Mobile Devices Face a Broad Range of Security Threats and Vulnerabilities

Threats to the security of mobile devices and the information they store  and process have been increasing significantly. For example, cyber criminals and hackers have  a variety of attack methods readily available to them, including using  software tools to intercept data as they are transmitted to and from a  mobile device, inserting malicious software code into the operating  systems of mobile devices by including it in seemingly harmless software  applications, and using e-mail phishing techniques to gain access to  mobile-device users’ sensitive information. For example, the number  of variants of malicious software, known as “malware,” aimed at mobile  devices has reportedly risen from about 14,000 to 40,000, a 185 percent  increase in less than a year. A Range of Vulnerabilities Facilitate Attacks

Mobile devices are subject to numerous security vulnerabilities, including  a failure to enable password protection, the inability to intercept malware,  and operating systems that are not kept up to date with the latest security  patches. Security Controls and Practices Identified by Experts Can Reduce Vulnerabilities

Mobile device manufacturers and wireless carriers can implement a  number of technical features, such as enabling passwords and  encryption, to limit or prevent attacks. In addition, consumers can adopt  key practices, such as setting passwords, installing software to combat  malware, and limiting the use of public wireless connections for sensitive  transactions, which also can significantly mitigate the risk that their  devices will be compromised. Although FCC has facilitated public-private  coordination to address specific challenges, such as cellphone theft, and  developed cybersecurity best practices, it has not yet taken similar steps  to encourage device manufacturers and wireless carriers to implement a  more complete industry baseline of mobile security safeguards. Furthermore, DHS, FTC, NIST, and the private sector have taken steps to  raise public awareness about mobile security threats. However, security  experts agree that many consumers still do not know how to protect  themselves from mobile security vulnerabilities. DHS and NIST have not  yet developed performance measures that would allow them to determine  whether they are making progress in improving awareness of mobile  security issues. However,  neither DHS nor NIST has developed a baseline measure of the state of  national cybersecurity awareness. Recommendations for Executive Action

To help mitigate vulnerabilities in mobile devices, we recommend that the  Chairman of the Federal Communications Commission  continue to work with wireless carriers and device manufacturers on  implementing cybersecurity best practices by encouraging them to  implement a complete industry baseline of mobile security safeguards  based on commonly accepted security features and practices; and monitor progress of wireless carriers and device manufacturers in  achieving their milestones and time frames once an industry baseline  of mobile security safeguards has been implemented. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine: (1) what common  security threats and vulnerabilities currently exist in mobile devices, (2)  what security features are currently available and what practices have  been identified to mitigate the risks associated with these vulnerabilities,  and (3) the extent to which government and private entities are  addressing security vulnerabilities of mobile devices. To determine the common security threats and vulnerabilities that  currently exist in mobile devices (cellphones, smartphones, and tablets),  as well as security features and practices to mitigate them, we identified  agencies and private companies with responsibilities in the  telecommunication and cybersecurity arena, and reviewed and analyzed  information security-related websites, white papers, and mobile security  studies.
Why GAO Did This Study

Millions of Americans currently use mobile devicese.g., cellphones, smartphones, and tablet computerson a daily basis to communicate, obtain Internet-based information, and share their own information, photographs, and videos. Given the extent of consumer reliance on mobile interactions, it is increasingly important that these devices be secured from expanding threats to the confidentiality, integrity, and availability of the information they maintain and share.
Accordingly, GAO was asked to determine (1) what common security threats and vulnerabilities affect mobile devices, (2) what security features and practices have been identified to mitigate the risks associated with these vulnerabilities, and (3) the extent to which government and private entities have been addressing the security vulnerabilities of mobile devices. To do so, GAO analyzed publically available mobile security reports, surveys related to consumer cybersecurity practices, as well as statutes, regulations, and agency policies; GAO also interviewed representatives from federal agencies and private companies with responsibilities in telecommunications and cybersecurity.

What GAO Found

Threats to the security of mobile devices and the information they store and process have been increasing significantly. For example, the number of variants of malicious software, known as malware, aimed at mobile devices has reportedly risen from about 14,000 to 40,000 or about 185 percent in less than a year (see figure). Cyber criminals may use a variety of attack methods, including intercepting data as they are transmitted to and from mobile devices and inserting malicious code into software applications to gain access to users sensitive information. These threats and attacks are facilitated by vulnerabilities in the design and configuration of mobile devices, as well as the ways consumers use them. Common vulnerabilities include a failure to enable password protection and operating systems that are not kept up to date with the latest security patches.
Mobile device manufacturers and wireless carriers can implement technical features, such as enabling passwords and encryption to limit or prevent attacks. In addition, consumers can adopt key practices, such as setting passwords and limiting the use of public wireless connections for sensitive transactions, which can significantly mitigate the risk that their devices will be compromised.
Federal agencies and private companies have promoted secure technologies and practices through standards and public private partnerships. Despite these efforts, safeguards have not been consistently implemented. Although the Federal Communications Commission (FCC) has facilitated public-private coordination to address specific challenges such as cellphone theft, it has not yet taken similar steps to encourage device manufacturers and wireless carriers to implement a more complete industry baseline of mobile security safeguards. In addition, many consumers still do not know how to protect themselves from mobile security vulnerabilities, raising questions about the effectiveness of public awareness efforts. The Department of Homeland Security (DHS) and National Institute of Standards and Technology (NIST) have not yet developed performance measures or a baseline understanding of the current state of national cybersecurity awareness that would help them determine whether public awareness efforts are achieving stated goals and objectives.

What GAO Recommends

GAO recommends that FCC encourage the private sector to implement a broad, industry-defined baseline of mobile security safeguards. GAO also recommends that DHS and NIST take steps to better measure progress in raising national cybersecurity awareness. The FCC, DHS, and NIST generally concurred with GAOs recommendations.