Retail Observer

DECEMBER 2015 RETAILOBSERVER.COM 39 2. Make sure your internal development team and/or your outside agency clearly understands and follows secure mobile app development best practices. Today's retail executives shouldn't just assume that their engineers and developers are always following security best practices. When speed-to-market is too often a priority, secure mobile development can fall by the wayside. It's everyone's job within an organization (including the management team) to make secure mobile app development a priority. 3. Build mobile security testing into your app development lifecycle. Secure mobile app development as an iterative process that requires commitment to security at every stage of development. Ongoing testing and security audits critical to identifying potential vulnerabilities, fixing the problem and preventing risk to the organization and customers. Ensure that your mobile security strategy addresses the unique challenges of the technology, and is not just repurposing traditional computing security solutions. Mobile is different and requires mobile-centric security solutions. It's critical to use security tools that specifically address the unique and evolving needs of mobile apps. Using outdated and generic solutions geared towards Web security in an effort to save time and money, will only leave a brand's mobile ecosystem at risk. 4. Understand the threat landscape and the latest known mobile security vulnerabilities. Cyber attacks tend to increase during the holiday shopping season and with the increase of mobile traffic to native apps and mobile sites, cyber- criminals will be aggressively exploiting mobile vulnerabilities. Understanding internal and external threat landscapes will allow for organizations to better prepare for and prevent a possible attack. Mobile has greatly increased the number devices that threaten retailers—large and small. Any device that touches a retailer's mobile ecosystem can impact its security—including company- owned, employee, vendor and customer devices. In addition to devices, user activity and actions on those devices significantly impact the overall health of a retailer's mobile environment. In fact, a study by NowSecure revealed that 43% of smartphones don't have a password, PIN or pattern lock on their device and 50% connect to unsecured WiFi at least once a month. If that wasn't scary enough, 48% of mobile apps on any given device have at least one major security vulnerability that either leaks sensitive data or allows unauthorized access to sensitive data. Protecting an organization from mobile threats requires being proactive, unrelenting and knowledgeable about the threat landscape and the solutions that work. Mobile devices require a different type of incident response and enterprise executives need to ask the right questions in order to prevent a devastating attack before it ever happens. The mobile security experts at NowSecure have highlighted the 10 most important questions any retailer should be asking about how secure their mobile ecosystem really is and what measures they have in place to protect their mobile data and prevent attacks: 1. Do the apps you or your outside agency develop follow best practices for security? 2. Do you have visibility into the security of the mobile devices impacting your organization? 3. Is mobile security testing built in to your app development lifecycle? 4. How secure are the third-party mobile applications on connected devices? 5. Are your employees trained on mobile security best practices? 6. Are there any restrictions in place to the kinds of corporate data that may be accessed by employees using their personal mobile devices? 7. Does your company have a comprehensive mobile incident response strategy in place? 8. Does your mobile security strategy address the unique challenges of the technology, or is it really just a repurposing of your traditional computing security solution? 9. How do you keep up to date with of the latest known mobile security vulnerabilities? 10. What criteria and analytics do you use to perform quantitative mobile risk assessment evaluations? RO Andrew Hoog, Co-Founder & CEO of NowSecure. www.nowsecure.com

• Cover