Mobile Security
Mobile security is the strategy, infrastructure, and software used to protect any device that travels with users, including smartphones, tablets, and laptops. Cybersecurity for mobile devices includes protecting data on the local device and the device-connected endpoints and networking equipment.
Threats
Physical Threats : There are two main physical threats to a mobile device: data loss and theft. Natural disasters are also an issue, which would be the cause of data loss but not data theft.
Application Threats: Administrators can block applications from being installed on a desktop, but a user with a mobile device can install anything. Third-party applications introduce several issues to mobile device security.
Network Threats: With mobile devices – especially bring-your-own-device (BYOD) – they create a threat for the internal network. It’s not uncommon for malware to scan the network for open storage locations or vulnerable resources to drop malicious executables and exploit them.
Web-Based and Endpoint Threats: Mobile apps connect to data and internal applications using endpoints. These endpoints receive and process data, and then return a response to the mobile device.
How to secure mobile devices
The requirements are to maintain and protect confidentiality, integrity, identity and non-repudiation. A secure mobile environment will offer protection in six primary areas: enterprise mobility management, email security, endpoint protection, VPN, secure gateways and cloud access broker.
Enterprise mobility management: EMM is a collective set of tools and technologies that maintain and manage how mobile and handheld devices are used within an organization for routine business operations.
Email security: To protect data from email-based cyber threats such as malware, identity theft and phishing scams, organizations need to monitor email traffic proactively. Adequate email protection includes antivirus, antispam, image control and content control services.
Endpoint protection: With technologies such as mobile, IoT and cloud, organizations connect new and different endpoints to their response environment. Endpoint security includes antivirus protection, data loss prevention, endpoint encryption and endpoint security management.
VPN: A virtual private network (VPN) allows a company to securely extend its private intranet over a public network's existing framework, such as the Internet. With a VPN, a company can control network traffic while providing essential security features such as authentication and data privacy.
Secure gateways: A secure gateway is a protected network connection, connecting anything to anything. It enforces consistent internet security and compliance policies for all users regardless of location or device type used, and it keeps unauthorized traffic out of an organization's network.
Cloud access broker: A CASB is a policy enforcement point between users and cloud service providers (CSPs). It monitors cloud-related activity and applies security, compliance and governance rules around cloud-based resources use.
