April 23, 2015 By Shane Schick 2 min read

Most people would probably agree getting struck by lightning is worse than downloading mobile malware, but security researchers say the statistical likelihood of either happening is about the same.

Unveiled at the recent RSA Conference in San Francisco, Damballa Inc. presented detailed results from a two-year study of more than 2 million unique hosts contacted by mobile devices across North America. The research concludes that mobile malware was contacting only 0.0077 percent of devices, based on a blacklist it had compiled. That means the average mobile user has only a 0.01 percent chance of being hit by a cybercriminal attack on his or her smartphone or tablet.

Damballa isn’t the only firm downplaying the extent of mobile malware issues. Verizon recently published a report of its own that said much of the same thing and even questioned the way organizations calculate the true cost of stolen data.

Besides suggesting many threats to mobile users may be wildly overblown, there were other surprises in Damballa’s research. As CSO Online noted, the report showed mobile malware infection rates were twice as high two years ago, the last time the company conducted a similar study. While that could be a credit to app stores that fend off the apps that pose the biggest risks, it could also be the increased sophistication of software tools to fight off cybercriminals.

A story on TechTarget pointed out that there is a direct relationship between mobile malware and the propensity for users to jailbreak phones in a given region. Unlocking devices can provide smartphone users the possibility of more choices in terms of apps, but it also means cybercriminals may have an easier way to target their potential victims.

Naturally, the statistics from Damballa aren’t intended to suggest chief information security officers and their teams should ignore the various Trojans, ransomware and other similar threats; when cybercriminals strike, the results can be disastrous. Ultimately, the numbers could mean IT departments will spend less time fending off cybercriminals directly. Rather, they may concentrate their efforts on educating their co-workers about phishing schemes and other techniques that might get them into trouble. It’s a matter of not leaving yourself exposed and vulnerable to unexpected danger — not unlike taking shelter during a thunderstorm to avoid lightning.

Image Source: iStock

More from

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today