JT Keating of Zimperium explores essential tips to fortify your mobile security: combat phishing, avoid risky apps, be cautious with public charging, and stay vigilant against man-in-the-middle attacks. Ensure a safe and worry-free summer in the digital age.
In recent years – and in the light of large-scale global events like the Olympics in the rearview – mobile devices have taken center stage and become increasingly woven into the fabric of our daily lives. As a result, we’ve become mobile-first users—where mobile devices are our first choice for how we communicate, navigate, bank, take photos, shop, stay informed and work. However, our reliance on mobile phones is not without its risks. According to Zimperium’s Global Mobile Threat Report 2023, 43% of all compromised devices were fully exploited (not jailbroken or rooted), an increase of 187% year-over-year – an astonishing and frightening number.
With the summer vacation season in full swing, employees across every industry will be using their mobile devices for accessing travel and social media apps, staying connected using public WiFis, and powering up via charging ports while on the go, leaving them open to a host of mobile security vulnerabilities which could have detrimental consequences. It’s important to be hyper-aware that cybercriminals are always looking for employees’ personal and financial information and looking for ways to compromise an organization’s data. If traveling to EMEA through North America, it is important to know that these regions have the highest percentage of devices impacted by spyware, with EMEA at 35% and North America at 25%, according to the Global Mobile Threat report.
When working from home or at the office, employees are protected from bad actors as a result of robust cybersecurity solutions from internal networks. However, when on a trip or vacation, employees will use their mobile devices, increasing the risk of exposure to malicious actors. Furthermore, as the distinction between bring your own devices (BYOD) and corporate-managed devices continue to blur, its crucial employers and employees stay vigilant about the potential risks while traveling and take necessary steps to be as protected as possible. This piece will examine and provide tips for the top four security risks employees encounter this summer. It’s vital for business leaders, HR heads, and IT teams to urge employees to follow these four tips to ensure they, and as a result, their organization, aren’t at risk from cybercriminals.
See More: BYOD: A Threat to Data Security and Privacy Protection?
Don’t Take the Bait
Perhaps the most common type of social engineering attack, phishing, is used to steal user data like login credentials and credit card numbers. Malicious actors masquerade as a trusted entity and dupe people into opening an email, instant message, or text message. Triple-check the authenticity of every link and email. According to the Global Mobile Threat Report 2023, 80% of phishing sites target mobile devices specifically or are designed to function both on desktop and mobile. Moreover, the findings also showed that the average user is six to ten times more likely to fall for SMS phishing attacks than email-based attacks.
Don’t underestimate the power of employee security training. Get your workforce into the habit of checking the source of emails before opening attachments or images. There is great value in implementing antivirus and mobile security solutions, but the best line of defense will sometimes be an employee’s common sense! Depending on the nature of the phishing campaign, cybercriminals can quietly steal sensitive information over a long time or immediately lock users out of their devices, asking for a ransom. Educating your employees before any holiday on the types of phishing risks and how to avoid them will be a lifesaver for their information and the company’s data.
See More: How to Improve Employee IT Security Awareness
Don’t Get Juice-jacked
Mobile batteries will inevitably run out when traveling, and desperate times call for desperate measures. However, employees with company-issued phones should avoid public USB charging stations like those in airports and hotel lobbies. Instead, they should plug chargers into a wall socket or take a portable charger to recharge mobile devices. Malicious actors can secretly modify USB ports to install malware on phones or steal data.
Earlier in April, the FBI warned of hackers using public USB ports to infect, track and steal data from phones that quickly connect to them. The alert warned travelers to avoid free charging stations, instead bringing their USB cord and charger to connect to a wall outlet. When hackers successfully trick people into using fake WiFi networks and charging stations, they can compromise devices and install dangerous malware and spyware. In short, travelers should be wary of any free solution masquerading as a public service.
Don’t Fall Prey to Risky Apps
Using one mobile device to do both business and travel may seem harmless. Still, employees should think twice before installing several popular travel apps, as they can put both privacy and security at risk. Download apps from official app stores, avoid apps from unauthorized sources, research apps, and check reviews before downloading them. The Global Mobile Threat Report also found that both Apple and Android saw increasing instances of detected vulnerabilities. A 138% increase in critical Android vulnerabilities was discovered in 2022, while Apple iOS accounted for 80% of the zero-day vulnerabilities actively exploited in the wild.
You can’t expect employees – or anyone for that matter – to read the entire terms of conditions and privacy policy before downloading an app. However, there are key things to keep an eye on when skimming through. One of the most important is the app’s data collection practices. Mobile devices have begun to offer users more control over what data is collected – such as Apple’s App Tracking Transparency. Cultivating a workplace culture wary of lengthy privacy policies is still important.
Don’t Fall for a Man-in-the-Middle
Man-in-the-Middle (MITM) attacks are a form of eavesdropping where attackers interrupt an existing conversation or data transfer. Their main goal is to weave their way in to steal login credentials, account details, and credit card numbers. After inserting themselves in the “middle” of the transfer, the attackers pretend to be both legitimate participants. Be aware of digital surroundings to keep devices and information safe. Clear sloppy websites, and avoid streaming or downloading content from unofficial sites. Malware is often hidden in links on dubious sites.
A common MITM tactic is when attackers make free, malicious WiFi hotspots available in public spaces. Once an unsuspecting user connects to the hotspot, the attacker has full visibility into the exchange. Going back to juice-jacking, this is another reason why discouraging employees from using free public services for their mobile devices can help your organization avoid mounds of trouble.
Overall, it’s clear that mobile threats are becoming more frequent and dangerous as bad actors increasingly target smartphones as high-value targets. Mobile-powered businesses must increase mobile security measures to protect the personal data security of employees and the sensitive information belonging to the organization. By encouraging employees to follow these tips, business leaders, HR heads, and IT teams will have peace of mind this summer and the rest of the year, all while proactively lessening the risk from cybercriminals.
Don’t Scan Recklessly
QR codes offer a convenient way for employees to access information instantly, but they simultaneously make it simple for scammers to create malicious phishing traps. Scammers acknowledge that QR codes appear credible and are common in everyday life, such as in the form of discount prompts, payments, or WiFi. Leveraging the commonality of QR codes, scammers strategically place codes on visible public surfaces, as well as send them through text messages, emails, and social media. Those who fall into the trap are led either to a fake website or tricked into installing malware. As a result, the quishing attack could lead to employees giving away their sensitive information or downloading malware that enables attackers to spy, steal, or take control of a device.
The simplicity of these codes incentivizes employees to take the easy route, but they may not realize the severity of not understanding the tell-tale signs of quishing. Mobile-powered businesses must take the necessary steps to attack quishing risks head-onhead on. Raising awareness and educating employees internally on how to mitigate these risks and stay safe is the initial safeguard. Following up with detection tools and simulating attacks can add depth to both employee knowledge and backup protection. Scammers are always in search of loopholes and new strategies to attack. For this reason, it is crucial for companies to place emphasis on internal support in analyzing attack patterns, staying up to date on the latest techniques, and continuously evaluating their security solutions to refine new anti-quishing strategies.
The tangible consequences of quishing can be profound. Most quishing attacks are financially motivated. That being said, successful attacks have the power to compromise personal and corporate data, cause financial loss, and, in some cases, result in significant reputational damage to businesses. To minimize the risks, employees should have knowledge of quishing warning signs and stay suspicious—in other words, not trust any prompts they find unusual. Be aware of strange login attempts, financial charges, unfamiliar apps, and unusual battery drainage. If employees are skeptical or experience any of these signs, they should notify their security teams to promptly mitigate potential security threats. Swift detection and reporting of unusual activities enable security teams to respond efficiently, thereby reducing the potential impact of security breaches.
The rise in attacks on mobile devices is crystal clear. As scammers continuously evolve their tactics, it becomes imperative for companies to protect their employees and the sensitive business information they handle. The time is now to choose comprehensive mobile device security to stay ahead of cybercriminals and safeguard sensitive information.
Image Source: Shutterstock
MORE ON MOBILE SECURITY
link