6 Tips to Secure Mobile Devices in Your Organization

An iPhone is seen in Wash., on Feb. 17, 2016. (Carolyn Kaster/AP Photo)

Mobile technology can be an excellent tool for productivity and convenience, but it also poses security threats. So be aware and watchful.

Smartphones are all around us, and people use them for work every day. Mobile technology can be an excellent tool for productivity and convenience, but it also poses security threats. CheckPoint’s Mobile Security Report 2021 found that nearly all organizations (97 percent) were affected by mobile threats in the last year.

Forty-six percent of these organizations had to deal with employees downloading malicious apps—not on purpose—but merely due to their mobile phones or watches.

Cybercriminals and other threat actors are attracted to major mobile platforms. However, it isn’t easy to ensure security in a sea of third-party apps that are made for easy connectivity. As a result, InfoSec professionals and IT departments are trying to find the right balance in mobile security. The right balance for you will allow employees to enjoy mobile devices while minimizing risk.

Secure Mobile Devices

Every company should have a strategy to increase mobile device security. There are many prominent places to begin. These suggestions are not as complicated as you think; just start as soon as possible.

Learn All You Can About Phishing (Email), Smishing (SMS Text), and Other Criminal Methods

Smartphones do not have anti-phishing filters, antivirus, or spam filters like most email clients. In addition, mobile phone carriers don’t inspect embedded URL links. As a result, these bogus links can be clicked by users, opening the door to trouble if they are connected. It may seem like this is fine—but you won’t think so if your system happens to be hacked in your company system.

By design, text/SMS messages can be weakly authenticated. To verify their identity, users cannot quickly check the domain. SMS messages could arrive via spoofed, borrowed,/shared phone numbers. URL links are usually a sign of phishing scams. However, malicious senders can disguise them using URL shortening services (like TinyURL and Bit.ly) to conceal the source.

Your people should suggest that they first expand the URL by using a URL expansion service (like Urlex and ExpandURL). If you are familiar with what to look out for—smishing attempts can be easily detected. They should be ignored, deleted, or reported by users.

Update and Patch Your Software Regularly

There are always new vulnerabilities and exploits that can be discovered in your business. Therefore, it is essential to ensure that all software used in your company’s mobile device management (MDM) system is up-to-date quickly. Mobile device management (MDM) tools you use for managing mobile devices must be updated, often with the most recent security updates.

When choosing apps or platforms to use, it is essential to consider the speed and effectiveness of security updates.

Provide Guidelines to Employees

Social engineering attacks are often responsible for malware infections. According to the FBI, Phishing was the most preventable cybercrime in 2020. Phishing had nearly ten times as many complaints in 2020 than in 2017. Where will it go in 2021? Phishing is a common technique to trick users into giving up their passwords or confidential information—or even money.

This includes fake website fronts, hidden links, files, and SMS messages that look like legitimate requests from Amazon, UPS, and your credit card.

These attacks are less effective if employees have been trained and taught how to spot the danger signs. Regular education will give people the knowledge and skills they need to recognize phishing/smishing attempts. Make sure that training is supported by basic guidelines that set off an alarm and report on findings. You can explain what you want and then reward and encourage vigilant employees.

Employ Proper Authentication

Although everyone is aware of the importance of password security, it isn’t enough. Multi-factor authentication (MFA), which includes one-time passcode generation via email or text, is an additional step.

Modern mobile devices have biometrics as an additional authentication method. Employees can’t lose or forget their fingerprints. They are unique and always with them. Facial recognition and fingerprint scanning can be used to add an extra layer of security to log in to company systems.

Advanced authentication methods include adaptive or contextual approaches that use the IP address, device location, and user configuration to authenticate logins to company systems.

The Clear Distinction Between Personal and Work

Management is complex because of the blurring between personal and company mobile devices. Managing third-party apps, lockdown devices, or force updates may prove challenging if the company does not have the device. It would be best to consider separating work and personal apps, creating clear policies about mobile device usage for work, and using virtualization and mobile gateways to limit what lives on other mobile devices.

Check Your Mobile Security Strategy

It is dangerous to wait for an attack to determine if your strategy is working. Regular security audits should be conducted and outsiders hired to test your defenses for vulnerabilities. To ensure that employees know your security procedures, they should be tested using mock smishing and phishing campaigns.

A snapshot is all you have. Plan a continuous program, and ensure that the results feed into a mitigation plan. You should assess your response to incidents. This includes testing as well as real-life issues. Make sure you take all the lessons learned from these incidents. Every test and every real-life incident is a learning opportunity that will help you improve your overall strategy.

By Howie Jones