Mobile security poses huge risk for small firms

Since iOS and Android edged their way to the top of mobile device market share, consumers, business leaders and tech pundits alike have argued over which is more secure. But it’s time for that argument to end – mobile security is no longer an Android versus iOS debate.

Today, 95% of UK businesses let employees bring their personal mobile devices into the corporate network. They should be concerned: mobile security breaches affected 41% of UK organisations in 2014, according to a study from BT. However, it’s no longer as simple as questioning the operating systems themselves. Here are three areas that are adding complexity to mobile security:

1. An influx of new devices

After attending Mobile World Congress this year, I was surprised to find there were many devices with the potential to truly rival the greats like Samsung, LG, HTC, and yes, even Apple. They’re slick, beautiful, and have intuitive user experiences. The best part? They’re cheap.

There’s a problem though. The mobile industry has by and large relied on the Open Handset Alliance, a group of major carriers, manufacturers, and others who abide by certain best practices (such as using Google Play as the main app store) in making and selling Android devices.

Devices that are not a part of this alliance are not beholden to these practices, and in turn can’t benefit from them when it comes to securing the devices and the apps on them. In fact, many of these manufacturers include their own or other third parties’ app stores on their devices. The more these economically priced, yet still competitive, devices flow into the market, the more we will see them – and unvetted apps – flow into the enterprise via Bring Your Own Device.

2. Unvetted apps

There’s a growing trend to build home-grown applications that specifically cater to your business’ needs. Indeed, a recent report by technology provider CDW states that 48% of businesses expect to increase their mobile app budgets.

Android has always made the distribution of customised enterprise apps easy. Users can download from the official Google Play app store, but they can also visit third-party marketplaces and download apps as attachments in email.

Apple, on the other hand, has traditionally run a very tight ship, funnelling app downloads exclusively through its protected App Store. But in an effort to court businesses, Apple provided a mechanism to distribute these applications to the thousands of employees an enterprise has through something called an enterprise provisioning profile. In simple terms, this profile allows a business to push out its application to any user without needing to go through Apple’s sometimes rigorous process of getting an app accepted to the App Store.

While this makes it easy for enterprises to distribute apps to employees, the enterprise provisioning profile creates a situation where many firms bypass Apple’s app vetting process, losing a layer of security.

3. Pop-up boxes

In many instances, receiving applications outside of the official App Store, or what we call sideloading, causes users to encounter dialogue boxes they don’t necessarily understand.

The world has a knee-jerk reaction to the pop-up box: comply quickly, close it, do whatever you can to make it go away. Anything that interrupts a user’s flow on the device is quickly dealt with in an effort to get back to the task at hand.

As enterprises have expanded their home-grown app offerings by the hundreds, employees are now receiving many more of these notifications on iOS devices.

Why is this worrying? When users are too often exposed to these dialogues, they are conditioned to ignore important security warnings. This could result in bad apps passing unnoticed on to devices, exposing businesses to possible risk.

Consider this: most known iOS threats use enterprise provisioning profiles to access their target device (not including attacks on jailbroken phones – iPhones modified to allow users to install non-Apple applications). As an enterprise, you don’t want those app download dialogue boxes becoming a nuance people ignore.

Don’t put all of your eggs in one basket

It’s a changing world – businesses and consumers alike are going to need to use a multi-layer approach to security. They can’t rely solely on Google or Apple to police the app landscape and ensure their operating systems are buttoned up and without back doors.

It takes many layers to filter out the mobile security risks. Traditional network security, device security and application security, on top of app vetting, will all work toward one common goal: a safer corporate network and protected personal data.

Aaron Cockerill is the vice president of products at Lookout

Sign up to become a member of the Guardian Small Business Network here for more advice, insight and best practice direct to your inbox.