February 11, 2015 By Kevin Olivieri 3 min read

It’s already difficult for end users to determine whether an app they use has been compromised, and with malicious mobile app threats such as last year’s Masque attack creeping into the enterprise, it’s about to get harder than ever for IT departments to determine that, as well.

Dangers of the Mobile App Explosion

According to the State of Mobile App Security report released in November 2014, there will be 253 billion app downloads in 2017, nearly double the 127 billion downloaded in 2014. Business apps in particular saw impressive growth last year in both the Apple App Store and the Google Play Store, with gains of 210 percent and 220 percent, respectively. This highlights the trend of employees increasingly using apps on their personal devices for work purposes.

It’s clear that we are currently in the midst of an unstoppable app explosion. IT departments must be ready to defend the enterprise against mobile app attacks from both outside the organization and its unknowing end users within.

No mobile device or operating system is completely safe as is, and no matter how unlikely a threat may seem, all it takes is one mistake to set in motion a cascade of critical leaks that could quickly take down a business. With this in mind, the following are four tips aimed at helping your organization prepare for the evolving nature of mobile app threats on the horizon:

1. Deploy an EMM Solution

First and foremost, your organization needs to employ an enterprise mobility management (EMM) solution. Having the right EMM solution in place lets you monitor and manage the apps and devices being used by your fellow employees, giving you visibility into the mobile environment within the enterprise and helping you act on threats before they affect your organization. Mobile threat management, another facet of EMM, provides organizations with mobile malware prevention and enhanced active protection through the ability to detect, assess and mitigate mobile security risks as they arise.

2. Establish Policies Around App Usage

One of the most mission-critical aspects of ensuring end users are safe from the mobile apps they use is through the establishment of policies that mandate app usage within the organization. Instituting security policies such as blacklisting and white-listing apps and compliance checks can set the ground rules of mobility in your organization and help you take action in real time to enforce compliance and stop potential data leaks before they happen.

3. Utilize an Enterprise App Store

To be sure the apps being used in your organization are of the utmost security and effectiveness, your IT department should leverage the capabilities of an enterprise app store. By utilizing an enterprise app store, you can simply and securely select, make available and distribute a wide range of key public and enterprise apps without compromising policies, productivity or the overall end user experience.

4. Ongoing End User Education

Although having security protocols around apps is common sense to IT departments, the same cannot be said for end users. Organizations must provide education with regard to best practices for app usage and mobile device use. It’s important to express the dangers of downloading apps from untrusted sources, whether they are from third-party app stores or links not sent from IT (phishing); highlight the threats associated with accessing corporate data and documents from unapproved apps; and inform them about the personal and corporate problems stemming from jailbreaking personal smartphones and using them for work. Doing this periodically will help keep your end users updated on new forms of potential attacks and help protect them from themselves.

Fighting Off Mobile App Threats

As the mobile app landscape evolves, so, too, will the threats that can take advantage of the tiniest of vulnerabilities. Acting on these four tips can help your organization combat malicious attacks and fight off rapidly advancing mobile app threats before it’s too late.

More from Application Security

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Audio-jacking: Using generative AI to distort live audio transactions

7 min read - The rise of generative AI, including text-to-image, text-to-speech and large language models (LLMs), has significantly changed our work and personal lives. While these advancements offer many benefits, they have also presented new challenges and risks. Specifically, there has been an increase in threat actors who attempt to exploit large language models to create phishing emails and use generative AI, like fake voices, to scam people. We recently published research showcasing how adversaries could hypnotize LLMs to serve nefarious purposes simply…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today