Corporate IT departments tend to be a nervous bunch when it comes to shadow IT and personal mobile apps that employees may be using on the same devices they use for work. And for good reason: Analysis has revealed that several common apps, including Uber, WhatsApp Messenger and Facebook Messenger for Android, present the most risk to enterprise data.
That’s according to Appthority’s third-quarter Enterprise Mobile Security Pulse Report, which also found that the riskiest iOS apps found in enterprises are Facebook, Pandora and Yelp.
These and other popular apps present in enterprise environments have mobile threat risk scores indicative of data leakage and vulnerabilities, the report found.
“Enterprise security teams need to understand which mobile apps are being used, the risks they bring, and how their peers are utilizing mobile threat policies to more effectively secure corporate data,” stated Domingo Guerra, president and co-founder of Appthority. “With BYOD and [corporate owned personally enabled (COPE)] many commonly used app-store approved apps are making their way into enterprises and posing risks to sensitive corporate data. The Pulse report provides a snapshot of what’s happening in the market so mobility and security teams can make informed decisions to protect themselves from the growing number of mobile threats.”
Also this quarter, the apps that are perceived to be the most dangerous in presenting an attack vector into enterprise systems—as determined by which apps are most likely to be blacklisted by security departments—are led by WhatsApp Messenger, Pokémon GO and WinZip for Apple devices, and Poot-debug(W100).apk, an Android System Theme and Where’s My Droid Pro topped the list for Android.
Appthority noted in its report that enterprises blacklist apps for a range of security concerns, including specific malicious or data leakage behaviors, security policy compliance and concerns about shadow data storage. The report shows that in Q3, Android apps that were blacklisted scored in the malicious range because malware was detected. The iOS apps that were blacklisted scored in the data leakage range for sending SMS messages, tracking location or for sending data—including sensitive data—unencrypted.
WinZip reached out to Infosecurity to say that it believes this perceived riskiness on the part of IT departments is unwarranted.
"Our team was extremely disappointed and surprised to read that WinZip for iOS has been mentioned in the Appthority report," a spokesperson told us. "We believe WinZip for iOS has been included in error and have identified incorrect information in their report. WinZip does not send SMS messages as the report stated. This statement is particularly problematic as it is the only reason provided to justify why WinZip for iOS is included on their list."
She added, "As we look into this issue further, we want you to know that we aren't aware of any valid reason why Appthority would consider WinZip for iOS a security risk. WinZip software is very popular with enterprise accounts and security is our top priority. Any security issue reported will be immediately investigated."
Meanwhile, the Pulse report also detailed the most common destination countries for mobile data and the reputation of the URLs used most by mobile apps among Appthority’s enterprise customers. Leading destination countries for the top 150 Android and iOS apps are the United States and Ireland. Android apps, however, connected to a wider set of geographic locations, whereas iOS apps connected less to countries such as China, Saudi Arabia and Chile.