New Verizon report shows a big gap between organizations' mobile security risk concerns and mobile security best practices they implement. Credit: Thinkstock The number of security incidents involving mobile devices has increased over the past year, but companies are not protecting their mobile assets as well as they do other systems. One in three organizations admitted to suffering a compromise due to a mobile device, according to a new study by Verizon that surveyed 671 professionals in charge of mobile device procurement and management in their organizations. This represents a 5 percent increase compared to the results of a similar survey last year.“Mobile devices are prone to many of the same attacks as other devices,” Verizon said in its Mobile Security Index 2019 report. “Most phishing attacks and badly coded sites can affect them; mobile users might even be more vulnerable. And there are also mobile-specific exploits—like malicious apps and rogue wireless hotspots.”Companies not meeting bare minimum mobile security standards“And yet again this year, we found that many companies are failing to protect their mobile devices,” the company said. “And we’re not talking about some almost-impossible-to-achieve gold standard. We’re talking about companies failing to meet even a basic level of preparedness.”This is not due to a lack of awareness, as over 80 percent of respondents said their companies were at risk from mobile threats and 69 said those risks have increased over the past year. At the same time over two-thirds of respondents said they are less confident in the security of their organization’s mobile devices compared to other systems. Almost half of respondents admitted that their organizations sacrificed mobile security to get the job done faster and nearly half of those that cut corners experienced a mobile-related security compromise. Meanwhile, less than 25 percent of those that didn’t sacrifice security for speed and profit had a mobile-related compromise.Around 60 percent of incidents were described as major and 40 percent as major with lasting repercussions. Over half resulted in the loss of data and 58 percent also led to the compromise of other devices. Mobile security perception doesn’t match realityVerizon found that there is a perception gap because over 80 percent of organizations believe their precautions are either effective of very effective but less than 12 percent had actually implemented all four basic protections: encrypting data on public networks, changing default passwords, regularly testing security systems and restricting access to data on a “need to know” basis.Eight in ten companies were also confident that they would be able to spot a problem quickly, but the study revealed that in 63 percent of cases, compromises were reported by a third party such as a customer, partner or law enforcement. That’s not surprising giving that only two in three organizations had deployed at least one solution that would help with detection of security incidents: mobile endpoint security, data loss prevention or security information and event management (SIEM).“Far more respondents said that they plan to implement each of the mobile security protections mentioned above in the next 12 months than had done so in the previous 12,” Verizon said. “We could interpret this as more companies having realized the need to improve their defenses and starting to take action. But a comparison with last year’s stats suggests that this is more likely to be over confidence. While they may hope, and even plan, to introduce additional protections, many will fail to do so.”Organizations were most concerned with mobile-related threats posed by current or former employees, followed by those posed by organized cybercriminal groups, hacktivists, state-sponsored actors and partners. However, Verizon found that less than a fifth of organizations had comprehensive acceptable use policies (AUPs) that covered mobile device use.The Verizon report includes a table with recommendations for improving the security of mobile devices in the enterprise. It is broken down in types of actions like assessing, protecting, detecting and responding and the level of sophistication: baseline, better and best. Related content news analysis Water system attacks spark calls for cybersecurity regulation The Iranian CyberAv3ngers group’s simplistic exploitation of Unitronics PLCs highlights the cybersecurity weaknesses in US water utilities, the need to get devices disconnected from the internet, and renewed interest in regulation. By Cynthia Brumfield Dec 11, 2023 11 mins Regulation Cyberattacks Critical Infrastructure feature Accenture takes an industrialized approach to safeguarding its cloud controls Security was once a hindrance for Accenture developers. But since centralizing the company's compliance controls, the process has never been simpler. By Aimee Chanthadavong Dec 11, 2023 8 mins Application Security Cloud Security Compliance news analysis LogoFAIL attack can inject malware in the firmware of many computers Researchers have shown how attackers can deliver malicious code into the UEFI of many PCs though BIOS splash screen graphics. By Lucian Constantin Dec 08, 2023 8 mins Malware Vulnerabilities news Google expands minimum security guidelines for third-party vendors Google's updated Minimum Viable Secure Product (MVSP) program offers advice for working with researchers and warns against vendors charging extra for basic security features. By John P. Mello Jr. Dec 08, 2023 4 mins Application Security Supply Chain Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe