Gartner | Biz Builder Mike

MAPS Helps Enterprises Avoid Mobile Application Security Pitfalls

August 27, 2020 by bizbuildermike

MAPS Helps Enterprises Avoid Mobile Application Security Pitfalls

Gartner’s recently published Avoid Mobile Application Security Pitfalls (July 27, 2020; Dionisio Zumerle) provides security and risk management leaders with must-follow mobile best practices to avoid data leakage from mobile devices and attacks to infrastructure. Zimperium – the global leader in mobile device and app security and provider of the Mobile Application Protection Suite (MAPS) – is recognized in this report.

According to the report, “Security and risk management (SRM) leaders must protect mobile applications to enable the organization to advance toward its digital transformation (*see Figure 1). This research highlights the main pitfalls and suggests approaches to avoid security failures when developing and using mobile apps.”

According to Gartner, “key challenges facing security and risk management leaders include:

Mobile application security failures lead enterprises to sensitive data loss, exposure of infrastructure, fraud and noncompliance.
The architectural decisions made very early on in the process will determine many of the limitations in the security functionality available to security leaders.
Mobile applications are subject to new types of attacks and require developers to revisit, learn and reprioritize security best practices.
When seeking advanced mobile application security functionality for particularly sensitive apps, the landscape is fragmented, maturing and technically challenging to grasp.”

Gartner, in this report, state leaders in charge of application security should:

“Provide early input on the performance-security trade-offs when a mobile architecture (native, hybrid or mobile web) is selected by being involved from the beginning of the process.
Implement application security best practices with a focus on the specificities of mobile and its associated back end and possible API. In particular, eliminate hardcoded credentials, minimize app permissions, encrypt sensitive data and use certificate pinning where possible.
Perform mobile application security testing and standardize the mobile security components used by employing ISVs, multi experience development platforms and UEM capabilities in the process.
Go beyond obvious controls, such as encryption at rest, for high-security apps by hardening and obfuscating code, preparing against tampering, and reverse-engineering attempts.”

MAPS identifies security, privacy and compliance risks during app development and protects/monitors apps from attacks while in use, ending the piecemeal approach and connecting data in a single platform.

MAPS is comprised of three solutions, each of which address a specific enterprise mobile app security need:

zScan helps organizations discover and fix compliance, privacy, and security issues within mobile apps before they are released as part of the development process;
zShield hardens the app through obfuscation and anti-tampering functionality, protects the app from potential attacks like reverse engineering and code tampering; and
zDefend SDK (formerly zIAP) is embedded in apps to help detect and defend against device, network, phishing and malicious app attacks while the app is in use.

Whether it is identifying security and privacy risks during the app development, or monitoring and protecting apps from attacks while in use, we are making sure mobile apps aren’t used by hackers as a data breach gateway.

zScan provides an ongoing and automated ability to discover privacy, security, and compliance issues in mobile apps before the apps are released into the wild. zScan is designed to fit directly into the development process without requiring developers to go outside their normal operations, implement any new code, or have to log into another console.

Once findings are discovered, zScan can open tickets in ticketing systems to provide developers with detailed information and work packages necessary to address the risk. Once developers fix and mark findings closed (as they would any bug or feature request), the information is synced back to zScan so security and compliance teams can verify the fix.

Once a mobile app is released publicly, potential attackers can inspect it for any coding errors and vulnerabilities that can be exploited. Zimperium zShield’s obfuscation and anti-tampering functionality hardens and protects the app from attacks such as reverse engineering, piracy, removing ads, extracting assets, extracting API keys and inserting malware among others.

With the zDefend SDK embedded, mobile apps can immediately determine if a user’s device is compromised, any network attacks are occurring or if malicious apps are installed. zDefend is completely configurable by app developers, who can take action when a given threat is detected.

The development of a mobile app should be focused on creating exceptional user experiences and engagement, not financial and reputation concerns over data breaches and privacy and security issues. MAPS provides peace of mind to CISOs, CIOs and security operational teams for the life of their mobile app so developers can focus on building features/functions for the business while applications are scanned, shielded and able to defend themselves once released into production.

If you’d like to read Avoid Mobile Application Security Pitfalls, please click here.

If you would like to learn more about securing your mobile apps from development to running on end user devices, please contact us. We are here to help.

*This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request.

MAPS Helps Enterprises Avoid Mobile Application Security Pitfalls

Source

Remote Learning Risks Facing Students

August 25, 2020 by bizbuildermike

Remote Learning Risks Facing Students

As summer turns into fall, more and more schools are starting the 2020-2021 academic year. Faced with uncertainty in an ever-evolving climate, school districts and higher learning institutions are struggling to do what is best for students and teachers alike.

There are no easy answers. We’ve seen months of careful planning and preparation turn on a dime at the University of North Carolina and Notre Dame, where the campuses have recently closed because of “COVID hot spots” turning up. Unfortunately, these schools may very well not be the exception.

For K-12, many school districts are opening with at least some degree of remote learning. Remote learning means increases in Chromebooks usage.

We recently held a webinar entitled Protecting Chromebooks Used by Schools, Cities & States in which I had the pleasure of speaking with Karen Jackson – Interim Executive Director, New College Institute; President, Apogee Strategic Partners; and former Secretary of Technology, for Virginia. We both provided insights on the risks schools face and what can be done – – you can watch the webinar by clicking here.

For schools relying on Chromebooks for remote education, students, teachers and administrators face the same privacy and security threats associated with laptops and mobile devices, without the same security measures. In a suburb of Dallas, Texas, we’ve already seen a hacker get into a sixth grader’s online classroom and send threatening messages.

With the exception of the mandated content filtering that prevents students from going to inappropriate sites, students are very vulnerable to cyberattacks. And unlike laptops, desktops – or iOS and Android devices for that matter – Chromebooks have not been provided protection from breaches.

Meaning, students are susceptible to network and phishing attacks, malicious apps, OS exploits and risky apps:

zIPS for Chromebooks – through its machine learning-based technology – detects and remediates against those attacks (and more):

Identifying and blocking users from accessing phishing sites;
Detection of malicious WiFi networks and alerting users to disconnect from the network; and
Assessment of all Android apps for undesired violations of privacy, or unsecure development practice.

zIPS for Chromebook’s on-device design also protects user privacy and provides local, continuous assessments of the mobile endpoint.

The combination of content filtering and zIPS for Chromebooks better protects students.

To learn more, please watch the webinar and contact us. We are here to help.

Remote Learning Risks Facing Students

Source

Zimperium Mentioned in Several Gartner Hype Cycles

August 20, 2020 by bizbuildermike

Zimperium Mentioned in Several Gartner Hype Cycles

Every year Gartner publishes more than 100 “Hype Cycles” for buyers of technology which are refreshed and published every July because the third quarter is typically a planning quarter for technology buyers. Zimperium, the global leader in mobile device and app security, is a part of several Hype Cycles, including:

Hype Cycle for Frontline Worker Technologies, 2020 (July 7, 2020; Leif-Olof Wallin and Rob Smith) – A frontline worker’s job tasks are often drastically different than those of a desk-based worker, requiring different and optimized solutions. I&O leaders responsible for mobility for frontline workers should evaluate the technologies in this Hype Cycle.

Hype Cycle for Privacy, 2020 (July 23, 2020; Bart Willemson and Bernard Woo) – Security and risk management leaders managing technology, information and resilience risk must consider privacy a top priority. Laws and privacy-preserving technologies that protect business value and build trust with individuals are covered in depth to support prioritization of risk and investment.

Hype Cycle for Application Security, 2020 (July 27, 2020; Mark Horvath) – Today’s pace of application development is continuously accelerating, giving way to complex, interconnected software systems. Security and risk management leaders need to adopt innovations in the application security space to handle the growing complexity.

Each report provides thorough analysis and is a great source of research. Today, I’d like to talk a little about Gartner’s Hype Cycle for Endpoint Security, 2020 (July 15th 2020; Dionisio Zumerle and Rob Smith) which tracks the innovations that aid security leaders in protecting their enterprise endpoints from attacks and breaches. Security leaders are asked to protect endpoints from attacks, while also allowing access from any device to any application over any network, with minimal impact on user experience.

From a mobile security perspective, the comprehensive report provides many compelling insights. I’d like to examine two points:

“Increasingly mobile devices are involved in advanced attacks, sometimes as part of a broader attack. For example, mobile phishing attacks can obtain account credentials that an attacker can reuse against an enterprise API, or on a corporate laptop.
“Because of the current lack of visibility on mobile devices, most organizations never identify these portions of the attack. MTD (mobile threat defense) solutions, stand-alone or as part of a broader EDR (endpoint detection and response) or UES (unified endpoint security) deployment, can improve detection of attacks against enterprises.

In our blog – The Ultimate Endpoint – we discuss how mobile security is one of, if not the single most important facet of enterprise security being overlooked or under-supported, therefore posing a massive threat to organizations. While every security team has defense-in-depth solutions protecting desktops and laptops, there is no such depth of protection for mobile devices.

We know an endpoint is an endpoint is an endpoint and enterprises must protect those endpoints – laptops, desktops, mobile devices – that have access to, and/or contain corporate data.

The reality is, 60 percent of a typical enterprise’s endpoints are mobile devices, and they are unprotected. Another reality is, there are several things an enterprise must consider when looking to protect its endpoints:

Mobile device management (MDM) products, virtual private networks (VPN), and multi-factor authentication (MFA), do not protect your device from phishing, network, OS/device, or mobile application vulnerabilities and zero-day threats;
MTD offerings exclusively dependent on a “cloud connection” are inherently sub-standard for continuous protection;
On-device and always-on is the only path for enabling zero-trust mobile operations;
With smaller screens, and less space to identify troublesome URLs, phishing detection and prevention is particularly important for mobile;
Enterprises require robust administration consoles and features that looks at all the endpoints; and
Protecting mobile applications is integral to the overall security of the mobile device.

To learn more about how Zimperium can protect your enterprises’ mobile devices, please contact us.

Zimperium Mentioned in Several Gartner Hype Cycles

Source