- 86% of enterprise executives say that mobile threats are growing faster than any other according to Verizon’s Mobile Security Index 2019 and 67% of enterprise execs are less confident about the security of their mobile devices compared to other IT assets.
- Mobile devices are hackers’ favorite platform to target, with over 905,000 malware packages installed in Q1 of this year alone and over 5.3 million in 2018, according to Statistica.
- 38% of mobile devices introduce unnecessary risk into the organization based on an analysis of privacy and security settings according to MobileIron’s Global Threat Report.
Mobile devices reflect you and your customers’ identity in the many apps, data, and ongoing activities you and they choose to engage in. Every enterprise looking to reinvent itself by scaling digital business strategies is putting mobile devices at the center of growth plans because they are everyone’s identity.
89% of security leaders believe that mobile devices will serve as your digital ID to access enterprise services and data in the near future according to a recent survey by IDG completed in conjunction with MobileIron, titled Say Goodbye to Passwords. You can download a copy of the study here. Mobile devices are increasingly becoming the IDs enterprises rely on to create and scale a mobile-centric zero trust security network throughout their organizations.
Enterprises are relying on mobile devices more than ever before, personalizing them for each associate or employee to launch and scale new business initiatives. These factors combined are leading to a rapid expansion of, and reliance on mobile devices as the single digital ID enterprises rely on to enable perimeter-less borders. The following IDG survey results reflect enterprise security leaders’ prediction of when mobile devices will authenticate Identity Access Management (IAM):
Passwords Aren’t Strong Enough For A Zero Trust World
The bottom line is that passwords are the weakest defense in a zero-trust world. Ineffective in stopping privileged credential-based breaches, with the most privileged system access credentials shared and at times resold by insiders, passwords give hackers a key to the front door of enterprises’ systems. They no longer have to hack their way in; stolen or purchased passwords and privileged access credentials available on the Dark Web-enable hackers to use the front door of enterprise IT.
Both the IDG study published in conjunction with MobileIron, Say Goodbye to Passwords and Passwordless Authentication: Bridging the Gap Between High-Security and Low-Friction Identity Management by Enterprise Management Associates (EMA) validate how weak passwords are in a zero-trust world and the many reasons they need to go. Here are a few of the many factors that favor move beyond passwords to mobile-centric zero-trust security framework:
- While 95% of enterprise executives say they have multi-factor authentication (MFA) implemented, a little more than half of their users are using it. Senior security executives say they doubt the security benefits (36%), expense (33%), and the decision that users don’t access sensitive information (45%), making MFA pointless.
- 86% of senior security executives would dump password use as an authentication method if they could. In fact, nearly half of those surveyed cited eliminating passwords as a way to cut almost half of all breach attempts. Perceived security shortcomings are a key reason why almost three-quarters of these security leaders say they’re actively looking for replacements for passwords for authentication.
- 62% of the senior security execs reported extreme user irritation with password lockouts. The percentage of respondents who reported extreme user frustration at password lockouts rose to 67% at companies with more than 5,000 employees. Users having to call in and change their password with IT’s help is a major drain on productivity and worker’s time. Senior security executives want to abandon passwords given how high maintenance they are to support and how they drain time and productivity from any organization.
Creating A Mobile Zero Trust Network
The new reality for any enterprise is that mobile device identities are the new security perimeter. Mobility devices ranging from smartphones to tablets are exponentially expanding the threat surfaces that enterprises need to secure and passwords aren’t scaling to do the job. Instead of just relying on a password, secure access needs to be determined by a “never trust, always verify” approach that requires verification of the device, user, apps, networks, and evaluation of the presence of threats before granting access.
The formidable challenges of securing a perimeter-less enterprise where the mobile device identities are the new security perimeter need a mobile-centric zero-trust network to succeed. Zero trust validates the device, establishes user context, checks app authorization, verifies the network, and detects and remediates threats—all before granting secure access to any device or user. Zero trust platforms are built on unified endpoint management (UEM) systems and their enabling technologies including zero sign-on (ZSO) user and device authentication, multi-factor authentication (MFA), and mobile threat detection (MTD). The following illustration reflects best practices in provisioning, granting access, protecting, enforcing, and provisioning access privileges for a mobile Zero Trust network.
Conclusion
Your smartphone or mobile device of choice is increasingly going to become your ID and secure access to resources across the enterprises you work for. Passwords have proven to be ineffective in thwarting the most common source of breaches, which is privileged credential abuse. Enterprise executives interviewed for two completely different studies reached the same conclusion: IT infrastructure will be much safer once passwords are gone.