Earlier this month, it was discovered that a vulnerability in Facebook’s WhatsApp messaging app could be exploited to inject commercial spyware onto Android and iOS phones by simply calling the target. Once infected, the phones’ camera and mic, emails, messages as well as the user’s location data could all be exposed. WhatsApp, which is Facebook’s flagship messaging platform, is adopted by about 1.5 billion users worldwide. WhatsApp also recently celebrated one year of its Business App, which is used in the enterprise and has over 5 million businesses on its platform.
Leveraging a consumer product/platform like WhatsApp for enterprise applications is a relatively new trend which builds on a decade long shift towards digitization. This fundamental shift has caused an exponential decrease in the cost of digital technology and put powerful computers and communication devices into the hands of everyday consumers. Furthermore, thousands of applications specifically designed to operate on these devices have successfully delivered rich consumer experiences ranging from communication and e-commerce to social networks. These end users are also employees at enterprises and their expectations for enterprise experience is conditioned by their experiences in their everyday lives. In fact, a recent survey by VMware which was further reiterated by a Forrester report found that Modern Digital Experience – meaning, employees being productive from any device and any physical location – is linked with company growth, competitive position, and employee sentiment.
As enterprises strive to scale their business and provide consumer-like experiences to enterprise applications, its important for them to make security intrinsic to their products to allow them to be proactive in thwarting security vulnerabilities. WhatsApp is often lauded for its end-to-end encryption, both for messaging and voice calls. This event, however, sheds lights on the fact that encryption alone does not secure the device or the data that the device accesses. In addition, as per Facebook’s security advisory CVE-2019-3568, this issue affected WhatsApp for individuals and WhatsApp for businesses across iOS, Android and Tizen operating systems and a multitude of end-user mobile devices. While vulnerability to personal information via WhatsApp’s individual accounts can be disastrous, exploitation of enterprise data and confidentiality can be catastrophic to a business.
Staying ahead of threats like the WhatsApp security vulnerability isn’t easy, but a good first step is to ensure apps and operating systems are up to date. Specifically to WhatsApp in the enterprise, IT can leverage VMware Workspace ONE to simply and effectively push updates to the app on all types of devices, including iOS and Android. Using Workspace ONE, IT has the ability to deploy policies to enable auto-update to apps on. Using Workspace ONE Intelligence, IT can also set up automation to continuously look for versions of WhatsApp Business that are vulnerable to this exploit and then push updates as needed. This model shifts IT from manual processes to data-driven, automated processes which improves an organization’s security posture.
To further address the dual needs of consumer simplicity and enterprise security across a heterogeneous environment, enterprises can use Workspace ONE’s easy-to-use dashboard and intrinsic security capabilities such as access management, app protection, and data loss prevention (DLP) policies. In addition, by partnering with other leading security vendors through Workspace ONE Trust Network, we’re taking advantage of aggregated threat intelligence to help secure the entire digital workspace.
In a modern enterprise, it’s not a matter of if an organization will encounter a cyber-attack, but when. This cyber-attack at WhatsApp is not the first such event we will witness and certainly not the last. Cyber-security attacks continue to get more sophisticated and while not all such attacks can be prevented, Workspace ONE can help reduce the attack surface and remediate effectively. For more information on Workspace ONE, visit workspaceone.com.
