Why enterprises should use the recent Apple iPhone hack as a learning opportunity and make changes to ensure they don’t fall victim to a future attack.
Recently, devices around the world started lighting up with notifications about a new Apple iPhone hack. As users raced to download a patch released by Apple to fix the vulnerability, questions about what went wrong and how to keep it from happening again quickly began to circulate.
This hack, which was discovered by the University of Toronto’s Citizen Lab in mid-September, has been occurring since February 2021. It is part of the ongoing evolution of cyber attacks and comes on the tail end of a year and a half of bad actors looking to exploit new vulnerabilities created by the COVID-19 pandemic. Given that these dangers are unlikely to disappear in the coming months and years, it’s important that enterprises take steps to increase their mobile device security and keep themselves from falling victim to the next attack.
The hack originated with NSO Group, an Israel-based spyware company that offers a proprietary software called Pegasus. Citizen Lab found that government clients of NSO Group were exploiting an iPhone software vulnerability to deploy Pegasus for months before the lab discovered it. While NSO Group says that its spyware is only intended to be used by licensed law enforcement agencies to target terrorists and criminals, investigations have found that the spyware was being used by government clients to target human rights activists and journalists around the world.
Spyware like Pegasus grabs everything from your geographical location and photos to your call logs and contact lists. To make matters worse, the exploit that Citizen Lab identified was a “zero-day” vulnerability, meaning that the bad actors using the spyware could infect a phone without the user having any idea that their device had been hacked.
Fortunately, Apple responded as soon as they were alerted to the vulnerability. They issued a patch for iPhones and iPads that addressed the vulnerability right away and encouraged all device users to install the update immediately. But this fast response doesn’t erase the dangers posed by the hack.
Even though the specific danger of this hack has now been addressed, the fact that this vulnerability was being exploited for months without anyone knowing is definitely cause for concern — especially for businesses and organizations that could face devastating consequences if their sensitive information were exploited. After all, exploiting a single mobile device can offer bad actors a back door entrance to an entire network.
At a time when more people than ever are using personal devices for work (often outside company firewalls), it’s critical that enterprises take proactive steps to limit the chances of a successful breach. That means taking this hack as an opportunity to strengthen your mobile security practices.
Essential mobile security best practices for every enterprise include:
The recent Apple iPhone attack is a reminder that mobile devices can be a major vulnerability for enterprises that don’t take proper security measures. The best way to ensure you’re staying safe is by working with a cybersecurity partner like Turn-key Technologies, Inc. (TTI). Our experts can help you manage your patches and updates, improve your endpoint security, create strong policies, and more to ensure you don’t fall victim to the next hack.
Contact TTI today to learn how we can help you boost your mobile device security!