Mobile Malware · Detection & Defense · Lesson 2 of 5

Enterprise Mobile Defense

Learn how companies manage phones, spot threats and gate access to data.

Managing a fleet of phones

A company with 2,000 employees can't check every phone by hand. Its security team relies on a few tools that work together. NIST's guide for managing mobile devices in the enterprise (SP 800-124 Rev. 2, 2023) covers these for both company-owned and personal phones.

Mobile device management (MDM) is the base layer. You saw in iOS Internals that an enrollment profile connects an iPhone to an MDM server. Android has the same idea through Android Enterprise. Once a phone is enrolled, IT can:

• Require a passcode and encryption.
• Set a minimum OS version or security patch level.
• Push work apps, Wi-Fi and VPN settings.
• Lock a lost phone, or wipe work data.
• See inventory details, such as model, OS version and, on company-owned phones, installed apps.

MDM knows how a phone is configured. It isn't built to spot malware. That's the job of mobile threat defense (MTD), a category of security apps installed on managed phones. Vendors in this space include Lookout, Zimperium, Check Point and Microsoft Defender, among others. An MTD app typically looks for three kinds of risk:

• App risk. Known malware, sideloaded apps, or apps with risky permissions.
• Network risk. For example, a Wi-Fi network that's open to someone intercepting traffic.
• Device risk. An outdated OS, a rooted or jailbroken phone, or a suspicious profile.

The MTD app rates the phone's risk, often low, medium or high, and reports it to the MDM. The MDM can then mark the phone as not compliant, which matters a lot in the next task.

A simpler defense is an app allowlist. On company-owned phones, IT can limit installs to a list of approved apps from a managed store, such as the work version of Google Play. If an app isn't on the list, it can't be installed. That shuts out most of the lures you've studied in this track, because droppers and fake utilities never make the list. The cost is flexibility, so allowlists suit dedicated work phones best.

Conditional access and personal phones

Detection only helps if it changes what happens next. That's where conditional access comes in. It's a rule at the login stage: before a phone can reach company email, files or chat, the service checks whether the device meets the company's requirements. Microsoft's Intune documentation describes one common setup. Intune and Microsoft Entra ID work together so only managed, compliant devices can reach email and Microsoft 365 apps.

Here's how the pieces chain together. An MTD app spots a malicious app and reports high risk. The MDM marks the phone non-compliant. Conditional access then blocks company email on that phone. Once the employee removes the app and the MTD app reports the phone as clean again, access comes back. Nobody has to chase the phone by hand, and company data stays away from a phone that might leak it.

Many employees use their own phones for work, which is called BYOD (bring your own device). Companies want control over work data, and employees reasonably don't want their boss seeing their personal life. Both platforms offer a middle path.

• Android work profile. A separate, walled-off space on the phone for work apps and data. Work apps carry a small briefcase badge. Microsoft's Intune help pages explain that IT manages only work email, apps, settings and data. It can't access personal email, apps or data, and it can't reset or wipe the whole phone. When someone leaves the company, removing the work profile takes work data with it and leaves personal things untouched. You can also pause the work profile after hours.
• iPhone User Enrollment. Apple's version for personal devices. The organization manages only its own accounts, settings and data, using a limited set of controls, and never a person's personal account.

These privacy limits shape investigations too. On a BYOD phone with a work profile, the security team can see that the phone is risky and block access. It usually can't see which personal app caused the problem. The employee has to look, often with guidance from IT.