Understand Mobile Attack Surface and How to Protect
Approximately 81 percent of financial applications potentially leaked sensitive information.
The use of company issued or personal mobile devices at work boosts employees’ productivity and efficiency. However, it also blurs the lines between mobile devices and data access on these mobile devices, making it possible for cybercriminals to gain access to sensitive enterprise information. As more employees use mobile devices for work and to access sensitive information, it is imperative that companies deploy a Mobile Threat Prevention solution to protect mobile devices and resources from increasingly sophisticated attacks on these devices.
Let’s understand the mobile security risk.
Everyone knows about Pegasus — a spyware program sold to the governments around the world, and it made a big headline after revelations of a campaign targeting thousands of journalists, human rights activists, political leaders and more.
Findings from a mobile threat report published by Zimperium covering 2022 global threat report includes:
# 42% of organizations report mobile devices and web applications have led to a security incident.
# In 2021, there was a 466% increase in exploited, zero-day vulnerabilities used in active attacks against mobile endpoints.
# 75% of the phishing sites analyzed specifically targeted mobile devices and delivered content appropriate for the mobile format.
# Approximately 81% of financial applications potentially leaked sensitive information.
# On average, 77% of Android and 46% of iOS apps use, or potentially use, at least one vulnerable encryption algorithm.
What is the Mobile Threat Prevention Solution? Mobile Threat Defense (MTD) solutions are security tools that are designed to protect mobile devices such as smartphones and tablets from a wide range of security threats, including malware, phishing attacks, network attacks, and device vulnerabilities.
MTD solutions typically include a combination of different security features such as mobile application management (MAM), mobile device management (MDM), threat intelligence, network security, and behavioral analysis etc.
Microsoft Defender for Endpoint is one of the MTD solution available from Microsoft for Android and iOS mobile devices to helps protect organizations and enterprise users by safeguarding their mobile devices from cyber threats, key Capabilities includes:
As for as licensing requirements goes, these capabilities are available part of Microsoft Defender for Endpoint plan 1 and plan 2 licensing.
How to Deploy Defender for Endpoint MTD to Mobile Devices?Deployment of Defender for endpoint on mobile devices can be done via Microsoft Intune and there is separate procedure for Android and iOS-based devices.
Deployment on iOS-based Devices with Microsoft Intune: Before jumping into the deployment aspect, lets quickly understand supervised vs unsupervised device modes and how these defer when it comes to managing and controlling the behavior of these devices.
Supervision is that differentiates element of iOS device management capabilities that helps the IT team to understand whom to provide total control and ownership of the devices. Without iOS supervision, the device can only be partially managed, making the device vulnerable to all possible threats, including data breaches and device theft.
Supervised Mode: Devices in this mode gives companies control over company-owned devices, which is a prerequisite to manage them further. Without supervision, functionalities like Factory Reset, Airdrop Sharing, iBooks, find my iPhone, and iMessage cannot be managed within an iOS device.
Un-Supervised Mode: it’s the opposite of supervised devices, this means that the company’s IT team cannot enforce company policies on unsupervised iOS devices and take full control over it. An administrator can opt for an intuitive MDM tool and push policies and restrictions on an iOS device, but the end-user will continue to have the option to exit, override or even totally erase or disregard the policies.
Personal or BYOD and company owned IOS devices can be enrolled in Intune. Once devices are enrolled, it receives the policies and profiles created by the Intune Administrator. However, this article is only focus on company owned devices and not BYOD or personal devices for the enterprise level security standpoint.
Pre-requisite Requirements:
a. Make sure you have access to the Microsoft Intune admin portal.
b. Device enrollment is done for users, and have a Defender for Endpoint license assigned to use Defender for Endpoint
Deployment Procedure (For both Supervised and Unsupervised devices)
- Login into Microsoft Intune admin center, go to Apps > iOS/iPadOS > Add > iOS store app and click Select.
2. On the Add app page, click on Search the App Store and type Microsoft Defender in the search bar. In the search results section, click on Microsoft Defender and click Select.
3. Select iOS version as the Minimum operating system. Review the rest of information about the app and click Next.
4. In the Assignments section, go to the Required section and select Add group. You can then choose the user group(s) that you would like to target Defender for Endpoint on iOS app. Click Select and then Next.
5. In the Review + Create section, verify information then select Create. In a few moments, the Defender for Endpoint app should be created successfully.
Get Ajay Kumar’s stories in your inbox
Join Medium for free to get updates from this writer.
6. In the Monitor section, select Device install status to verify that the device installation has completed successfully.
Configuration Procedure for Supervised Devices
First step is to configure the device in supervised mode with an app configuration policy and device configuration profile.
a. App configuration policies
- Login into the Microsoft Intune admin portal and go to Apps > App configuration policies > Add. Select Managed devices.
2. In the Create app configuration policy page, provide the following information:
· Policy Name
· Platform: Select iOS/iPadOS
· Targeted app: Select Microsoft Defender for Endpoint from the list
3. In the next screen, select Use configuration designer as the format. Specify the following properties:
· Configuration Key: issupervised
· Value type: String
· Configuration Value: {{issupervised}}
4. Select Next to open the Scope tags page. Scope tags are optional. Select Next to continue.
5. On the Assignments page, select the groups that will receive this profile.
6. Click Next.
7. On the Review + create page, when you’re done, choose Create. The new profile is displayed in the list of configuration profiles.
b. Device Configuration Profile
For devices that runs in Supervised Mode, there is custom .mobileconfig profile, called the ControlFilter profile. This profile enables Web Protection and gives end-users a seamless experience while still being protected from phishing and other web-based attacks.
Once the profile has been downloaded on the device, execute these steps to deploy the custom profile.
1. Login into the Microsoft Intune admin portal
2. Navigate to Devices > iOS/iPadOS > Configuration profiles > Create Profile.
3. Select Profile Type > Templates and Template name > Custom.
4. Provide a name of the profile. When prompted to import a Configuration profile file, select the one downloaded from the previous step.
5. In the Assignment section, select the device group to which you want to apply this profile. As a best practice, this should be applied to all managed iOS devices. Select Next.
6. On the Review + create page, when you’re done, choose Create. The new profile is displayed in the list of configuration profiles.
Deployment Validation
- Once Defender for Endpoint on iOS has been installed on the device, you will see the app icon.
2. Tap the Defender for Endpoint app icon (MSDefender) and follow the on-screen instructions to complete the onboarding steps. The details include end-user acceptance of iOS permissions required by Defender for Endpoint on iOS.
3. Upon successful onboarding, the device will start showing up on the Devices list in the Microsoft 365 Defender portal.
Hope you like the article, please provide your feedback and/or comments in any in the comment section.
