Cybersecurity is no longer a luxury but an absolute necessity, especially for organizations using sensitive information. One of the most underestimated risks in high-risk environments is the use of smartphones. How can we ensure that mobile devices do not become weak links in the security chain? Eddy Boot, Director of dcypher, shares his insights on the challenges and strategies for mobile security.
The growing threat to mobile security
Our smartphones are always connected to the internet, day and night, filled with personal data, and continuously exposed to cyber threats. Hackers exploit these vulnerabilities, making mobile devices a weak link in an organization’s security. Security experts warn that traditional measures are no longer sufficient.
“We are falling behind in security,” says Boot. “Threats evolve faster than our defenses. Reactive security is not enough; we need to adopt ‘security by design’.” Instead of being treated as standalone elements, mobile devices must be fully integrated endpoints within an organization’s broader cybersecurity strategy.
Geopolitical risks
In high-risk environments such as government institutions, critical infrastructure, and companies essential to national security, additional risks arise. Geopolitical threats, espionage, and cyberattacks from foreign actors make digital security even more complex. Eddy Boot points out that smartphones have evolved into real instruments for espionage. “Governments and businesses are increasingly becoming targets, and smartphones can be exploited as listening devices.”
The current state of security: a wake-up call for CISOs
Despite growing threats, organizations still rely on basic security measures, such as standard smartphone controls, antivirus software, or general awareness training. However, according to Boot, these basic measures are inadequate against modern threats like zero-click exploits and deepfake phishing. “Current security strategies are no longer effective against increasingly sophisticated attacks,” he warns. The key is implementing multi-layered security.
CISOs and CIOs must take a more initiative-taking role in transitioning to a secure mobile infrastructure. Instead of being an afterthought, mobile security must be a key strategic priority. To ensure proper security, mobile devices must be treated with the same level of protection as critical IT infrastructure, requiring a mindset overhaul.
Strategies for stronger mobile security
To enhance mobile and multi-layered security, Eddy Boot offers three key recommendations for high-risk environments:
- Zero trust for mobile: mobile devices should be subject to the same stringent security protocols as other IT systems. No device or user should be trusted by default, ensuring continuous verification and risk minimization. dcypher facilitates knowledge sharing among governments, businesses, and researchers to implement Zero Trust and develop best practices.
- Awareness and training: organizations must educate employees to recognize advanced cyber threats. A well-informed workforce serves as the first line of defense against cybercriminals. Regular training sessions and awareness campaigns are essential.
- Security by design: organizations should prioritize hardware and software designed with security as a core principle from the outset. This means choosing devices that receive continuous updates and incorporate built-in hardware security against the latest threats.
dcypher: a critical player in IT security innovation
As a government organization driving innovation in IT security, dcypher plays a leading role in identifying emerging trends and risks in digital security. By raising awareness and engaging private-sector stakeholders, dcypher fosters the development of innovative solutions.
Beyond identifying risks, dcypher promotes collaboration between the public and private sectors to enhance digital resilience in the Netherlands. As part of its mission, dcypher has organized multiple roundtable discussions with CISOs and cybersecurity experts focused on mobile security.
These discussions, featuring participants such as Fox Crypto and BlackBerry, highlighted three critical pillars of effective mobile security:
- Tailored technological solutions: standard mobile operating systems and applications provide insufficient protection in high-security environments. High-security enterprises and government institutions have an immediate need for tailored solutions.
- Legislation and regulations: the Cyber Resilience Act (CRA) holds manufacturers accountable for the digital security of their products. While this legislation is a crucial step towards safer mobile solutions, the key question remains: who will take the lead? Governments and major corporations must set security standards through their procurement policies.
- Cultural change within organizations: security should not be an afterthought, only addressed after an incident occurs. Instead, it must be an integral part of daily operations. Investing in security should be as natural as maintaining other critical systems.
With dcypher leading the way, mobile technology security has taken a substantial leap forward.
The future of mobile security
“The future of mobile security is not just about technology,” Boot concludes. “We must also focus on collaboration.” Establishing a security-centric environment will strengthen our ability to address future threats. This requires close cooperation between manufacturers, software developers, and policymakers.
