Research results from a 2017 mobile security study of over 1,900 cybersecurity professionals on their perceptions of mobile risks and threats. In contrast, Zimperium provides data from its Global Threat Intelligence on the realities of mobile risks and threats seen on mobile devices.

1. All Rights Reserved © 2017 0
Mobile Security 2017:
Perceptions vs. Device-harvested Reality
JT Keating
Vice President of Product Strategy, Zimperium
Holger Schulze
Founder, LinkedIn Information Security Community

2. All Rights Reserved © 2017 1
Mobile Threats
Are Everywhere
24% of organizations suffered a
mobile security breach,
primarily driven by malware and
malicious Wi-Fi
43% were unsure if mobile security
incidents had occurred
Network AttacksApplication Attacks
Device Attacks Privacy Violations
Source: 2017 Mobile Security Spotlight, Zimperium, Inc.

3. 2
Risk Is Escalating Rapidly
Source: CVE.Mitre.org
0
100
200
300
400
500
600
700
800
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
Known
CVEs

4. All Rights Reserved © 2017 3
Mobile Compromise
Assets
Risk to Enterprise
Access
Emails Pictures Company
Confidential
files
Technology Contacts Calendar
Credentials
Email Servers Document Repositories
Enterprise Apps Corporate Servers
Further compromise…

5. All Rights Reserved © 2017 4
Q: How has the volume of mobile device threats targeting your users’ smartphones and tablets changed in the past 12 months?
Mobile Security Threats
17%
30%
39%
7%
7%
47%see increase in
mobile threats
Significant rise
Modest increase
No change
Modest decrease
Significant decrease
Source: 2017 Mobile Security Spotlight

6. All Rights Reserved © 2017 5
Mobile Security Breaches
Q: How many of your mobile devices were hacked or had data leaks?
11001010110010101
010PASSWORD100
11001010110010101
11001010110010101
33%
None
43%
Can't
disclose
16%
Up to-25%
4%
26-50%
3%
51-75%
1
%
51-75%
Source: 2017 Mobile Security Spotlight

7. All Rights Reserved © 2017 6
BYOD Security Concerns
Q: What are your main security concerns related to BYOD?
69%
Data leakage
/loss
64%
Users download unsafe
apps or content
63%
Malware
DOWNLOAD
Lost or stolen devices 61% | Unauthorized access to company data and systems 58% | Vulnerability exploits 49% | Inability to control endpoint security 45% | Device management 41% | Network attacks via WiFi 38% |
Ensuring security software is up-to-date 38% | Compliance with regulations 32%
Source: 2017 Mobile Security Spotlight

8. Patented z9™ detection
engine uses machine learning
to provide real-time, on-device
protection against both known
and unknown threats, enabling
detection and remediation of
attacks on all three mobile
threat DNA levels.
Network Attacks
Application Attacks
Device Attacks
ONE ENGINE

9. 8
0% 10% 20% 30% 40%
Malicious Profiles
Configuration Risk
OS Vulnerability
Device Risks
Source: Zimperium Global Threat Intelligence

10. All Rights Reserved © 2017 9
Q: Have any of your BYO or corporate-owned devices connected to a malicious Wi-Fi in the past?
Malicious Wi-Fi
22%
NO
59%
Not Sure
Can't disclose
19%
YES
Source: 2017 Mobile Security Spotlight

11. 10
0% 1% 2% 3% 4% 5% 6% 7% 8%
Rogue AP
SSL Strip
MITM Attacks
Reconnaisance Scans
Network Forensic Detections
Source: Zimperium Global Threat Intelligence

12. All Rights Reserved © 2017 11
Q: Have any of your BYO or corporate-owned devices downloaded malware in the past?
21%
NO
28%
YES
51%
Not Sure
Can't disclose
Malware Threat
Source: 2017 Mobile Security Spotlight

13. All Rights Reserved © 2017 12
Q: Are you concerned about introducing security or privacy risks in the apps you develop for your customers?
24%
NO
18%
Not Sure
Can't disclose
59%
YES
Security Risks in Apps
Source: 2017 Mobile Security Spotlight

14. 13
Android Specific Risks
0% 20% 40% 60% 80% 100%
High Risk Configuration
Extreme Risk Configuration
Malicious Apps
OS Vulnerability
Source: Zimperium Global Threat Intelligence

15. 14
0% 10% 20% 30% 40%
Malicious Profile
App Using Weak Encryption
App Accessing Private
Frameworks
App Sends Private Info
OS Vulnerability
iOS Specific Risks
Source: Zimperium Global Threat Intelligence

16. All Rights Reserved © 2017 15
4%
Budget
will decline
Mobile Security Budget
70%Budget will stay flat
Q: How is your mobile security budget going to change over the next 12 months?
26% Budget
will increase
Source: 2017 Mobile Security Spotlight

17. All Rights Reserved © 2017 16
Q: What is your biggest pain point when it comes to mobile security?
44%PROTECTION
We need a solution that not only
detects threats but also remediates them
based on the corporate policy
22%INTEGRATION
We need a mobile security solution that
integrates with our existing network (e.g., SIEM),
endpoint (e.g., MDM or EMM), or ITSM
(e.g., System Center) platforms
20%VISIBILITY
We need to see all affected devices
and the types of threats
14%
NONE
Key Mobile Security Requirements
Source: 2017 Mobile Security Spotlight

18. All Rights Reserved © 2017 17
Password
protection
77%
username
Remote
wipe
Device
encryption
Data removal at
employee separation or
device disposal
72% 69% 63% 19%
None
Q: Which of the following mobile security technologies are in place?
Mobile Security Technologies
Mobile device management (MDM) 58% | Mobile device file/data encryption 48% | VPN to onpremises security gateway 47% | Endpoint security tools 43% | Device management 41% | Mobile device antivirus/antimalware 39% |
Network access control (NAC) 38% | DLP / Access Control 37% | Mobile application management (MAM) 33% | Auditing of mobile devices 30% | Virtual desktop infrastructure (VDI) 30% | VPN to cloudbased security gateway 29% |
Containerization/microvirtualization 23% | Automated remediation using other security systems 22% | Mobile Threat Detection & Management (MTM) 22% | Attack and penetration testing of mobile applications 22% | None 19% | Not
sure 32%
Source: 2017 Mobile Security Spotlight

19. All Rights Reserved © 2017 18
Q: In your opinion, what key capabilities are required for Mobile Threat Management?
64%Logging, monitoring
and reporting
56%
Network / WiFi
attack defense
Cross-platform
support
Role-based
access control
Device
configuration
Integration with other
Endpoint Management
Systems
44%46%
LOG
68%
Malware
protection
59%Ease of
deployment
56%Vulnerability
exploit defense
52% 47%
App Risk
Detection
44%
Key Requirements for MTM
Source: 2017 Mobile Security Spotlight

20. All Rights Reserved © 2017 19
Case Study: Large Technology Enterprise
Need
❯ Proactive Risk Management for mobile devices - critical OS vulnerabilities
❯ Automate access to corporate IT services based on measurable device risk
Baseline Research
❯ 60% of devices accessing IT services highly vulnerable
Results
❯ Mitigated Risk from vulnerable devices
❯ Visibility into threat landscape
❯ Understand potential risk and data loss via legitimate applications across iOS & Android
❯ Detailed reports to support justification for blocking or restricting access to high risk apps
❯ Visibility of iOS exploitation attacks such as Pegasus
❯ iOS risk perspective and analysis
”This has delivered value in
the first 30 days of
deployment”
– Directory, Risk Management Workflow

21. All Rights Reserved © 2017 20
Fit With Mobile / Security Workflows and Tools
Identity & Access
Management Policy and
Governance
EMM
zIPS app,
Policy Updates
Risk Posture,
Policy Change
Device
Information &
Meta data
Threat event processing &
advanced threat analytics
SIEM
Threat event
data & forensics

22. 21