40% Large Companies Mobile Apps Subscribers Unsecured - Study

Worrisome findings of a study released by IBM and the Ponemon Institute show that nearly 40% of large companies, including many in the Fortune 500, are not taking the right precautions to secure the mobile apps they build for customers.

The study also found organizations are poorly protecting their corporate and BYOD mobile devices against cyber-attacks – opening the door for hackers to easily access user, corporate and customer data.

The research indicated an alarming state of mobile insecurity, as the number of mobile cyber-security attacks is continuing to mount.

At any given time, malicious code is infecting more than 11.6 million mobile devices.

The Ponemon Institute and IBM study, which researched security practices in over 400 large organizations, found that the average company tests less than half of the mobile apps they build.

Also, 33% of companies never test their apps - creating a plethora of entry points to tap into business data via unsecured devices.

While shocking, this is not surprising, given that a full 50% of these organizations were found to devote zero budget whatsoever towards mobile security.

“Building security into mobile apps is not top of mind for companies, giving hackers the opportunity to easily reverse engineer apps, jailbreak mobile devices and tap into confidential data,” said Caleb Barlow, vice president of Mobile Management and Security at IBM.

Barlow added that, “Industries need to think about security at the same level on which highly efficient, collaborative cyber criminals are planning attacks. To help companies adopt smart mobile strategies, we've tapped the deep security expertise of IBM Security Trusteer, bringing what we've learned from protecting the most sensitive data of complex organizations - such as top global banks - and applying it to mobile.”

Hackers are now taking advantage of the popularity of insecure mobile apps, public WiFi networks, and more to break into the highly valuable data often housed on BYOD and corporate mobile devices.

Further, they are also tapping mobile devices as an entry portal into an organization’s broader, highly confidential internal network.

The Ponemon Institute Unveils an Alarming State of Mobile Insecurity

Among organizations represented in the study, each spent an average of $34 million annually on mobile app development.

Of this tremendous budget, however, only 5.5% is currently being allocated to ensuring that mobile apps are secure against cyber-attacks before they are made available to users.

A full 50% of companies devote no budget whatsoever.

Tending to prioritize speed-to-market and user experience, the study found that many of these organizations scan their mobile apps for security vulnerabilities infrequently and much too late – if at all – leaving entry points which hackers are increasingly exploiting.

These holes allow cyber-thieves to gain access to confidential business and personal data through BYOD or corporate mobile devices.

In 2014 alone, over 1 billion personal data records were compromised as a result of cyber-attacks2.

During the creation of mobile apps, end user convenience is trumping end user security and privacy.

According to the study, 65% of organizations state the security of their apps is often put at risk because of customer demand or need, and 77% cite “rush to release” pressures as a primary reason why mobile apps contain vulnerable code.

Of the companies that actually do scan for vulnerabilities before deploying apps to the market, only 15% of them test their apps as frequently as needed to be effective