Mobile workforce security in today’s age of BYOD is no easy task. In the wake of the explosion of mobile devices, organizations are embracing mobile applications increasingly, as a way to improve productivity and to meet the employee requests to work anywhere seamlessly. There is one critical question that many users and organizations continue to overlook and that is ‘Are mobile applications secure and protected from the malicious hackers?’
However, new studies show that there definitely is some room for enhancement. As per a study for IBM, an average company tests less than half of the mobile applications it builds. Another 33% have never tested their applications for security before floating it in the market. This inequality could expose the data of the users to cyberattacks, which could empower the hackers to gain access to the treasuries of the personal and corporate data of the users.
Companies in huge numbers have adopted the BYOD (bring your own device) policies and 55% allow the employees to use and download the business applications on their personal devices. In addition to this, 67% of the companies allow their employees to download non-vetted applications for their work devices.
So how can you secure the mobile workforce in the age of BYOD? Start with the following steps to address the four key concerns:
Concern 1: Building Secure Apps
Mobile malware exploits the bugs or the vulnerabilities in the coding of the mobile applications. Applying the best practices to mobile application security, can help in making the mobile application resilient to such an attack. It is also very important to analyze the code from third parties, or any application that is allowed to coexist on the devices used by the employees. In such a case, the executable needs to be scanned.
This concern arises out of a growing trend of hackers to create fake application versions. Hackers can obtain a public copy of a mobile application, engineer it in reverse, place the malicious code in it and then re-deploy it in the market. Unsuspecting victims, then download and use the app, leaving their personal information and credentials exposed to the hackers.
Concern 2: Making Devices Risk-Aware
The security of an application is deeply impacted by the underlying security of the devices. An indiscreet device is one that has been adjusted by its owner or an unauthorized application to surpass the operating system security, in turn allowing the installation of any app and from any source. Such devices, known as rooted or jail broken devices are vulnerable to mobile malware. While many organizations prevent such devices from accessing the company networks, the jailbreak technology is surfacing to dodge this detection.
Even worse, the attackers using mobile malware don’t just rely on a jail broken device to facilitate the fraudulent activities. Users who allow excessive permissions for the mobile applications, though often by default, also provide a path for the malware to access the basic services like SMS.
To address these concerns, it is mandatory for all organizations to adopt technology that allows the device risk to be incorporated into the mobile application structure and detect mobile malware. Let's say, if an application is to execute a complex transaction and the device is jailbroken or rooted, then the app may elect against executing the task.
Fundamentally, by making applications ‘device risk-aware,’ organizations can confine certain functionalities, eliminate sensitive data, and avoid access to the organizational resources. Organizations should look into ways to test the security of the underlying device vigorously because the risk hosted by conceded devices is an often a disregarded aspect of mobile security.
Concern 3: Preventing Data Theft and Leakage
When mobile applications access the data, their documents are often stored on the device itself. If the device is lost, or if it is shared with non-business applications, the probability of the data loss is intensified.
Businesses should develop a selective remote wipe capability to erase the sensitive data from the lost, stolen or otherwise compromised mobile devices. Restricting this sharing of the organizational data with non-business applications can help prevent leakage of data.
Concern 4: Restricting High-Risk Access & Transactions
Mobile applications are built to work together with backend services. For instance, mobile banking applications allow the customers to transfer money to third parties, which mobile CRM applications enable the salespersons to update their forecasts and access the critical account data. By using the context and factors for mobile app security risks, it is possible to prevent or restrict the access to the organizational systems and delay the execution of the transactions.
