Although most people own a smartphone, not everyone understands the importance of mobile security and how failing to secure your phone or tablet could wreak havoc with your life and your finances.
Remote Workforce Management
With a large percentage of the population working remotely, even before COVID-19, mobile connections and data transmissions pose unique risks that individuals and companies need to be aware of.
When the average cost of a corporate data breach is $3.86 million, that’s a huge risk to take allowing employees to connect to workplace servers with untested, unsecured devices.
Dangers of Mobile Phone Usage
Although malware is what is on everyone’s mind, malware infections on mobile devices are far less prevalent than other types of dangers. However, as a company, you should require all remote employees to have good antivirus software installed on their devices if they are using them to connect to your servers. Other dangers posed by mobile devices are:
Vulnerable Apps
Not all users/employees download safe apps from the app stores. Downloading and installing any software on a smartphone opens it up to malware, spyware, or even ransomware. Many of these “free” downloads have a piggyback companion, which can be malicious.
Institute a policy of app download approval. Try to minimize the number of apps that users can install on their mobile devices that connect to the company. Your IT department can put rules into place preventing users from installing anything without approval.
Have a vetting policy to check out the solidity and security of all apps used by the entire organization. Your data is only protected if all vulnerabilities are removed.
Man-in-the-Middle Attacks and Data Exfiltration/Wi-Fi Issues
Do not let staff connect to public Wi-Fi hotspots at the coffee shop, mall, or airport. These places are ripe for man-in-the-middle attacks. If employees connect to your company while on public Wi-Fi, nearby hackers can use sniffers to grab login credentials, exfiltrate data, or install software onto their device or your network. Once the bad guys are in, they are in.
Social Engineering
Educate your employees on the dangers of social engineering. Fake ads that show up in social media, Google searches, and sent via email could pose a threat as well. Teach your employees that even though something looks like it came from a trusted source, never do anything until you check it out first. Verify the sender if it came through email, do not click links or respond to texts from unknown numbers, and operate on the defensive, always looking for suspicious things. If something sounds “too good to be true,” it probably is, walk away.
Phishing Attacks
Phishing attacks are one of the most common ways that companies get hacked. The weakest link is that one employee who receives an email (that looks like it came from the boss) clicks a link and provides the requested information. Only to find out that the boss never sent the email, it was from a hacker, and he or she handed over the login to the company vault.
When it comes to phishing attacks, education is your best defense. Show employees how to verify the sender of an email and create a policy that no one should ever click a link in an email. Even if it is from a legitimate sender, go to your web browser and log on from there.
Insecure Settings or Configurations
Although many of us are pretty good about keeping our devices up to date with the latest security patches, not everyone does. It’s critical to update the operating system on both Android and iOS mobile devices to keep them safe and secure. The privacy and security settings should also be set to the maximum settings to keep intruders out.
Routers or IoT Devices
Another area of concern is remote workers who work from their home network. Although they may be using smartphones or tablets to connect to company servers, they may also be using their home PC or Mac. The problem is many of these home networks are at risk due to insecure IoT devices or misconfigured routers and firewalls. Unfortunately, many of these items do not receive regular security updates, if at all. There are some smart TV remotes that are at risk of hacking also. Once a hacker is inside the employee’s home network, they can easily gain access to yours through the insecure connection. It’s not enough to just secure mobile devices but ensure that any connection to your corporate servers passes muster.
A Final Word on Mobile Passwords Security
The risk of letting even one cybercriminal into your corporate infrastructure could devastate your company and your life. The biggest risk of using mobile devices to connect remotely is weak passwords. By now, everyone knows the dangers, but not everyone follows the advice. When talking about security with your staff, stress the importance of using long, strong passwords on mobile devices along with multi-factor authentication to keep anyone except the mobile device owner out.
