Preventing Attacks on Mobile Applications

By relying on mobile app development, brands across all industries provide a more convenient and user-friendly experience for their customers. 

On the other hand, the proliferation of mobile apps has increased the attack surface on corporate systems and increased business-oriented security exploits that cause financial and reputational damage to companies. In this context, securing mobile apps becomes a significant concern for enterprises.

To better understand the mobile security landscape, let's look at the security risks that affected consumer and enterprise mobile apps in recent years.

Phishing

Phishing is a type of social engineering attack where trusted individuals are reproduced or imitated to convince a victim to open a malicious link or message or to provide personal information otherwise. Phishing attacks originated in the 1990s and remain the most persistent security threat today.

In order for their exploits to successfully withstand evolving security mechanisms, hackers are constantly coming up with new sophisticated phishing schemes. Email applications would be an obvious breeding ground for phishing scams, but as companies implement filtering tools and users become increasingly wary of suspicious text messages, cybercriminals have had to diversify their delivery mechanisms. Moreover, most companies use the DMARC record generation tool to ensure proper authentication and email security. Recently, mobile apps have earned special attention.

As a result, 87 % of successful mobile phishing attacks occur outside of email, according to the Wandera 2020 Mobile Threat Landscape Report. Cybercriminals use social media, messengers, retail apps, productivity tools, and mobile games. CEO fraud is another new phishing scam, where cybercriminals impersonate senior executives and ask employees to make corporate fund transfers.

Why is mobile phishing especially effective? First, smartphone screens are smaller, so it's harder to see the difference between an official app page and a fraudulent one. People also tend to operate cell phones at higher speeds and automatically enter credentials. Moreover, many methods exist to mask malicious URLs and present them inconspicuously, such as Punycode or homoglyphs.

Malware

Malware is malicious software whose purpose is to gain access to sensitive data or disrupt the functionality of a device. Today, malware comes in many shapes and sizes: from adware, an intrusive but harmless solution that displays unwanted ads, to ransomware that steals sensitive data for ransom, to spyware that allows hackers to spy on the actions of the device owner.

Cryptojacking is a new type of attack that has already struck many through the mobile channel. This malware uses the resources of an infected device to mine cryptocurrency, draining its energy and resources. 

Wi-Fi connectivity

Wi-Fi connectivity is another risk point for consumer and business mobile app users. While access points at home or in the workplace can usually be trusted, in public places such as hotels, cafes, airports, supermarkets, etc., it's easy to stumble upon an unauthorized or unsecured access point.

Such connections are fraught with security risks of varying degrees of severity. By gaining control of a poorly secured AP or using a fake AP, hackers can intercept mobile traffic with a man-in-the-middle attack and steal app credentials, sensitive documents, and other sensitive information.

Another attack scenario is the introduction of malware. By intercepting an unencrypted response from a web server before the user receives it, attackers insert hidden malicious code into it, which subsequently undermines the mobile app and then the entire device.

Physical access to the device

A lost smartphone is a fact of life, though not pleasant. Thousands of personal and corporate mobile devices are lost or stolen every year, and quite a few fall into the hands of those who can take advantage of the owner's identity or the confidential information stored on the phone. 

Sometimes criminals don't need to take possession of a cell phone - a few minutes with an unprotected device can be enough to install malware. Since most people think of their workplace as a safe zone and don't hesitate to leave their appliances unattended, such an attack can quickly occur in a large office with an open space.

Strengthening enterprise mobile app security

Conventional IT security measures don't provide comprehensive protection for the in-house and third-party apps that are part of corporate workflows. What's worse, employees often don't follow appropriate precautions.

Take basic security steps

First, ensure your company complies with mobile security basics, such as two-factor authentication, changing standard app logins and passwords, and full-disk encryption of sensitive data. You also need to limit employee access to corporate applications and stored data according to job responsibilities. Following these four measures will prevent most mobile app security incidents, intentional or unintentional.

Another important security measure is protecting your mobile ecosystem from specific attacks. To prevent phishing attacks, your company can equip each mobile device with a monitoring solution that will analyze incoming traffic and weed out phishing content in emails, app notifications, and text messages. Antivirus software is another indispensable enterprise mobile security tool, as it scans the device and incoming network data around the clock for various types of malware.

Implementing user security guidelines

To regulate your company's secure mobile app experience, you need to implement a specific set of requirements and practices. The policy should cover aspects such as installing third-party apps on the device provided, using personal devices for work purposes and connecting to public and private networks.

The document should also detail important mobile security activities such as timely patching and updates, cache management, regular credential changes, and so on. Above all, it should require employees to report lost or stolen devices, security incidents, and unauthorized access.

No matter how much you trust your employees, they may still fail to comply with corporate security policies due to specific circumstances or inattention. Suppose security is a critical or major competitive advantage component of your service. 

Increase employee awareness

Having security monitoring tools and robust security policies in place is essential to corporate mobile security, but companies shouldn't pin all their hopes on them. Because hackers are constantly improving their attack methods, the software may sooner or later miss something through security, and security rules, as discussed above, can be ignored.

In a mobile-friendly environment, security becomes a shared responsibility, so the decision to keep employees in the dark about relevant security risks and their consequences is very likely to result in an unintentional breach. Thus, your company will achieve much better protection of the mobile ecosystem if you raise employee awareness of device and app security.

A corporate training program should educate employees about common and domain-specific mobile security threats and vulnerabilities and how they can undermine business operations. Employees should be trained to recognize phishing emails and notifications, identify suspicious links and applications, identify suspicious mobile activity and report these threats. Since new malware, phishing scams, and online threats appear almost daily, it's essential to update employees' knowledge regularly.

Ensuring consumer app security

The security of customers' mobile apps is another source of deep concern for companies. For one thing, outfitting an app with numerous advanced layers of security will not only make it cumbersome and reduce usability, but it will also prove costly to maintain. In addition, no brand can force its customers to comply with the necessary security measures or install monitoring solutions.

To keep customers safe from mobile security issues without exposing them to restrictions, companies need to balance the following strategies: security-focused development, continuous improvement of app source code, and customer security education.

Making apps secure by design

A dismal number of mobile apps are released with inherent vulnerabilities because developers tend to treat security as an afterthought. By incorporating software security testing into the development lifecycle, you will create a high-quality mobile app resistant to major hacker exploits and resilient in the long run.

Creating a secure app in the development phase begins with analyzing domain- and functionality-specific security risks and gathering security requirements. During the design phase, the team must conduct threat modeling to understand how attackers can compromise the software. Engineers must incorporate appropriate security controls into the source code and continuously test it for weaknesses.

Before the solution is released to the public, the application is once again subjected to a comprehensive security assessment that identifies and addresses all vulnerabilities in the source code and gaps in the security mechanisms.

Suppose you want to outsource the creation of a branded mobile app. In that case, it is advisable to turn to a specialized development team with the appropriate skills and experience, prioritizes security, and uses best security practices.

Ensure regular patches and updates

More than robust source code is needed to make your customer-facing mobile app impregnable. Later on, standard protections may become outdated and ineffective against evolving exploits. In addition, bugs may appear that undermine the integrity of the app. For this reason, it is necessary to closely monitor the application's security status and new types of cyberattacks to protect it from threats.

Inform your users

Unfortunately, your efforts to secure your mobile app can be thwarted by none other than your customers. Your team may outfit the app with sophisticated built-in security features. Still, your customer may disable multi factor authentication for convenience and fall victim to a common exploit.

That's why it's crucial to educate mobile app users about effective security practices and why it's essential to follow them. Since you can't do full-scale security training for every one of your customers, you should develop an informative and unobtrusive format. You also need to inform mobile app users about emerging attacks and what they might look like and provide escalation when necessary.