The recent shift in enterprise application platforms from desktop to mobile has brought with it many exciting benefits, which organizations have recognized and leveraged to provide a more flexible and convenient workplace. Unfortunately, individuals and groups with less honorable intentions have also taken notice of this shift. In fact, a report from ISACA predicts a massive rise in malvertising and other mobile malware in 2016, as cyber criminals take advantage of this lucrative mobile trend.
With that in mind, it’s important for organizations to ask themselves the following important questions as they prepare for an increasingly hostile mobile world:
How Can You Quantify Mobile Risk?
The covert nature of malware hidden inside otherwise legitimate apps makes it increasingly difficult for organizations to quantify this particular mobile risk. Despite these challenges, Ernst & Young recently teamed up with the Interactive Advertising Bureau to come up with some basic figures, as Forbes reports. With a focus on the digital advertising sector, the study found that malvertising, piracy, and invalid traffic joined forces to comprise the bulk of malicious factors that costs the industry $8.2 billion a year. Malvertising alone accounted for $1.1 billion in lost revenue.
Another reason why these malicious advertisements are so hard to quantify is that they are becoming increasingly sophisticated as time goes on. What was once simply an image with a link to malicious content has now evolved into a supremely subtle, passive method of injection that requires almost no interaction from the victim.
The same technology that allows ads to animate and display interactive content now enables cyber criminals to run malicious code on your device by simply being viewed. As these malvertisements become more sophisticated, the strategies that organizations use to combat them must similarly mature.
How Can You Integrate This Quantification Into a Successful Mobile Security Strategy?
When it comes to successfully fighting the growing threat of malware-laden advertising, simply following the “safe browsing” strategy won’t work. After all, according to CIO, malvertising affected record-breaking numbers of users last year when some of the most popular web destinations served up malicious ads, unbeknownst to them. The bottom line: You need an intelligent strategy to combat an intelligent threat.
The process of integrating malicious ad protection into your current mobile threat strategy begins with data. Tools that are driven by this data and allow you to dive deep into the sometimes-hidden traffic of your mobile applications and access points are the key to sniffing out the bad apples before they can do any damage. These tools include monitors at the network and application level that can discover traffic patterns that deviate from established norms. This process will highlight apps and ads that are paving unauthorized tunnels or diverting traffic to malicious destinations.
Once your monitoring services are in place, your next step should be to put these data streams to good use. Security monitoring platforms go a long way toward increasing mobile threat visibility by aggregating all your threat sources for automated and manual analysis. Sources including environment traffic, endpoint scans, and identity access management systems will give you the bird’s-eye view of mobile environment health. The process of consolidating mobile, data, network, and endpoint security views will also help to streamline infrastructure management and reduce the pressure of mobile threats.
In the end, malvertising is just another piece of the complex cyber security puzzle. When you deploy data-focused tools and managed security frameworks to analyze the information generated, you can rest a little easier knowing that you have a comprehensive security perspective of your mobile infrastructure.
