Apple security trends: What's on the horizon?
Apple Macs used to be considered near-impenetrable, but Steve Kelly says an evolving threat landscape, maturing marketplace and increase in business use means that reputation is changing rapidly.
Steve Kelly, president, Intego & Flextivity
Apple's operating system (OS X) has been the centre of some negative press recently. A recent report claimed OS X was the ‘most vulnerable software of 2015'. From our perspective, this is not true.
Considering our position in the security industry, this viewpoint might surprise readers so it is important to add some context. The claim derived from an industry research project analysing CVE identifiers. However, as respected industry analyst Graham Cluley pointed out, the findings assume that the greater the number of security advisories issued, the more insecure the platform.
What the research doesn't take into account is how severe each vulnerability actually is, the potential impact, or whether the vulnerability was even exploited. Ultimately, the research requires more detail to provide a true overview of the security landscape.
That said, there are definitely a number of OS X threats businesses should be aware of, both native to the operating system and also within the wider security sphere.
The number of Apple users continued to grow last year; a rise that was accompanied by greater interest from the hacking community. Yes, there was new Mac malware, but the most prevalent threats were data breaches, including state-sponsored hacking and a desire to expose corporate and consumer data for ethical and financial reasons.*
A notorious case was the Ashley Madison breach, which generated sensational headlines and sleepless nights for the site's 37 million members. These types of attacks affect Apple and Windows users alike – hackers are indiscriminate with their targets.
Incidents involving weak passwords continued to affect companies. This is partly due to less security-inclined employees who require guidance to counter weak password practices, staff unwillingness to follow security policies, ove-rconfidence in the quality of an installed security solution, insecure personal browsing habits and general inexperience with the modern threat landscape.
These concerns are intensified within the context of 2015's most popular corporate buzzword, the Internet of Things (IoT). The IoT has made progress in demonstrating the positive impact it can have on business processes, but it also means that any productivity benefits are quickly followed by cyber-criminals searching for exploits.
We expect insecure IoT end-points to be a major security topic in 2016. Many of us are choosing to trade personal information for convenience and multi-device data syncing expands the complexity of our personal networks and integration with corporate systems, which in the process opens up new avenues for cyber-criminals to take advantage of.
Holding you hostage
If we delve deeper into more targeted threats, 2016 could also be the year that Ransomware is treated with the caution it warrants.
Ransomware tactics have already proved to be a popular, profitable approach for cyber-criminals intent on extorting money from individual victims. Strategies often include a damaging mix of malware, the perception of urgency, sophisticated behavioural engineering and guilt if ‘embarrassing data' is involved. This is a concerning combination for anyone that has become a target.
Beyond personal cases, businesses are equally at risk. Both local data and cloud services offer opportunities for cyber-criminals to intercept data and block access for financial payments. Due to the nature of its software architecture, OS X users are currently at less risk from the effects of Ransomware, however just because the platform is better protected now, does not mean it always will be.
Furthermore, Ransomware represents a wider ecosystem of financially-related phishing, social scams and corporate misrepresentation. A common example is fake CEO emails, which prompt accounting employees to approve bogus payments to foreign bank accounts.
The final trend that could be significant this year is faux advertising, especially now Apple has implemented ad-blocking on iOS. Advertising departments have to identify new strategies to effectively communicate with their target audiences and as a result, cyber-criminals are adapting to users that are in more control of what they see online.
Apple security may give observers the impression it is a more stable, slower paced threat landscape, but broadening threats mean businesses need to consider more than just Mac malware. The industry's variety is expanding every day and while we hope many of the above predictions do not come to fruition, it is possible that many might well come true.
*Note - this report was written prior to the recent controversy regarding US authorities seeking access to data on a particular terrorist's iPhone.