Zero Trust and Mobile Security Explained

Mobile technologies have unquestionably invaded the workplace. Essentially, mobile devices provide numerous gains to businesses and employees by enhancing productivity and work flexibility. On the other hand, ensuring secure access to sensitive information from any mobile device is one of the biggest cybersecurity challenges. In 2020, mobile security threats affected 97% of companies through multiple vectors. Additionally, advanced persistent threat groups like Iran's Rampant Kitten execute sophisticate and elaborate targeted attacks on individual mobile devices to access and steal corporate data. 

Despite the increasing security threats, enterprises still encourage employees to access critical digital assets from anywhere using mobile devices. However, such access comes with multiple security risks necessitating companies to implement appropriate solutions. In this regard, most organizations are shifting towards a zero-trust architecture. As the term implies, zero-trust is an approach based on the principle that all devices and users are potential threats. Zero-trust security enables organizations to maintain and monitor the health of networks containing widely distributed endpoints. 

Mobile Security is a Growing Threat

In 2020, the COVID-19 pandemic disrupted traditional working methods causing a mass shift to remote working. As such, mobile devices have become ingrained as fundamental tools for ensuring business continuity. For example, more than 80% of small business owners rely on mobile devices to drive daily business operations. Besides, experts forecast that the trend will continue, with IDC projecting that 60% of employees will be fully mobile workers by 2024. 

On the downside, increased use of mobile devices expands the threat attack surface significantly. For example, Kaspersky detected 25,314 banking Trojans and 3,596 ransomware Trojans in mobile installation packages in the first quarter of 2021. Also, the 2021 Check Point mobile security report revealed the following mobile device threats:

• Malicious mobile applications impact almost half of the companies. At least one employee in 46% of businesses downloads harmful mobile software that can cause a data breach.
• Hackers have increased their use of mobile malware. For example, in 2020, there was a 20% rise in banking Trojans. Also, harmful cyber actors distribute mobile malware, such as Mobile Remote Access Trojans, disguised as apps for COVID-19 information.
• Four in ten mobile devices worldwide contain exploitable vulnerabilities. For example, inherent security flaws like vulnerable chipsets expose 40% of mobile devices to various attacks.

Importance of Mobile-Centric Zero Trust 

Zero-trust addresses the cybersecurity challenges arising from a perimeter-less work model while enabling access from anywhere, any time. In addition, a zero-trust strategy aims at authenticating multiple users and device attributes before providing access to protected digital assets. For example, to deter threats and unauthorized access; zero-trust models authenticate and validate the network requesting access; identifies and mitigates threats in real-time; determines the context under which a user or device is requesting access; checks mobile app authorization.

That said, organizations need to adhere to the following steps to achieve a robust mobile-centric zero-trust strategy:

• Provide devices with hardened security: Provision entails providing trusted users mobile devices with hardened security. The process entails ascertaining that the trusted devices contain secure and appropriate applications, policies, profiles. Utilizing a unified endpoint management software can enable companies to enroll and control users' mobile devices to access confidential data. More importantly, the solution enforces access policies based on user context and protects data residing on the devices.
• Develop appropriate access policies: A mobile-centric user or device access requirements consider the context of all access requests. For example, the access requirements must verify that a mobile app is authorized, determine the network type and security protocol, ensure the security posture of the mobile device is as recommended, and ensure the mobile device does not contain any threats.
• Enforce strong policies: Enforcing strict access and user authentication policies is key to realizing an effective zero-trust model. In addition, an organization must monitor the policies continuously to identify and mitigate malicious events. Moreover, the enforced policies must be aligned to maintaining compliance with mandatory or optional regulations and quarantining devices or users with questionable security or motives. 
• Robust protection: Upon developing and implementing required policies, a company must deploy suitable tools and software to hunt, detect, remediate, and prevent security threats. The security tool should comprise intelligent threat hunting, endpoint management, antimalware/antivirus, and network security monitoring solutions.

The Implication of Zero-Trust on Mobile Security 

Zero-trust extends beyond an identity-only approach used to authenticate devices and users. Many organizations are adopting zero-trust security as it is proving to be a reliable strategy for keeping threats to the business environment at bay. At least 60% of enterprises have accelerated plans to implement mobile-centric zero-trust security. However, with mobility growing rapidly due to remote and hybrid (a mixture of office-based and remote) working models, the attack surface is also growing rapidly. Therefore, attackers identify and exploit security loopholes in mobile devices to access internal networks and exfiltrate data. 

The good news, though, is implementing a zero-trust security model has several benefits and positive impacts on securing a network from mobile security threats. These include:

Network-Wide Visibility  

The best approach to protect company data is gaining visibility of devices and users accessing the data. However, it is a challenge for an organization to identify mobile security risks if it has no control over users accessing a network from any location using any device. Implementing zero-trust security provides network visibility of all devices and users, thus eliminating hindrances to risk identification and treatment in unmanaged mobile devices. Additionally, a zero-trust strategy can analyze file-less malware attacks and identify insider threats. Essentially, through increased visibility, a company can monitor risks in mobile endpoints and enable dynamic modification of users and devices that can access data securely.

Ability to Control All Access Requests 

A zero-trust strategy centered on mobile security enables IT administrators to enforce and adjust access controls for various risk profiles. For example, it is possible to apply multi-factor authentication (MFA) challenges to specific mobile devices. MFA mitigates challenges present in password security by requiring additional authentication items from users and devices before allowing access. Other controls like just-enough-access (JEA) and just-in-time (JIT) access provide access privileges to required data for a certain period. Such risk-adaptive controls protect data while enabling employee productivity and agility.

Mobile Device Management (MDM) Solutions 

Zero-trust security comes with essential MDM tools that permit IT admins to set various access policies for remote users using mobile devices. Also, adopting zero-trust platforms that combine MDM solutions and organizational mobile security enhances security across the business environment. The MDM solutions enable seamless management of mobile devices connecting to the corporate network, whereas enterprise mobile security protects against malicious apps and other mobile threats. 

Preventing False Positives to Ensure Operability 

A zero-trust strategy approach enforces mandatory security checks in all data or network access requests through threat detection solutions based on multilevel behavioral analysis. The primary aim of eliminating false positives is to precisely comprehend who or what requests network or data access and under which context. As a result, a zero-trust architecture can grant access to valid requests while denying illegitimate ones. In addition, since conditional access is automated to enable real-time processing, zero-trust approaches prevent inconvenient latency that can impact employee productivity or user experience, ensuring operability.