Mobile Security Best Practices

As mobile devices enter the work place, there is no denying their potential for improving and streamlining work processes. Companies are utilising enterprise apps that are unique to their businesses, and employees are taking full advantage of the benefits that accompany mobile business. However, with the conveniences of mobility comes the mounting threat of mobile security threats. The more that employees and contractors use mobile devices to access organizational systems, applications and data, the more important it is to protect such access.

Mobile Devices at Workplace

Traditionally, Organizations used to distribute Blackberry devices to their employees and setup the restrictions at Blackberry Enterprise Servers (BES).

Gone are those days; now Organizations are distributing high end SmartPhones to their Executives. Quite a good number of lower level Executives and Employees/Contractors bring their personal SmartPhones, which are connected to the Corporate Network.

These phones/tablets have different Operating Systems, like Android, iOS, Windows 7 or 8 etc. and have sufficient enough computation and capabilities to hack or cause nuisance.

Types of Applications

There can be multiple classifications of mobile applications-

1. Native v/s WAP v/s Hybrid apps.
2. Apps developed for inhouse employees v/s Apps developed for consumers.
3. Free v/s Commercial apps.

Threats to Enterprises

Data is the critical asset of Enterprises. Below threats pose risks related to data compromise via mobile devices-

1. Lost devices.
2. Temporarily unattended devices.
3. Malwares/Rouge Applications in devices.
4. Devices under control of remote attackers via internet, Bluetooth, NFC etc.
5. Jailbroken or Rooted devices.
6. Leaked Domain Credentials for WPA2-PEAP WiFi.
7. Lacking accountability or traceability for mobiles in enterprises.
8. Missing/Mis-configured encryption for data at rest and transit.

Mobile Application Development Security

Most vulnerability in the mobile applications, result from bad programming and can be avoided by following few quick tips, by all developers irrespective of their development platform:

1. Do not hardcode secrets like passwords, encryption key in the client side source code.
2. Do not store passwords or other sensitive data in the phone.
3. Use SSL for sensitive data transfer.
4. Use appropriately strong encryption for data at rest.
5. Authenticate users, sanitize inputs and manage sessions appropriately.
6. Do not print/store sensitive data in console, logs or cache.
7. Check security of 3rd party libraries in use.
8. Secure the backend components (web servers, web services and hosting).

Mobile Device Security

Here are the few tips for end users to keep the mobiles/tablets secured:

1. Set a password lock (numeric or graphical).
2. Set Device auto-lock.
3. Install a good anti-virus.
4. Keep the device firmware updated.
5. Pair only to trusted Bluetooth devices or NFC peers.
6. Always download applications from trusted App Stores.
7. Visit HTTPS secured and reputed websites only.
8. Do not jailbreak or root your device.
9. Connect to secure/trusted WiFi networks.

Additionally, few tips for enterprises to safeguard their employee mobiles and data:

1. Use Disk Encryption for mobile devices.
2. Employ Disk Encryption for SD cards too, if users store corporate date there.
3. Secure WiFi with strong WPA2 PEAP (Domain based) or Certificate based authentication.
4. Employ remote data wipe.
5. Use mobile device data backup solutions.
6. Maintain an inventory of user devices allowed to connect to corporate network.
7. Maintain an inventory of allowed mobile applications for work.
8. Have a fair usage policy and systems to control usage.
9. Enterprises having their private AppStores, must take care of distributing secure applications only.

BYOD as an opportunity for Enterprises

BYOD concept allows employees to use their devices at work and BYOD Solutions allows enterprises to control the Employee device security by building restrictions, controls and policies around it. Different BYOD Solutions offer variety of security features. Some useful ones are-

1. AppStore owned by Employers, for providing work related apps to employees.
2. Unified security policies enforcement across organization.
3. Access control and auditing.
4. Selective data wipe for corporate data.
5. Certificate Authority and Certificate based security.
6. Secure file sharing.
7. Device Registration mechanism.

Conclusion

A lot a have been spoken and written over time on mobile security. OWASP runs a mobile security project, NIST has released Mobile Device Security Guidelines for Enterprises, hacking and security companies have release free and paid tools for mobile app security assessments, apart from the commercial MDM solutions. Adaptation of all of these approaches in tandem is necessary to implement security by “defence in depth” approach.

Three final tips to Enterprise Mobile Security. Firstly, harden the mobile devices; encourage users for the same, go for forceful implementation if required. Secondly, ensure that mobile applications are secure via SAST and DAST approaches. Finally, implement a suitable BYOD solution and setup security policies for end users.