Report: Most Mobile Breaches Result of App Misconfigurations by 2017

• By Joshua Bolkan
• 06/05/14

Three-quarters of mobile security breaches will be the result of application misconfigurations by 2017, according to a new forecast by market research firm Gartner.

The company predicts that 2.2 billion smartphones and tablets will be sold to end users this year, yet security incidents stemming from mobile devices are still "rare."

"With the number of smartphones and tablets on the increase, and a decrease in traditional PC sales, attacks on mobile devices are maturing," according to a news release from the company. "By 2017, Gartner predicts that the focus of endpoint breaches will shift to tablets and smartphones."

"Mobile security breaches are — and will continue to be — the result of misconfiguration and misuse on an app level, rather than the outcome of deeply technical attacks on mobile devices," said Dionisio Zumerle, principal research analyst at Gartner, in a prepared statement. "A classic example of misconfiguration is the misuse of personal cloud services through apps residing on smartphones and tablets. When used to convey enterprise data, these apps lead to data leaks that the organization remains unaware of for the majority of devices."

To do more severe damage via mobile devices, malware needs devices with administrator-level alterations, such as a jailbroken iPhone or a rooted android device.

Rooting and jailbreaking are usually performed deliberately by a device's owner because they allow access to resources that are usually inaccessible. But they also jeopardize data. "This is because they remove app-specific protections and the safe 'sandbox' provided by the operating system," according to information released by Gartner. "They can also allow malware to be downloaded to the device and open it up to all sorts of malicious actions, including extraction of enterprise data. 'Rooted' or 'jailbroken' mobile devices also become prone to brute force attacks on passcodes."

To secure mobile devices Gartner recommends a mobile device management policy with baseline features including:

• Require users to opt in to enterprise policies. If their devices are not in compliance, deny access or provide only very limited access;
• Require length and complexity minimums for passcodes and strict retry and timeout standards;
• Limit the versions of platforms and operating systems allowed to those that can be supported;
• Do not allow jailbreaking, rooting or the use of third-party app stores. Disconnect any devices in violation from sources of business data and consider wiping them; and
• "Require signed apps and certificates for access to business email, virtual private networks, Wi-Fi and shielded apps."

"We also recommend that they favor mobile app reputation services and establish external malware control on content before it is delivered to the mobile device," said Zumerle.