Device threats

This year, our study looked at businesses of all sizes, from those with fewer than 100 mobile devices to companies with 10,000 or more. And all of them were worried about the same types of device threats, from lost devices to OS vulnerabilities.
 

SIM swapping

Imagine your mobile phone suddenly displayed the message “no network"; what would you think? You’d  probably roll your eyes and blame your provider. You might try shifting location, and when that fails, go for the dreaded restart. What if it still isn’t working? Would you suspect that somebody had hijacked your number and was now getting all your texts  and calls? You might think that a bit   of peace and quiet would be a nice change, but remember that those messages might include two-factor authentication texts and calls about resetting passwords.

SIM swapping involves an attacker researching the victim to gather personal details like their date of birth and address. They then call up the mobile phone provider, impersonating the victim, and ask to transfer the target phone number to one owned by the attacker.

It’s a growing threat. Based on the number of incidents reported to the FBI’s IC3 unit, the number of successful attacks has almost doubled year-on-year since 2016.²⁵

Loss and theft

Everybody loses stuff, including expensive devices packed with valuable information. They leave devices in taxis, on trains, at restaurants—the list goes on and on. Some of these will end up in lost and found, others will find a new owner.

Some 83% of organizations said they are concerned about device loss/ theft, and 20% of those felt that their defenses were inadequate to deal with this threat—despite it being one of the easiest types of attack to prepare for and mitigate. Encryption and remote wipe are now standard with many common user devices, but that doesn’t mean that companies are using them.

These are basic precautions that don’t cost a dime but could prevent a device that falls into the wrong hands from leading to a compromise.
 

IoT devices

The volume and variety of connected devices is growing rapidly. Eighty-four percent of organizations said that IoT devices are crucial to their digital transformation. What are the risks of IoT, and how can your organization stay prepared? We explored the state of IoT device security.

Out-of-date operating system (OS)

It’s not just the major OS updates that matter. Threats are evolving all the time. Missing an update, even a minor one, can put mobile devices at greater risk. How many people can honestly say that they’ve never clicked “Remind me later” when asked to update? Can you?

There are several factors driving the lag between OS updates being released and users installing them. First, device replacement cycles are growing. Just a few years ago, people were queuing around the block to upgrade to the latest iPhone. But devices are now extremely advanced and innovations less dramatic—typically, most new features are software and hardware updates focused on improvements to cameras. With fewer “must have” advancements many owners are prepared to hold on to their devices longer.

Second, many software updates aren’t that compelling for users. Often, they only bring minor changes to functionality.Since users know they’re not going to experience much of a difference, they may think the hassle of upgrading isn’t worth it and delay it as long as they can.

There are many other reasons that updates are sometimes delayed, including device settings. For example, many devices have a setting to wait until the user is connected   to a Wi-Fi network to execute updates over a set size, and most OS updates are quite big.

But many companies aren’t taking advantage of the update policies that are built into their managed Android devices. According to IBM data, almost half (49%) of enterprise devices are being used without any managed update policy— the decision to update is being left up to employees. Just 21% of these devices are set to immediately install system updates—see chart the below.