Mobile Security Index 2019
Executive Summary

Companies think that they are doing ok. 

84% of organizations rated their existing mobile security measures as “effective," including a third (33%) that thought they were “very effective.” Almost four in five (79%) said that they're confident they’d spot a compromised mobile device quickly. And a similar percentage (77%) were confident that they would spot misuse by employees promptly. 

This sentiment is not matched by events or actions.

But many aren't doing as well as they think.

A third (33%) of organizations admitted that they have experienced a compromise that involved a mobile device—up from 27% in the 2018 report.

This can't be accounted for solely by lost devices and relatively harmless things like adware infections. 62% of those that experienced a compromise described the event as “major,” and two fifths (41%) said that it had lasting repercussions.

The bad actors keeping IT up at night.

While organizations are concerned about professional criminals, hacktivists and state-sponsored actors, they're even more worried about threats from within.

At 38%, employees topped the list of actors that respondents were most concerned about. Members of staff frequently expose their organizations to risk, both knowingly and unknowingly. Included in this number is the issue of negligence—employees making careless errors, losing their devices, using public Wi-Fi or circumventing security rules.

Organized criminal groups weren’t far behind. These groups are constantly adapting. As one device or platform becomes less vulnerable, they will move on to another. And they are constantly finding new ways to make money from their efforts. While “smash and grab” attacks are still common, there are much more sophisticated attacks too.

The tactics companies are concerned about.

We’ve broken threats and vulnerabilities into four layers: user behavior based, app based, device based and network based.

But it's not just email you need to think about—in fact, 85% of phishing attacks seen on mobile devices take place outside of email. While many organizations have filtering in place to block email-based attacks, far fewer have similar protection in place for these other routes⁵.

Abuse/personal use

Defining what constitutes misuse of corporate resources can be tricky. For example, some companies will frown on the use of social media, but many others encourage employees— especially salespeople—to use it to do their job more effectively. How can companies differentiate between watching a cute cat video and an interview with the CEO of a customer?

Excess permissions

We all know that few people read the lengthy terms and conditions when upgrading the OS on a device or installing a new app. The page that lists what permissions an app wants is typically much shorter, but do users still just click “Ok” anyway? This could be exposing you to more risk than you think.

Unapproved/rogue apps

Only two fifths (40%) of organizations said they limit users to installing apps from a recognized app store (like the Google Play store or the company's internal one). And just 3% totally blocked users from installing apps.

The official app stores aren't perfect. There have been several instances of rogue apps getting through, including some masquerading as popular messaging apps. But at least they have a degree of policing, unlike the Wild West of the internet.

Cryptojacking

In 25% of companies, at least one mobile device has encountered cryptojacking⁹. Infections are typically invisible and don’t steal data or hijack credentials. But they aren't harmless. 

The impact of even an “innocuous” infection can be severe. The disruption of reacting to the attack can be significant. But obviously the consequences of letting an infection through, even if it looks relatively innocuous, could be much worse.

* Common vulnerabilities and exposures system maintained by The National Cybersecurity FFRDC, funded by Homeland Security.

** Common vulnerability scoring system, https://nvd.nist.gov/vuln-metrics/cvss

To paraphrase a famous saying, there’s no such thing as free public Wi-Fi. At best, users are swapping privacy for convenience. At worst, they could be compromising credentials to other systems and exposing devices—not just the one they’re using, but every one it can connect to—to malicious code.

Insecure networks

Employees connect to an average of 12 Wi-Fi hotspots per day¹². Unfortunately, not all access points can be trusted. Nearly 2% of mobile devices have connected to a rogue access point (one set up to imitate a legitimate network)¹³.

For over a decade, year after year, the Verizon Data Breach Investigations Report (DBIR)¹⁵ has found that many companies are taking the same gambles—and losing. Many are failing to take even basic precautions, and as a result, they are exposing themselves to greater risk of downtime and massive damage to their reputation.

It’s worrying that our data shows that attitudes to protecting mobile devices are much less sophisticated than those of defending servers and personal computers. 

What will drive companies to take mobile security more seriously?

2018: The year of regulation.

Governments are doing more to regulate privacy and data security. The big news of 2018 was clearly the General Data Protection Regulation (GDPR). It is by far the most ambitious and wide-ranging data protection law yet enacted. And while it’s a European Union (EU) regulation, legislated by the 28 member nations, it has a global impact—any organization doing business in the EU, whether based there or not, is covered. 

In fact, we found that over three quarters (78%) of the US-based organizations that we surveyed said they had changed IT security policies in light of it. The well-publicized scale of potential penalties was almost certainly a driving factor.

GDPR wasn’t the only new kid on the block. As of March 2018, all 50 states in the US have mandatory breach notification laws in place. Several updated their regulations during 2018, and several are actively considering more wide-ranging laws. 

But cybersecurity is moving too fast to wait for regulation. Companies need to take responsibility for their data and the privacy of their customers and take action now.

Sadly, many aren't.

Companies aren't doing enough.

Mobile devices are prone to many of the same attacks as other devices. Most phishing attacks and badly coded sites can affect them equally, mobile users might even be more vulnerable. And there are also mobile-specific exploits—like malicious apps and rogue wireless hotspots.

And yet again this year, we found that many companies are failing to protect their mobile devices. And we’re not talking about some almost-impossible-to-achieve gold standard. We're talking about companies failing to meet even a basic level of preparedness.

Two thirds (67%) of organizations said they are less confident about the security of their mobile assets than other devices. A fifth (21%) strongly agreed with that statement.

This isn't surprising. As we've seen, many organizations don't have even the most basic protections in place—despite mobile security spend going up.

Most (64%) saw their spend rise in the past year—this could be additional remediation costs as more faced dealing with compromises. Even more (69%) expect their spend to rise in the next 12 months. Only 24% won't have seen an increase over the two year period.

Money's not the problem.

Budget was cited as a significant barrier by just 28% of respondents. And as in the Mobile Security Index 2018, lack of C-level support came at the bottom of the list of barriers to improving mobile security. The top three answers offered all revolve around expertise, or lack of it.

Respondents said that their organization lacks sufficient understanding of the threats and the skills to tackle them, and their users aren’t adequately prepared.

Are you ready?

Companies need to put in place measures across the whole security cycle: assess, protect, detect and respond. And they should implement systems to enforce the rules and spot noncompliance automatically. Many companies already take this approach for other IT systems, lots more are working towards putting it in place. It's time to include mobile devices in the plan.

See our Baseline, Better, Best matrix below for some suggestions on how you can get started or move up to the next level of mobile device security.