What Enterprises Can Learn from the Apple iPhone Hack

Why enterprises should use the recent Apple iPhone hack as a learning opportunity and make changes to ensure they don’t fall victim to a future attack.

Recently, devices around the world started lighting up with notifications about a new Apple iPhone hack. As users raced to download a patch released by Apple to fix the vulnerability, questions about what went wrong and how to keep it from happening again quickly began to circulate.

This hack, which was discovered by the University of Toronto’s Citizen Lab in mid-September, has been occurring since February 2021. It is part of the ongoing evolution of cyber attacks and comes on the tail end of a year and a half of bad actors looking to exploit new vulnerabilities created by the COVID-19 pandemic. Given that these dangers are unlikely to disappear in the coming months and years, it’s important that enterprises take steps to increase their mobile device security and keep themselves from falling victim to the next attack.

How Did the iPhone Hack Happen

The hack originated with NSO Group, an Israel-based spyware company that offers a proprietary software called Pegasus. Citizen Lab found that government clients of NSO Group were exploiting an iPhone software vulnerability to deploy Pegasus for months before the lab discovered it. While NSO Group says that its spyware is only intended to be used by licensed law enforcement agencies to target terrorists and criminals, investigations have found that the spyware was being used by government clients to target human rights activists and journalists around the world.

Spyware like Pegasus grabs everything from your geographical location and photos to your call logs and contact lists. To make matters worse, the exploit that Citizen Lab identified was a “zero-day” vulnerability, meaning that the bad actors using the spyware could infect a phone without the user having any idea that their device had been hacked.

Fortunately, Apple responded as soon as they were alerted to the vulnerability. They issued a patch for iPhones and iPads that addressed the vulnerability right away and encouraged all device users to install the update immediately. But this fast response doesn’t erase the dangers posed by the hack.

What Enterprises Can Learn from this Breach

Even though the specific danger of this hack has now been addressed, the fact that this vulnerability was being exploited for months without anyone knowing is definitely cause for concern — especially for businesses and organizations that could face devastating consequences if their sensitive information were exploited. After all, exploiting a single mobile device can offer bad actors a back door entrance to an entire network.

At a time when more people than ever are using personal devices for work (often outside company firewalls), it’s critical that enterprises take proactive steps to limit the chances of a successful breach. That means taking this hack as an opportunity to strengthen your mobile security practices.

Essential mobile security best practices for every enterprise include:

• Developing continual patch management procedures: All software is going to have bugs. Fortunately, patch management is designed to find and address these errors before bad actors have a chance to exploit them. Yet far too many enterprises fail to regularly patch their systems, meaning that hackers can get easy access to a network through a known vulnerability. The best way to avoid this is by creating official policies and procedures around patch management that ensure this critical process never falls by the wayside.
• Creating and enforcing strong policies: In addition to patch management procedures, it’s important for enterprises to create strong policies surrounding general mobile security. That means enforcing strong password policies including multi-factor authentication, blocking the use of certain websites on mobile devices used for work, limiting downloads onto those devices, and more.
• Educating employees: Hackers are getting better and better at making their malicious software appear normal, whether it takes the form of a phishing email or a regular GIF extension (as in the case of the Apple iPhone hack). Educating employees on how to identify suspicious emails and avoid clicking on links from unknown sources can help keep enterprises secure.
• Focusing on endpoint security: With more people working from their personal devices, hackers are moving to target these endpoints. Since centralized protection does very little to protect against mobile device attacks, it’s important for enterprises to implement security compliances for each mobile device connecting from outside the office. That means installing special security software on in-house gateways and servers and on mobile devices themselves.

Prioritizing Cybersecurity

The recent Apple iPhone attack is a reminder that mobile devices can be a major vulnerability for enterprises that don’t take proper security measures. The best way to ensure you’re staying safe is by working with a cybersecurity partner like Turn-key Technologies, Inc. (TTI). Our experts can help you manage your patches and updates, improve your endpoint security, create strong policies, and more to ensure you don’t fall victim to the next hack.

Contact TTI today to learn how we can help you boost your mobile device security!