or enterprising startups to fill the solution gap between doing nothing and adopting a heavyweight solution. I'll outline the main characteristics below.

First, I think the issue of mobile security is largely an issue of mobile app security and requires an app-centric approach. The device and network threats, while real, are less of a threat to enterprises than vendors and the trade press would have us believe.

Second, the unfamiliar terrain of mobile security concepts represents a new strain for IT security staff in having to master concepts regarding EMM capabilities and operational aspects of integrations with MTD solutions.

Third, it would be ideal if a mobile security solution leveraged current enterprise security infrastructure rather than having to introduce a new platform. Most enterprise security today is based on identifying threats that come from specific external sites as identified by IP addresses. Threat intelligence, employed by many enterprises, includes a list of IPs that should be blocked, and the ubiquitous firewall is the primary security solution for accomplishing that.

If an enterprising vendor developed a mobile threat intelligence feed, that could be used to provide a reasonable level of protection within the enterprise.

The ideal feed would include endpoints and servers associated with malware campaigns which could be blocked by a firewall or other perimeter security solutions (while as noted above this is a negligible threat to enterprises, blocking those connections would be a relatively trivial task so the cost/benefit ratio is positive).

In addition, the mobile threat intelligence feed would identify apps' network connections that leak data contrary to corporate policy. Of course, each enterprise has different criteria for developing such policies, so the feed should include enough meta data so that connections could be selectively blocked based on the nature of the data leakage risk.

The vendor providing such a feed would have to analyze the connections from all apps available from Google Play, the App Store, and any other sanctioned app stores. This is simpler than doing a full behavioral analysis of the apps. A higher level solution would classify connections based on the type of data being leaked. I believe the apps' network connections could be categorized as follows:

• backend: the servers that the app connects to for cloud-based computation, aggregation and persistent storage
• auxiliary:  the third-party servers that provide auxiliary services to the app, such as outside temperature or a map overlay
• marketing frameworks: the third-party servers, such as Flurry,  that provide app use analysis and some forms of surveillance to precisely identify characteristics of the user, usually for input into big data algorithms for ad networks
• ad networks: the third-party servers and related infrastructure for serving ads (and sometimes malvertising) to the mobile device

The mobile threat intelligence feed, with meta data for each IP identifying the source app and which category the connection falls into, would give enterprises enough data to provide lightweight security to their mobile devices, both COPE and BYOD.

Here are some use cases that could be addressed with such a solution:

1. Malware protection: block all connections to/from malicious sites. Note that blocking of such connections would only be performed while the mobile device is on the corporate network; when the employees go home no further protection would be active unless a VPN is used. However, this is exactly the paradigm in place for laptop protection, when employees take their laptops home. When accessing enterprise resources remotely, a VPN is almost always required, and malicious IPs would be blocked.
2. Data leakage: block all connections, based on policy criteria. For example, apps that send address books could be blocked. The enterprise wouldn't know which are the offending apps necessarily (although a mature solution would have the option to query that). Note that the blocking of those connections prevents data leakage without having an on-device agent and without requiring any action on the part of the user. The user experience would simply be that the app would fail to work normally. If it's not a work-based productivity app, the employee really has nothing to complain about except having to wait until they get home to play games or engage their social network. Maybe productivity will improve!
3. Advertising: while employees using apps that receive ads isn't generally considered a threat, does an enterprise really want content from any one of hundreds of as networks sending data into their secure environment? And while ad network malware, known as malvertising, is rare, that would be prevented by blocking all advertising connections.

Note that with such a solution most of the MTD deployment and operational challenges are not present. No EMM integration is required. No mobile apps or agents need to be deployed on all users' devices, and employees are never asked to delete apps from their device. Some personal apps that violate policy may not operate correctly while employees are at work, but that's hardly something they can complain about.

A specialized mobile threat intelligence feed could represent an enterprise's first step into mobile security. Based on how the threat landscape evolves, and how MTD solutions mature over time, there's nothing to preclude adoption of MTD at some future date.

I haven't done an exhaustive search of the many threat intelligence feeds available today. It's possible that one or more are already covering mobile connections to some extent. And I don't know for sure that existing MTD vendors aren't exploring lightweight options similar to what has been described above. Hopefully the enterprises that have opted not to procure MTD due to its cost and operational burden may find a lightweight approach to mobile security in the near future.

We're All Under Attack!! Buy My Product Now!

It is generally the role of security vendors to alert potential customers as to the dangers from certain threats, namely threats that the vendors' products provide protection for. There's a fine line between education and scare tactics, and sometimes the desire to make a point can cause that line to become blurred.

Which brings us to an article published last week entitled Mobile Malware Incidents Hit 100% of Businesses. The article describes research by Check Point that may or may not confirm our worst fears: Every enterprise has experienced mobile malware attacks.

Furthermore, Check Point's research also revealed that "89% of organizations experience a least one man-in-the-middle incident stemming from users connecting to a risky WiFi network." Well, that's a relief, I was worried that the figure would be 11 percent higher.

Now, let's ask ourselves a question: Where's the enterprise breach that resulted from either mobile malware or man-in-the-middle (MiTM) attacks?

That's okay, take your time. I can wait.

Still waiting.

Maybe the answer is that mobile malware and mobile MiTM attacks represent only a negligible risk to enterprises. As we've noted previously, while there's a significant risk to enterprises from use of mobile apps that leak corporate data, mobile malware is almost exclusively a threat to consumers--not enterprises.

Yes, the term "malware" connotes real risk to enterprise desktop and infrastructure systems, and has been the cause of breaches from Target to Home Dept to Sony to Equifax. But mobile malware is different, and while trojans (otherwise called fake apps or camouflage apps) can perpetrate financial fraud against you or me, it has not yet shown itself to be a threat to enterprises. Mobile ransomware can lock up an individuals files and lead to temporary loss of functionality by a single user. However, mobile ransomware is not a threat to enterprises in the same way ransomware that locks up hospital servers is. Other mobile malware that perpetrates toll fraud and click fraud are annoying, but hardly existential threats to enterprises.

Mobile malware should be considered in two categories: broad-based attacks; and targeted attacks. The examples cited above, including trojans and ransomware, are broad-based attacks, aimed at a large population of users. An example of a targeted attack is Pegasus, which we know has occurred in the wild at least twice, both times against political dissidents in the Middle East and Mexico. So far, no mobile targeted attacks have been publicly reported against enterprise executives or key knowledge workers.

So what's an enterprise to do to ensure their use of mobile is secure? Think about how to protect data that's accessed by mobile devices, and be aware of concentrations of user data in the cloud resulting from mobile use. In general, it's apps that access and manipulate data, and an app-centric approach is likely to provide the most value from a security perspective.

Interpreting Mobile Malware Headlines for Enterprises

Another week, another onslaught of scary mobile malware headlines. Whether it's a fake app on an app store (WhatsApp this week), a triple whammy attack, or just a theoretical exploit that hasn't yet occurred in the wild, the headline informs us that millions if not billions of users are at risk.

But are enterprises at risk? Yes, but rarely from mobile malware.

JR Raphael posted an interesting article at CSO that suggests we may be asking the wrong question if we're asking what's the best Android security app to protect ourselves from mobile malware attacks. In suggesting why third-party security is rarely the right answer, Raphael lists several points, including this:

Even if you do happen to encounter Android malware, it's highly unlikely to compromise corporate data

Mobile malware represents a threat, but mostly to the individual user. Not to the enterprise. Why? It's mostly because the major mobile platforms, Android and iOS, are really quite secure. As a result, attackers have limited options. The major mobile attack vectors are:

• ransomware
• trojan or fake app
• spyware
• toll and ad fraud

Toll and ad fraud are mostly an annoyance, but the other attacks can result in a ransom payout (or lost data), financial fraud, or identity theft. Such attacks can cause my privacy to be violated or my bank account to be emptied, but represents no threat to my enterprise's finances or infrastructure. Unlike in the enterprise desktop environment, cross-platform attacks that jump from the compromised endpoint into the soft underbelly of the enterprise infrastructure are rare and relatively unsophisticated. Therefore, while mobile malware represents a serious threat to consumers, there are no known cases where a mobile malware has led to a major enterprise breach.

It's unfortunate that we use the same term for mobile and desktop attacks. "Malware" in the mobile context refers to attacks with a blast radius of one; "malware" in the desktop context is an existential threat, with a potential enterprise-wide blast radius. Protecting against such exploits has been and continues to be the top priority of any enterprise, and we've seen cases where a enterprises business prospects are harmed and executives' careers are damaged.

So does this mean there's no threat resulting from mobile use in the enterprise? Hardly. As noted in prior posts, employee use of mobile devices in the workplace can lead to data leakage of privacy and corporate data that could reveal confidential initiatives, plans and strategies. But malware is not the threat here, it's mostly legitimate public store apps gathering far more data than most people realize. Stay tuned as we develop those concepts in future posts.

Mobile Data Leakage Versus DLP

Seth Hardy over at Appthority has an interesting post this week, discussing how a focus on malware protection can cause enterprises to miss the threat of data leakage from legitimate public store apps. And a new case study from Lookout, describing how their solution addressed customer objectives that include reducing customer data leakage risks, also addresses this emerging threat vector.

I see this as a positive trend, as more vendors and enterprises focus on what's important: protecting corporate data.

In talking about mobile data leakage, I find that people often confuse that with data loss protection (DLP). The issues are similar, in that they focus on data loss, but they address completely different problems. It's worth a brief outline of each threat scenario to clarify:

When enterprises talk about defense in depth, DLP often represents the last line of defense. If an attack breaches NGFW, IDS/IDP and CASB protections and eludes breach detection systems, it will ultimately attempt to exfiltrate data. DLP solutions are designed to detect and possibly block the exfiltration, and among other features it may recognize bulk transfer of SSNs or credit card numbers that have been aggregated in an internal data set. The large data set was the ultimate target of the attackers, who had to circumvent a number of enterprise defenses to access it.

Mobile data leakage is different. In this case aggregation takes place outside of the enterprise infrastructure in a backend server or a cloud storage system. The data set in this case may contain personally identifiable information (PII) for thousands of employees, or it may contain sensitive corporate information. This could be the backend for an app that was deployed enterprise wide, such as CRM, ERP, endpoint security, or an internal productivity app. If a malicious actor intends to access such sensitive information, it's far more feasible that a cloud server could be breached than that thousands of mobile devices could be successfully attacked with malware. And in this example, the enterprise-wide app has already done the heavy lifting of collecting such information into a single file system or database. There's ample evidence that mobile app developers can be lax when it comes to cloud-based storage security, so the threat is amplified due to the ease with which the database can be breached. That's why mobile data leakage is a rising concern.

The biggest challenge for enterprises is that use of mobile devices creates new threats to corporate data. Attackers usually choose the path of least resistance, and exposed data in the wild represents an easy exploit.

ADINT: Do It Yourself Surveillance

"If it's free you're the product." Most of us have heard this meme often enough, and have a vague understanding that it relates to online ads. But when most of us think about online ads, we think about the occasional annoyance of having to scroll past or otherwise ignore an ad—doing so is assumed to be the price of free online services, and it seems a small price to pay.

If only it were so simple.

Researchers at the University of Washington published a paper at the ACM Workshop on Privacy in the Electronic Society entitled "Exploring ADINT: Using Ad Targeting for Surveillance on a Budget." The subtitle is "How Alice Can Buy Ads to Track Bob." Yes, it's as bad as it sounds. The authors point out that for as little as $1,000, someone can use targeted ads to track the location of specified individuals. The mobile advertising infrastructure allows any attacker with modest means to to "know where the target goes, where they live, and other sensitive information such as what apps they use". Knowledge of what apps are being used can be considered sensitive for a variety of reasons, including mental health conditions, diabetes trackers, dating apps (which can indicate relationship or sexual preferences), political affiliation apps, and religious and church apps.

As I've pointed out before, most people think it's a reasonable trade-off to allow ads to be shown in order to get apps and services for free. But in order to deliver those ads, the ad networks need to learn as much as possible about all of us, so that advertisers know whether it's worth paying to target an ad to any of us (and when and where it should do so). Advertisers have enabled what we can refer to as a stalker economy. If you think it sounds creepy, you're right. And it's also ubiquitous, part of the background noise of being a mobile-phone using netizen. 

This is how Alice can buy ads to track Bob. But what is meant by "ADINT"? The authors invented this term, and I think it's a good one. Whereas the intelligence community refers to human intelligence as "HUMINT" and signals (electronic) intelligence as "SIGINT", the corresponding term for advertising intelligence has been coined by the paper's researchers as "ADINT."

Most of the focus on mobile security has been around malware and network attacks that deliver malware. But malware is rare, whereas the stalker economy, or ADINT, can affect us all. In my previous post, I noted that mobile devices send considerable amounts of data into the cloud, which is to say the data is now in the wild—outside of our ability to track and control it. ADINT represents another threat vector regarding the digital exhaust of our mobile devices. This should worry us.

Mobile Security: Focusing On What's Important

Often, it's what we don't know that gets us in the most trouble.

Conventional wisdom regarding mobile security in many enterprises is that it's not an urgent requirement. Many enterprises have convinced themselves that it's sufficient to implement policies to ensure that users don't root or jailbreak their phone, and that they only download apps from an official app store. With such policies in place, the CISO's mental image of their mobile security posture might look like this:

In actuality, their mobile security policy probably looks more like this:

The good news is the gate is closed--and locked! And, per security best practice the policy is publicly posted (Keep Gate Closed). Luckily, due to the security of Android and iOS, the mobile device is probably secure, as is the data on the device--despite the incompleteness of the mobile security controls.

But what about the data that leaves the device? How well is it protected by the locked gate?

Not very well, unfortunately. Most mobile device and their apps send considerable amounts of data into the cloud, and it's not obvious to most enterprises what data leaks from mobile devices into the wild--and how effectively the data is secured in the cloud. App developers have a financial incentive to report location and other personal data to ad networks, marketing frameworks, and apps' back ends when aggregation or persistent storage is required. Personal data might include device identifiers, phone number or email address, calendar and contact info, and app-related usage information. Ad networks are relentless in collecting as much data as possible to support the real-time bidding (RTB) process for mobile ad placements. And while most of this data leakage is privacy related, some can be used to inform an enterprise attack.

Meanwhile, we obsess over whether Face ID is better than Touch ID, and lament that the iOS 11 control center doesn't fully disconnect Bluetooth and WiFi. We breathlessly follow headline after headline making us scared over malware campaigns in Asia that truth be told represent little threat to the enterprise--in the unlikely event an employee's phone is infected (the employee, though, has plenty of reason to worry).

Multiple vendors have developed Mobile Threat Defense (MTD) solutions that address mobile security issues, each with their own unique focus. The MTD market is still in its infancy, and only a small percentage of enterprises have adopted and fully operationalized a solution. MTD solutions don't readily fall into typical enterprise security paradigms, and of course they compete for scarce dollars and security staff resources. As the world shifts to a "mobile first" focus, it will be interesting to see the degree to which MTD emerges as a major factor in enterprise security.