Security Updates
Install security updates in response to discovered vulnerabilities.
Purchase devices with a vendor and/or mobile carrier commitment to provide security updates in a prompt manner for a set period of time.
Decommission devices that will no longer receive security updates.
Limit or block access to enterprise resources from devices that have not installed recent security updates.
On Android devices, access can be controlled based on each device's security patch level. On iOS devices, access can be controlled based on the iOS version.
Techniques Addressed by Mitigation
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Mobile | T1398 | Boot or Logon Initialization Scripts |
Security updates frequently contain fixes for vulnerabilities that could be leveraged to modify protected operating system files. |
|
| Mobile | T1577 | Compromise Application Executable |
Security updates frequently contain patches to vulnerabilities. |
|
| Mobile | T1645 | Compromise Client Software Binary |
Security updates frequently contain fixes for vulnerabilities that could be leveraged to modify protected operating system files. |
|
| Mobile | T1634 | Credentials from Password Store |
Apple regularly provides security updates for known OS vulnerabilities. |
|
| .001 | Keychain |
Apple regularly provides security updates for known OS vulnerabilities. |
||
| Mobile | T1456 | Drive-By Compromise |
Security updates frequently contain patches for known exploits. |
|
| Mobile | T1658 | Exploitation for Client Execution |
Security updates frequently contain patches to vulnerabilities. |
|
| Mobile | T1664 | Exploitation for Initial Access |
Security updates frequently contain patches for known software vulnerabilities. |
|
| Mobile | T1404 | Exploitation for Privilege Escalation |
Security updates often contain patches for vulnerabilities. |
|
| Mobile | T1629 | Impair Defenses |
Security updates often contain patches for vulnerabilities that could be exploited for root access. Root access is often a requirement to impairing defenses. |
|
| .003 | Disable or Modify Tools |
Security updates frequently contain patches to vulnerabilities that can be exploited for root access. |
||
| Mobile | T1630 | Indicator Removal on Host |
Security updates typically provide patches for vulnerabilities that could be abused by malicious applications. |
|
| .001 | Uninstall Malicious Application |
Security updates typically provide patches for vulnerabilities that enable device rooting. |
||
| Mobile | T1461 | Lockscreen Bypass |
OS security updates typically contain exploit patches when disclosed. |
|
| Mobile | T1458 | Replication Through Removable Media |
Security updates often contain patches for vulnerabilities. |
|
| Mobile | T1474 | Supply Chain Compromise |
Security updates may contain patches for devices that were compromised at the supply chain level. |
|
| .002 | Compromise Hardware Supply Chain |
Security updates may contain patches to integrity checking mechanisms that can detect unauthorized hardware modifications. |
||
| .003 | Compromise Software Supply Chain |
Security updates may contain patches that inhibit system software compromises. |
||