FEBRUARY 2018 - THE STATE OF MOBILE IN ASSET … · According to Accenture’s High Performance...

This report looks at data from the mobile estates of global asset management and investment firms; providing analysis, benchmarking and best practice guidance on keeping mobile devices secure and managing data consumption.

Mobile data reportFEBRUARY 2018 - THE STATE OF MOBILE IN ASSET MANAGEMENT AND INVESTMENT FIRMS

Mobile data report - Investment and Asset Management | 2

Copyright © 2018 Wandera

Ever since the introduction of smartphones to the workplace, IT departments have been trying different methods of integrating them with their wider IT strategy. What began as a consumer technology quickly became a tool that enabled businesses to be more agile and allowed employees to stay connected while out of the office. However, when it comes to valuable financial services data, this new mobile workplace has brought unprecedented challenges along with it.

The fast-changing space of mobile technology has left IT departments scrambling to keep up. Not only do they need to combat the rising costs associated with mobility, but they also face issues with shadow IT, compliant usage and security threats.

Let’s take cellular data consumption, for example. Data accessed via 3G and 4G connections has been increasing at an alarming rate. In fact, mobile internet usage first surpassed that of desktop in 2016, and with the proliferation of feature-rich social media and video streaming sites such as YouTube and Netflix, it is showing no sign of slowing down.

According to our research, the total cost of ownership of a mobile device is significantly more than just the cost of the handset plus the contracted monthly carrier bill. In reality, unaccounted for consumption such as roaming data and bill shock events can send costs skyrocketing. Additionally, the associated IT resources, enterprise mobility management (EMM) and security investments collectively account for around 30% of the total cost of mobility, and can easily be overlooked. The very nature of mobile devices means employees tend to use them for personal reasons, which can incur further unwanted costs for the enterprise.

The biggest issue facing asset management and investment firms in 2018 is security. The volume of sensitive data that these firms handle means a breach could be catastrophic. According to Accenture’s High Performance Security Report 2016, the average financial services organization will face 85 targeted breach attempts every year, and a third of them will result in a successful security breach.

Research by IBM suggests the financial services sector was attacked more than any other in 2016, with cyber criminals using a variety of techniques, including Distributed Denial of Service (DDoS), Business Email Compromise (BEC) and ransomware campaigns. Some of the best documented cybersecurity events have occurred in the financial services space, including a UK Institution that was infected with the Retefe banking trojan, which ultimately led to 9,000 customers having their accounts emptied. In Ukraine and Bangladesh two banks lost $10 million and $81 million respectively, in what emerged to be as the result of sophisticated cyber attacks. In just the past year, successful DDoS attacks have been targeted at finance companies in Canada, USA, the UK, France and Greece.

More specifically, asset management firms have been accused of becoming complacent in this area in the past and mobile is widely acknowledged to be the weakest link in the enterprise IT infrastructure. This report investigates the current status of mobile usage and security in asset management and investment firms. It is designed to provide insights and best practice guidance on keeping mobile devices secure and managing data consumption.

Introduction

1 OTA, Cyber Incident & Breach Trends Report



Enterprise mobility managementMobile Device Management (MDM) was the first attempt to control mobile fleets in the post-BlackBerry era. MDM has now evolved into Enterprise Mobility Management (EMM) or even Unified Endpoint Management (UEM) and in many industries it is the first defense in controlling, managing and securing a mobile fleet.

Within our sample of 64 asset management and investment firms, around 1 in 6 do not have an EMM in place. Of those that do, VMware AirWatch is the most popular, closely followed by BlackBerry’s management solutions and MobileIron.

As the EMM environment has matured however, it has become clear that there are limits to their capabilities. For truly effective data management and enterprise-grade security, enterprises need to look beyond EMM tools because they often lack the ability to gain visibility of the data flowing into and out of each device. This leaves IT teams critically underpowered when it comes to security – a sentiment frequently repeated by analyst research in 2017.

Typical methods of protection provided by EMMs do not protect against the huge variety of mobile threats in today’s landscape. This creates problems for mobility and security teams and they find themselves wondering: which services are employees using on devices? What sites are being accessed through the browser? Are end-users vulnerable to phishing attacks, data leaks or malware? Clearly, the security features available in EMMs and in the native operating systems (iOS, Android, Windows) fall short of protecting the modern asset management and investment firms.

MDM USED IN ASSET MANAGEMENT AND INVESTMENT FIRMS

“Malicious threats or data leakage risks elude EMM controls.”

GARTNER MARKET GUIDE FOR MOBILE THREAT DEFENSE SOLUTIONS

“The security capabilities found in EMM solutions aren’t enough.”

VENDOR LANDSCAPE: ENTERPRISE MOBILITY MANAGEMENT (EMM) SOLUTIONS, 2017

“EMM, native sandboxing and segmentation on mobile OS are not enough to meet overall mobile threat needs.”

IDC MARKETSCAPE: WORLDWIDE MOBILITY THREAT MANAGEMENT SECURITY SOFTWARE 2017 VENDOR ASSESSMENT



Data usage risingData usage is rising, and it’s rising fast for firms within the financial services industry. There are a number of reasons for this: employees are more mobile, international assignments are becoming the norm and employees are doing a growing proportion of their workload on mobile devices.

In tandem, the proliferation of social media and the increase in video streaming services means mobile data consumption is rising fast. The following analysis looked at data from 25,000 devices given to employees by asset management and investment firms. During the period from March 2017 until December 2017, the data used by employees on mobile devices grew by 93%, representing an annual growth rate of more than double. Average usage per employee shot up from under 1GB in March to more than 1.6GB by December.

Interestingly, the majority of data consumption on these corporate-owned devices is coming from what would likely be constituted as personal use. Video and photo services is the category that consumed the most data in 2017, closely followed by social media apps and sites. On personal devices, people are often conservative when using such hungry services to ensure they don’t

wind up with a large bill they will be personally liable for. When it comes to corporate devices, users are less concerned with the resulting bill because it is often paid for by the business. This behavior is more difficult or nuanced to control in the enterprise, meaning the onus is on IT teams to be proactive with defining and enforcing acceptable use policies.

On mobile devices, more so than laptops, the line between business and personal use is irrefutably blurred. When given a mobile device, although it may be a ‘work’ device, employees often do not use it in the same way as they would a desktop or laptop.

Compared to desktop, there is very little control (or even visibility) into how mobile devices are being used. The ease with which mobile devices can leave the corporate infrastructure has allowed employees to easily access a far greater range of content and customization than they would on work-assigned PCs.

It’s also worth considering that mobile devices are inherently consumer focused and engineered for personal use. This, plus many other factors, make the relationship between corporate and personal ownership and usage far more complex than with traditional enterprise computing.

MOBILE DATA CONSUMPTION PER DEVICE PER MONTH IN ASSET MANAGEMENT AND INVESTMENT FIRMS IN 2017

93%GROWTH IN DATA CONSUMPTION BETWEEN MARCH AND DECEMBER 2017 IN ASSET MANAGEMENT AND INVESTMENT FIRMS

1.68GBTHE AVERAGE DATA USAGE PER MONTH PER DEVICE IN ASSET MANAGEMENT AND INVESTMENT FIRMS

TOP 10 CATEGORIES BY USAGE IN ASSET MANAGEMENT AND INVESTMENT FIRMS IN 2017

1 |

2 |

3 |

4 |

5 |

6 |

7 |

8 |

9 |

10 |

VIDEO & PHOTO

SOCIAL

TECHNOLOGY

BUSINESS & INDUSTRY

APP STORES

CONTENT SERVERS

AUDIO & MUSIC

NAVIGATION

CLOUD & FILE STORAGE

NEWS & SPORT



Which applications are used the most?Looking at the most used applications, it is no surprise that the apps consuming the most data are web browsers including Chrome and Safari. Also making it into the top 10 apps by usage are social giants Instagram, Facebook and Snapchat as well as YouTube and Spotify.

These data hungry apps - which we can assume are used almost entirely for personal reasons - present an issue for IT teams looking to curb personal use and cut costs. EMMs offer tools that can manage the applications that employees use, as well as offering the ability to blacklist unwanted services. Web browsers, however, present a black box scenario for most mobility teams, as EMMs and carriers reveal nothing about what websites employees are visiting in the browser (at least, not without complex and critically flawed workarounds).

ComplianceRemaining compliant should be a priority for asset management and investment firms. It is essential to ensure that employees’ corporate device usage follows acceptable use policy, especially as businesses can be held accountable for the actions of their employees.

Accessing extreme, adult or illegal content on work devices is typically considered unacceptable. There have been well-documented incidents of organizations being held liable for the actions of employees on work-assigned devices. This involves staff developing gambling addictions, accessing gun-related or terrorism materials, and using adult websites in the presence of customers. In each of these areas, employers have been held accountable for these actions.

This graph shows the number of attempts of access inappropriate content on work devices per month. This includes adult, extreme, illegal and gambling sites. In reality, this number would be higher in most companies but the data analyzed was that of Wandera customers who have the ability to block unwanted content and most of them do. Therefore once someone realises the content is blocked they are unlikely to try and access it again.

Inappropriate content not only puts a risk on the company in terms of litigation, but many users don’t realise that this content is also a high security risk, with a large proportion of malware embedded into it. Pornography and other adult content categories are notorious for lax handling of PII. In fact, 40 out of the top 50 adult sites were exposed when researched in 2017. These high risk sites, along with gambling services, are also notorious for distributing malware and phishing links, either through exposure to poorly regulated advertising networks found on these sites, or through malicious practices by the site itself.

ATTEMPTS TO ACCESS INAPPROPRIATE CONTENTPER MONTH IN ASSET MANAGEMENT AND INVESTMENT FIRMS

TOP 10 APPS BY DATA CONSUMPTION IN ASSET MANAGEMENT AND INVESTMENT FIRMS

1 | Web browser

2 | Mail

3 | App store

4 | Facebook

5 | Instagram

6 | Spotify

7 | Google Maps

8 | YouTube

9 | Snapchat

10 | iTunes

99ATTEMPTS TO ACCESS INAPPROPRIATE CONTENT EVERY MONTH IN THE AVERAGE 100 DEVICE ASSET MANAGEMENT AND INVESTMENT FIRM



PhishingPhishing attacks have long been associated with poorly written emails landing in your spam folder. As mobile has grown in importance, phishing attacks have shifted in focus. The smaller amount of screen estate, the ‘distraction mode’ of usage and the wide range of distribution channels (SMS, Skype … even Tinder) mean that individuals and companies are extremely vulnerable to phishing attacks on mobile.

Years of hard work to defend businesses against email phishing has left many organizations complacent in staying protected from phishing conducted over mobile apps, social media and other more novel approaches. In 2017, 81% of successful mobile phishing attacks took place outside of email, as reported in Wandera’s recent phishing research.

Data from Proofpoint suggests that phishing attacks conducted over social media jumped by 500% in the final three months of 2016, representing a wider trend in hackers looking beyond desktop and email when executing phishing attacks.

Phishing is not only prevalent, but it’s also arguably the most damaging and high-profile cybersecurity threat facing organizations today.

Wandera’s research into how attackers use phishing on mobile found that mobile apps were used for such attacks regularly and successfully - even on iOS devices with anti-virus and EMM security in place, none of which can see or block access to phishing sites. More than 12% of all mobile security incidents involve phishing URLs, and 63% of such attacks target iOS users.

PHISHING ATTEMPTS PER DEVICE PER MONTH

Looking at the devices being used by employees at asset management and investment firms, Wandera found an average of 53 phishing attacks per month per 100 devices. That means, on average, around half of all employees will be exposed to a mobile-based phishing attempt every month.

1. APPLE

2. PAYPAL

3. FACEBOOK

4. GOOGLE

5. AMAZON

THE MOST FREQUENTLY USED IMPERSONATED ORGANIZATIONSIN PHISHING ATTACKS53

53 PHISHING ATTACKS EVERY MONTH IN A 100 DEVICE ASSET MANAGEMENT AND INVESTMENT FIRM.



Data LeaksSecurity is often an afterthought when creating apps. Developers tend to be more focused on making sure the app is user-friendly and intuitive to use, as well as getting it out to market as quickly as possible. Without following rigorous secure development practices, apps that leak sensitive PII can find their way on to the official app stores presenting a very real problem. What’s worrying for any asset management or investment firm is that employee mobile devices carry a lot of valuable information to hackers. This includes client financial data; intellectual property, such as algorithms and investment strategies; and information that could be used to front-run trades for profit. Furthermore, that amount of personal information, together with the incredibly large pool of assets represented by the industry, tends to attract a good deal of attention.

Wandera’s 2017 Mobile Leak Report detected data leaks containing PII from more than 200 mobile websites and apps as it monitored the corporate-liable devices for over 500 enterprise businesses around the world. The leaked data varied in type, ranging from passwords and usernames, right through to entire credit card details, dates of birth, addresses, home phone numbers and even passport numbers.

Corporate owned mobile devices hold a large amount of information. When looking at the mobile data of employees at asset management and investment firms there are an alarming number of sites and apps used by employees which, unbeknownst to the user, are leaking data.

According to our research, for every 100 devices there will be almost 1000 connections to such sites each month. The most commonly leaked type of data was email addresses, followed by location data and then passwords. Alarmingly, there are a handful of cases when full credit card information was being leaked as well.

1,0001,000 CONNECTIONS TO LEAKING SITES AND APPS EVERY MONTH IN A 100 DEVICE ASSET MANAGEMENT AND INVESTMENT FIRM

CONNECTIONS TO LEAKING SITES OR APPS PER MONTH



Man-in-the-Middle attacksLeaking data leaves companies even more vulnerable to man-in-the-middle (MitM) attacks. Free Wi-Fi is becoming the norm, on average, a corporate device makes 12 Wi-Fi connections a day and 12% of the hotspots that employees are connecting to are open. But insecure networks can make all traffic visible to a malicious actor that wants to see the online communication of people physically nearby. Almost every coffee shop, hotel, airport, train, hospital, etc., offers a service of open Wi-Fi connectivity to their customers with minimal security, encryption or privacy.

When a leaking site or app is being used on an open Wi-Fi network, the unencrypted information can be harvested by a malicious actor or “man-in-the-middle”. Depending on what is being leaked, this Wi-Fi risk could lead to credit card theft, identity theft, or even the reuse of login credentials to access a corporate network.

Man-in-the-middle attacks are increasing inside asset management and investment firms. In the average 100 device company, approximately 4 will be vulnerable to a MitM attack over the course of a month. Couple this with the amount of leaking data and a hacker could gain access to the corporate network with very little effort.

MITM ATTACKS PER DEVICE PER MONTH

4DEVICES IN THE AVERAGE 100 DEVICE ASSET MANAGEMENT AND INVESTMENT FIRM WILL BE SUBJECT TO A MITM ATTACK EACH MONTH



Sideloaded AppsA sideloaded app is defined as an app whose installer is unknown, meaning the app was not installed from an official app store or through an EMM. Most often, they take the form of downloads from third party app stores, application packages installed on Android devices using the USB interface, or IPA files on iOS leveraging a jailbroken device.

The practice of sideloading apps is becoming more common and Android users specifically, are regularly found to be using third party app stores and websites to download the latest apps to their devices, free of charge. Because there’s no security standard nor strict quality requirements regulating the availability of these apps to the public, they have become the perfect entry point for hackers to transport vicious malware straight to employee devices. In the average 100 device asset management and investment firm, there are around 12 sideloaded apps present in corporate owned mobile devices.

12SIDELOADED APPS INSTALLED IN THE AVERAGE 100 DEVICE ASSET MANAGEMENT AND INVESTMENT FIRM

MalwareMalware is among the most troublesome of problems for security teams, and mobile has become the most fertile ground for hackers to operate in. Research from Gartner in 2017 showed that mobile malware had grown by 100% year-on-year, and a concerning number of new attacks are focused on iOS, not just Android.

Analysis of the number of times that known (and unknown) malware was prevented from being installed in the Wandera network reveals how common malware infection typically is for asset management firms. Around 9 corporate owned devices in an average 100 device asset management and investment firm attempt to download malware every month.

It’s a relatively new threat, but we’ve also been monitoring illegitimate crypto resources hammering mobile devices in our network for their CPUs without user consent (background Javascript and/or malware). This threat is also known as “cryptojacking” and has been described as a form of malware. It’s even more sensitive on mobile devices as battery life is more important than oxygen for most users. Our analysis found that within the average 100-device asset management and investment 3 in 100 devices access cryptojacking scripts per month.

MALWARE INCIDENTS PER MONTH IN ASSET MANAGEMENT AND INVESTMENT FIRMS9

MALWARE INCIDENTS PER MONTH IN THE AVERAGE 100 DEVICE ASSET MANAGEMENT AND INVESTMENT FIRM

3INCIDENTS OF CRYPTOJACKING IN THE AVERAGE 100 DEVICE ASSET MANAGEMENT AND INVESTMENT FIRM EVERY MONTH



To find out why the world’s leading firms are working with Wandera, visit

wandera.com/demo

About WanderaWandera provides mobile security and data management solutions. Our customers include some of the world’s largest financial management firms, including Pimco, Fidelity, BNP Paribas, Santander, Rothschild and Man Group. Unlike endpoint mobile threat defense vendors and EMM platforms, Wandera offers protection against phishing attempts, network attacks and malware downloads before they even reach the device. That’s why it was featured as a Leader in the IDC MarketScape for Mobile Threat Management in 2017, just a month after being recognized in Gartner’s Market Guide for Mobile Threat Defense solutions.

Financial services firms are now expected to implement threat defense solutions and ensure they have a robust mobile security strategy in place, especially in light of the upcoming GDPR legislation and a pressing need to prevent data breaches. Mobility leaders also use Wandera to implement intelligent acceptable usage policies, enabling employees to work on the go without security risks or unpredictable cost implications.

Wandera is the global market leader in enterprise mobile security, delivered through its pioneering web gateway. Providing maximum visibility into mobile data, Wandera goes beyond threat detection to prevent attacks and contain data leakage. The solution’s threat intelligence is powered by MI:RIAM, a real-time security engine that analyzes the industry’s largest mobile dataset to uncover new vulnerabilities and zero-day threats as they emerge.

FEBRUARY 2018 - THE STATE OF MOBILE IN ASSET … · According to Accenture’s High Performance...

Documents

Transcript of FEBRUARY 2018 - THE STATE OF MOBILE IN ASSET … · According to Accenture’s High Performance...