The pandemic situation requires governments to actively enjoin companies to set up remote working.
To keep up as much as possible with activities, enterprises are issuing additional corporate-owned devices or enabling BYOD usages multiplying access points to corporate data.
If some companies are actively using this way of working and have implemented all security gates to protect data beyond the enterprise perimeter, others have to rush things.
Securing the mobile environment is key when enabling working from home. Indeed, if we have witnessed in recent days an upsurge of solidarity and ingenuity, the situation unfortunately triggers malicious activities to redouble. For example, a coronavirus tracker application that offered to map the spread of the virus turned out to be a ransomware[1].
Pradeo is committed to support companies during this crisis and would like through this article to provide all the key insights to quickly set up mobile security at individual and corporate levels. You can also watch the webinar we held on the topic here.
Individual best practices to relay to the workforce
Mobile threats act on 3 different layers, starting with applications, network and device. Some simple rules could be followed at the individual level to reduce attack opportunities.
Applications
Applications are the privileged media for cybercriminals to run attacks because of their outreach and easiness of deployment.
Therefore, collaborators must pay greater attention to applications that are hosted on their devices.
Here are the core principles to apply individually :
- Banish the downloading of apps from 3rd party stores. The case related hereabove is a blatant example.
- Watch out for requested permissions. Users might carelessly grant permissions to applications. Yet, it happens more often than may be imagined, that permissions are not all required for the proper functioning of the application but requested to collect and sell data mainly to marketing companies. When using a mobile device for corporate purpose, users have to be diligent with apps’ permissions to prevent from data leakage (contact list, SMS, call log, …).
- Rigorously update applications. Malicious applications can still be downloaded from stores despite security measures implemented by Google and Apple and are usually removed as soon as they are detected. By enabling applications auto-update in the store settings, obsolete apps will be deleted and the user will benefit of new releases right away.
Network
When working from home, network connection is key to run its activities: retrieve and send e-mails, access to corporate resources (files, contracts…) and applications (intranet, CRM, messaging…).
It usually often involves to rely on a network connection other than the cellular one. Here also are some core principles that must be followed:
- Use a known private WiFi network. To prevent from any transaction interception, collaborators have to connect to their own WiFi network and avoid any next-door public connection facilitating Man-In-The-Middle attacks.
- Do not tweak the connection. Whatever the bandwidth capacity, it’s never enough and users may be tempted to try to improve their network performance downloading for instance a shady application.
OS
The device itself represents a target for hackers which are looking for breaches to take control on the system. Basic actions can be taken to strengthen the OS:
- Do not root or jailbreak the device. Extra capabilities unlocked when jailbreaking or rooting a device are leveraged by cybercriminals when perpetrating an attack. Thus, 75.1% of applications are checking this status to run advanced commands.
- Keep the OS up to date. Updates have to be strictly applied as they usually embed a security patch fixing knowing vulnerabilities.
Company straightforwardly actionable levers
If the best practices previously mentioned help limiting attacks, mobile devices of remote workers are still exposed to threats and endanger corporate data.
Pradeo Security Mobile Threat Defense ensures automatic and real-time protection of mobile devices. To support companies deploying secure remote working during the Covid-19 crisis, Pradeo is making its mobile security services available for free.
Through our Mobile Threat Defense solution, the security of mobile devices can be quickly implemented through the 2 options below:
- Automatic protection of devices from malicious and leaky applications
If your company has an Enterprise Mobility Management (EMM) solution in place such as VMware Workspace ONE, Microsoft Intune, IBM MaaS360, Mobileiron… we can plug our Pradeo Security solution in a matter of minutes and provide a security assessment of all applications hosted on the mobile fleet. Security measures can be dynamically enforced within the EMM solution to blacklist non-compliant applications and setup conditional access to corporate resources depending on the security status of the device.
- Ensure on-device real-time security
As soon as the Pradeo Security agent is installed on devices, it transparently checks in real-time apps, network and device layers and triggers security measures in case of threat. It could be either deployed on devices using the EMM solution in place if any or directly downloaded from the store. The security policy is already defined by Pradeo depending on the sensitiveness of the company to provide a ready-to-use complete solution for mobile workers.
