The mass adoption of both consumer and managed mobile devices in the enterprise has increased employee productivity, but has also exposed the enterprise to new security risks. Our latest research is a deep dive into the current state of mobile device security. You can read the whitepaper in its entirety here.
More than anything else, the analysis shows that while the most popular mobile platforms in use today were designed with security in mind—and certainly raise the bar compared to traditional PC-based computing platforms—they may still be insufficient for protecting the enterprise assets that regularly find their way onto these devices.
Today’s mobile devices also connect to an entire ecosystem of supporting cloud and desktop-based services. The typical smartphone synchronizes with at least one public cloud-based service that is outside enterprise control. At the same time, many users also directly synchronize mobile devices with home computers. In both scenarios, key enterprise assets may be stored in any number of insecure locations outside the direct purview of the enterprise.
To get at the heart of this issue and start looking for a solution, the paper takes an in-depth look at the security models employed by two of today’s most popular mobile platforms: Apple’s iOS and Google’s Android. The goal is to better understand the impact these devices have as their adoption grows within the enterprise and share that knowledge. It defines the major mobile threats we’re seeing today—click here (PDF) to see our infographic—and analyzes the effectiveness of each platform’s in-built security features against these threats.
So, what did we find? Overall, our analysis showed that while not perfect, the iOS security model is well designed and has thus far proven largely resistant to most types of attacks. With regard to Android, while we believe its security model is a major improvement over the models used by traditional desktop and server-based operating systems, it’s not perfect either. Specifically, it suffers two major drawbacks. First, its provenance system enables attackers to anonymously create and distribute malware. Second, its permission system, while extremely powerful, ultimately relies upon the user to make important security decisions. Unfortunately, many users are not technically capable of making such decisions and this has already led to social engineering attacks.
It’s important for enterprises to remember that today’s iOS and Android devices do not operate in a vacuum—they’re almost always connected to one or more cloud-based services or to a home or work PC, or all of the above. With that said, when properly deployed, both Android and iOS platforms allow users to simultaneously synchronize their devices with both private and enterprise cloud services without risking data exposure. However, these services may be easily abused by employees, resulting in the exposure of enterprise data on both unsanctioned employee devices as well as in the private cloud.
Thus, it is imperative that enterprises seek to understand the entire ecosystem the devices used by their employees participate in, and then formulate effective device security strategies to mitigate the risk these devices create. This can seem like a monumental task, but reading our whitepaper is a great place to start!
By: Carey Nachenberg
More than anything else, the analysis shows that while the most popular mobile platforms in use today were designed with security in mind—and certainly raise the bar compared to traditional PC-based computing platforms—they may still be insufficient for protecting the enterprise assets that regularly find their way onto these devices.
Today’s mobile devices also connect to an entire ecosystem of supporting cloud and desktop-based services. The typical smartphone synchronizes with at least one public cloud-based service that is outside enterprise control. At the same time, many users also directly synchronize mobile devices with home computers. In both scenarios, key enterprise assets may be stored in any number of insecure locations outside the direct purview of the enterprise.
To get at the heart of this issue and start looking for a solution, the paper takes an in-depth look at the security models employed by two of today’s most popular mobile platforms: Apple’s iOS and Google’s Android. The goal is to better understand the impact these devices have as their adoption grows within the enterprise and share that knowledge. It defines the major mobile threats we’re seeing today—click here (PDF) to see our infographic—and analyzes the effectiveness of each platform’s in-built security features against these threats.
So, what did we find? Overall, our analysis showed that while not perfect, the iOS security model is well designed and has thus far proven largely resistant to most types of attacks. With regard to Android, while we believe its security model is a major improvement over the models used by traditional desktop and server-based operating systems, it’s not perfect either. Specifically, it suffers two major drawbacks. First, its provenance system enables attackers to anonymously create and distribute malware. Second, its permission system, while extremely powerful, ultimately relies upon the user to make important security decisions. Unfortunately, many users are not technically capable of making such decisions and this has already led to social engineering attacks.
It’s important for enterprises to remember that today’s iOS and Android devices do not operate in a vacuum—they’re almost always connected to one or more cloud-based services or to a home or work PC, or all of the above. With that said, when properly deployed, both Android and iOS platforms allow users to simultaneously synchronize their devices with both private and enterprise cloud services without risking data exposure. However, these services may be easily abused by employees, resulting in the exposure of enterprise data on both unsanctioned employee devices as well as in the private cloud.
Thus, it is imperative that enterprises seek to understand the entire ecosystem the devices used by their employees participate in, and then formulate effective device security strategies to mitigate the risk these devices create. This can seem like a monumental task, but reading our whitepaper is a great place to start!
By: Carey Nachenberg
