Can government secure the mobile ecosystem?
Connecting state and local government leaders
Mobile devices pose a special risk to government, in part because commercial carriers aren't subject to the security controls that can be applied to federal networks, a new DHS report says.
While government workers make up a small fraction of the number of mobile device users, securing those devices against attacks that use them to access larger agency networks is a massive task.
According to a new study from Department of Homeland Security's Science & Technology Directorate in consultation with the National Institute of Standards and Technology, mobile devices pose a special risk to government, in part because commercial carriers aren't subject to the security controls that can be applied to federal networks.
The report, "Study on Mobile Device Security," was prepared in compliance with the Cybersecurity Act of 2015, which required DHS to explore security gaps that arise from government's use of commercial mobile devices and recommend security improvements within the mobile device ecosystem.Nation states, organized crime and independent hackers use the same variety of threats against federal mobile devices as they do against consumer phones -- social engineering, ransomware, banking fraud, eavesdropping, identity and data theft.
Federal mobile users, the study found, may also be specifically targeted just because they're government workers, particularly because their devices could provide a way into computer systems that contain sensitive data on Americans or access to government functions.
The mobile threat requires a substantially different approach to security than desktops, particularly because mobile devices "operate outside of enterprise protections and have evolved independently of desktop architectures," the report said.However, DHS lacks legal authority to close security gaps with wireless service providers, the report said. While DHS can evaluate voluntarily provided mobile carrier network information, the agency doesn't have the authority to make wireless carriers provide information to assess their networks' security.
Although the General Services Administration has successfully leveraged the federal government's vast buying power to nail down group discounts with carriers, the study said that purchasing power may not be enough to give the federal government any leverage on wireless security issues with service providers.
Despite the growing threat, the study noted mobile device security is improving thanks to operating systems providers and mobile device and enterprise mobility management systems that inject additional scrutiny and manage security configurations.
Read the full report here.
NEXT STORY: Eye-tracking tech helps CBP detect imposters