The Department of Homeland Security (DHS) has submitted a report to Congress that details current and emerging threats to the Federal government’s use of mobile device, recommending security improvements within the mobile device ecosystem, the agency announced Thursday.
The study found that the threats to the Federal government’s use of mobile devices — smartphones and tablet computers running mobile operating systems — exist across all elements of the mobile ecosystem.
These threats require a security approach that differs substantially from the protections developed for desktop workstations largely because mobile devices are exposed to a distinct set of threats, frequently operate outside of enterprise protections and have evolved independently of desktop architectures.
“The Study on Mobile Device Security has found that threats to the mobile device ecosystem are growing, but also that the security of mobile computing is improving,” said Dr. Robert Griffin, Under Secretary (Acting) for Science and Technology. “It outlines several important recommendations to strengthen security that will help the Federal government keep pace with current and emerging threats.”
Threats to mobile devices range from those perpetrated by nation-states, organized crime or hackers to loss or theft of mobile phones. Additionally, threats that target consumers — such as social engineering, ransomware, banking fraud, eavesdropping, identity theft, and theft of services or sensitive data — also impact Federal government users, according to the study.
Further, Federal government mobile device users may be targeted with additional threats simply because they are public-sector employees. Lastly, the study warns that Federal government mobile devices could become an avenue to attack back-end computer systems containing the data of millions of Americans and sensitive information related to Federal government functions.
The DHS Science and Technology Directorate (S&T) led the study in coordination with the National Institute of Standards and Technology and its National Cybersecurity Center of Excellence.
The study, which also drew support from the Department of Defense and General Services Administration, presents a series of recommendations to enhance Federal government mobile device security. Key recommendations include:
- Adopt a framework for mobile device security based on existing standards and best practices.
- Enhance Federal Information Security Modernization Act (FISMA) metrics to focus on securing mobile devices, applications and network infrastructure.
- Include mobility within the Continuous Diagnostics and Mitigation program to address the security of mobile devices and applications with capabilities that are on par with other network devices (e.g., workstations and servers).
- Continue the DHS S&T applied research program in Mobile Application Security to enable the secure use of mobile applications for government use.
- Establish a new program in mobile threat information sharing to address mobile malware and vulnerabilities, including ways to handle Common Vulnerabilities and Exposures generation.
- Coordinate the adoption and advancement of mobile security technologies into operational programs to ensure that future capabilities include protection and defense against mobile threats.
- Develop cooperative arrangements and capabilities with mobile network operators to detect, protect against, and respond to threats (e.g., SS7/Diameter vulnerabilities, rogue IMSI catchers) and, if necessary, extend the legal authorities of the DHS National Protection and Programs Directorate to achieve these objectives.
- Create a new defensive security research program to address vulnerabilities in mobile network infrastructure and increase security and resilience.
- Increase active participation by the Federal government in key mobile-related standards bodies and industry associations.
- Develop policies and procedures regarding U.S. Government use of mobile devices overseas based on threat intelligence and emerging attacker tactics, techniques, and procedures.
DHS has a responsibility to not only secure the means of communication used by departments and agencies, but to safeguard the nation against emerging threats in both the physical and cyber domains.