HP 2012 Cyber Risk Report

White paper | HP 2012 Cyber Risk ReportAlthough meaningful information and analysis can be obtained from a forensic device (if accessto such hardware is available), at this time there is no known tool that allows access to theSecure Element information. Secure Element, as the name implies, provides specific securitymechanisms (e.g., access control, encryption, and segregation) to prevent extraction of possiblesensitive information. Therefore, explicit forensic access of the Secure Element is not currentlypossible even with a forensic tool from market leaders.RecommendationsThere are certain actions that organizations can take to mitigate the risk from mobileapplication security vulnerabilities. First, applications need to be manually audited andassessed before the products are launched to determine if any input injection vulnerabilitiesor information leakage vulnerabilities are present. The code should be analyzed via staticanalysis when being developed to find code-based vulnerabilities. As with any application, it’smuch less expensive to address security vulnerabilities during development than once it hasbeen released.Secure data transmission standards should be included as part of any application requirements,especially if those applications are being developed by third-party developers. The same is truefor secure data storage and application logging. Reasonable inter-application communicationexposure and permissions in application requirements should be stringently defined. Theseconcerns should all be addressed in the requirements phase and tested during development.When performing security testing and analysis on mobile applications, the server-side Webservices and APIs that the mobile clients talk to should be taken in context and analyzed forvulnerabilities. High-risk vulnerabilities may be missed if the two are tested out of context witheach other.ConclusionsFor us, this report is a way to provide organizations with the security intelligence they need tobetter understand how to deploy their limited resources so that they can best minimize theirsecurity risk. As such, there are a number of lessons and trends from 2012 that should not beignored either in the coming year or beyond.Vulnerability weaponizationWe will continue to see attackers weaponize vulnerabilities to carry out their malicious agendas.Those who build exploit kits will continue to focus on vulnerabilities in prevalent software, oftentargeting browsers and browser plug-ins, such as Oracle Java and Adobe® Flash. Similarly,we will continue to see a steady rise in the number of publicly disclosed attacks targetingspecific technologies and organizations. Crime organizations, nation states, and hacktivistswill continue to use cyber attacks as a method of leveling the playing field against wealthyor powerful targets, though the true motivations behind attacks will often remain difficultto determine.Mobile vulnerabilitiesThe growth in adoption of mobile technology and its intersection with use in the enterprise willcontinue to introduce considerable risk. As many have noted, the growth of malware on boththe Android and Apple marketplaces continues to climb. The problem is only exacerbated by thefact that enterprises don’t have the same types of control over these devices as they do PCs.As BYOD becomes the enterprise norm, and the adoption of mobile devices continues to grow,expect the commensurate rise in mobile application vulnerabilities to continue unabated for theforeseeable future.21