Malware on the move

I have been participating in a series of seminars around North America with a leading anti-malware company, discussing the growing problem of malware and the impacts it is having on organizations large and small. At several of these seminars, I have asked the audience members if they have any sort of anti-virus software installed on their mobile devices. Out of all the times I have asked the question, only one person indicated that they have any sort of anti-virus or anti-malware capability on their mobile device.

What this means is that there is an enormous vulnerability for corporate networks given that smartphones and other mobile devices are used extensively for accessing corporate email, the Web, etc. For example, a study we did in late 2009 found that 12% of email users check their work-related email from home using a smartphone as the primary way of doing that. Many users are not going in through a VPN or other secure tunnel, instead relying on their home Wi-Fi network or their carrier’s network, potentially allowing malware and other bad stuff into their mobile device and then into their corporate network.

The problem is not a theoretical one. Malware was first discovered for the Symbian platform in June 2004 and for the Windows CE platform a month later. Last year saw the introduction of a variety of new malware aimed at the iPhone and Android platforms. Today, there are hundreds of mobile-specific threats – I anticipate that the number of such threats will grow dramatically this year with the increasing adoption of mobile devices as a means of accessing corporate email systems, the Web, Web 2.0 applications and the like.

There are a variety of tools you can install on a mobile device to thwart malware, including:

• Airscanner AntiVirus for Windows Mobile (http://www.airscanner.com/downloads/av/av.html)
• F-Secure Mobile Security (http://campaigns.f-secure.com/mobile-security/index.html)
• Kaspersky Mobile Security (http://www.kaspersky.com/mobile_downloads)
• NetQin Mobile Antivirus (http://www.netqin.com/en/products/antivirus/)
• Norton Smartphone Security (http://www.symantec-norton.com/Norton_Smartphone_Security_p36.aspx)
• Trend Micro Mobile Security (http://us.trendmicro.com/us/products/mobile-security/)

The bottom line is that mobile devices are now indispensable for anyone who travels, as well as for many who use them in an office or when working from home. Not having good anti-malware capabilities for these devices, whether deployed on the device itself or through some other means, means additional risk that organizations should simply not take.