Countering the mobile phishing challenge
Connecting state and local government leaders
Mobile endpoint security solutions can help agencies protect government networks from sophisticated phishing attacks targeting employees' devices.
With the dramatic rise of sophisticated attacks, mobile devices have become a major point of vulnerability in government’s cybersecurity defenses. The compromise last fall of White House Chief of Staff John Kelly’s personal smartphone highlighted those risks and intensified state and federal agencies focus on mobile security.
One specific threat vector that should rise to the top the cyber priority list is mobile phishing.
Nuanced mobile phishing attacks are circumventing the security of previously safeguarded networks and exposing sensitive government data that could compromise national security.
Many agencies protect their networks from email-based phishing attacks through traditional firewalls, secure email gateways and endpoint protection. However, even with these security measures, government workers are still vulnerable. For example, a recent “fake phishing” attack audit in Michigan found that nearly one-third of state employees opened the email, a quarter clicked on the link, and almost one-fifth entered their user ID and password.
In addition, according to the InfoSec Institute, government and military institutions face more challenges than commercial ones when it comes to phishing. Not only are the backgrounds of the operators and their motives more diversified, but the phishing techniques and strategies are more sophisticated. For example, phishers aiming at U.S. civil institutions often pretend to be senior officials requesting co-workers or subordinates provide or renew personal information.
These phishing challenges have captured the attention of civilian, defense and intelligence agency leaders. William Evanina, director of the National Counterintelligence and Security Center within the Office of the Director of National Intelligence, recently stated that federal agencies must do more to harden their cybersecurity defenses because “we have an unbelievable inability not to click on a link.”
Further compounding the issue is the fact that mobile has made identifying and blocking phishing attacks considerably more difficult for both government employees and existing security technologies.
Mobile devices connect to networks outside traditional firewalls, typically lack endpoint security solutions and use a plethora of messaging applications not deployed on desktops. Plus, the mobile user interface does not provide the depth of detail users need to identify phishing attacks, such as revealing hyperlink destinations on hovering. For these reasons, mobile users are three times more likely to fall for phishing scams, according to IBM.
Additionally, government employees use their personal mobile devices in the workplace and sometimes use employer-provided devices for personal communications, in spite of policies to limit those practices. Unfortunately, the rules prohibiting government personal smartphone use at work have little to no impact on employee behavior, according to a study Lookout conducted in 2015.
Those vulnerabilities, along with the huge amount of personal data on mobile devices, make smartphones the preferred target for phishing attacks.
Thankfully, today’s mobile endpoint security solutions offer phishing and content protection for government agencies.
These solutions can detect phishing attempts on mobile devices from any source, including email (government or personal), SMS, chat apps, social media and more. They allow administrators to set policies to protect against phishing threats and block connections from mobile devices to known malicious URLs that may attempt to phish for credentials. It is also possible to alert end users to dicey websites at the actual time of URL access -- preventing exposure to malicious apps or websites with known vulnerabilities.
Criminals are using ever-more sophisticated forms of phishing to access to government networks, where any data that is compromised could have a major impact on our national security.
While federal security and IT professionals generally recognize the dangers associated with phishing attacks, a majority of organizations have chosen to focus on securing traditional endpoints, like PCs, rather than on the more problematic threat in their employees' pockets.
Agencies seeking comprehensive protection against phishing attacks across all vectors, including the mobile device, must find and deploy the right solutions to protect themselves from mobile threats.
NEXT STORY: A cybersecurity credit score