Apple is known for maintaining high standards when it comes to the App Store. It has set strict guidelines for developers, runs a thorough review process for new apps sent to market, and monitors apps to ensure they deliver what developers promise.
This tightly controlled environment is in place to maintain a great user experience, preserve end-user privacy, and protect the platform from bad actors, all while allowing third-party developers to create compelling experiences on Apple’s mobile platforms. Apple’s operating system design, along with these protection policies, has helped keep the iPhone and the apps that run on it generally immune to widespread threats for nearly two decades.
Over the years, these efforts—and Apple’s ongoing commitment to privacy, security, and safety—have set the iPhone apart. Apple introduced App Tracking Transparency in 2021 to address concerns about user data collection. Just one year later, in 2022, Apple rejected nearly 1.7 million apps out of 6.1 million applications, demonstrating its commitment to high standards in the App Store.
However, the Digital Markets Act (DMA) forced Apple to dismantle the walls it had built to protect the iPhone app market in Europe. In light of recent legislation, Apple has been identified as one of the influential gatekeepers in the European market. This designation subjects Apple to special regulations aimed at ensuring fair competition and open digital markets. Most notably, the tech giant is forced to provide users with the ability to load apps from alternative markets onto their iPhones.
In response to the EU regulation that came into effect, Apple launched iOS version 17.4, allowing users with an Apple ID registered in the EU to install apps from sources outside the official App Store, bypassing Apple’s strict controls. Although not all applications distributed through alternative marketplaces are malicious, DMA’s permission for such practices introduces new considerations for application distribution and security.
So how will this affect companies in the EU or those with a workforce operating from the EU?
Before we dive into the critical risks introduced through newly permitted alternative app marketplaces, it’s important for companies to understand how Apple is optimizing its approach to managing these third-party apps.
As of iOS 17.4, Apple is implementing notarization for mobile apps, a review process previously applied to macOS apps. This requires developers to submit their apps for basic review by Apple, ensuring a minimum security standard before apps can run on iOS devices. The review includes both machine analysis and human testing to scan for malware and verify that the application is working as described. Apple is still committed to maintaining the security of the platform, but their claim is that they are too remote to monitor secure content within apps as a result of DMA.
There are also new rules for developer registration. All developers, regardless of how they plan to distribute their apps, will need to register with Apple’s developer program, verifying their identity with official names, phone numbers, locations and other details. By having a developer ID attached to every app in distribution, including those that go through alternative app markets, Apple will be able to apply restrictions to code produced by those developers, if it is found to contain malicious content.
However, despite these proactive measures, side-loaded apps will bring certain risks to organizations that will require a more proactive approach to managing and securing mobile devices used for work to ensure they maintain an acceptable security posture and cyber resilience.
Risks of side-loaded applications
Organizations need to understand that while Apple continues to implement certain security measures, the open system mandated by DMA introduces inherent risks not present in a previously closed ecosystem. With the ability to distribute apps through third-party stores, Apple’s control over content becomes limited. This change could lead to the availability of apps with content previously restricted by Apple’s policies, such as pornography or self-harm.
The decentralized nature of app distribution under the DMA means that Apple’s content guidelines may not apply equally across platforms, potentially diluting the ecosystem’s content quality and security standards. This will open up new risks for companies regarding the type of content that can be accessed within their network infrastructure. Threat actors can use these third-party applications to distribute malicious content, often embedding phishing links or inappropriate information.
Additionally, the introduction of alternative app markets will likely fragment iOS’s review system. The App Store has always used consolidated reviews to monitor and fix specific performance and security issues for specific apps. However, third-party app stores will fragment this system, potentially reducing Apple’s ability to use community feedback as a tool to enable timely responses to quality control issues. This means companies will have less confidence in the quality of the apps their staff access on their devices. This will potentially lead to the threat of such applications secretly collecting and disclosing personal information without the user’s consent or awareness.
Furthermore, expanding application distribution channels can limit an organization’s visibility into where and how applications are downloaded and used. This lack of oversight complicates Apple’s ability to effectively monitor and manage apps, particularly related to user-generated reviews, app performance, and security feedback. So these responsibilities of supervision and monitoring fall on the companies themselves.
It is therefore crucial that companies not only rely on Apple’s security measures, but also implement their own checks and balances.
Risk mitigation
Business leaders need to consider how important it is for the organization to use an alternative app market outside of the traditional App Store. The more they use an alternative distribution channel as a business, the more fragmented they are from the iOS ecosystem. So, it is important to weigh the benefits and potential risks.
It is also important to establish and maintain good device hygiene. This does not necessarily mean adhering to established compliance standards, but may include setting internal benchmarks around device configuration and access policies and implementing a routine audit program to ensure that devices continue to meet those standards over time.
Most importantly, companies need to start gaining better visibility into the applications installed on enterprise devices. The more apps that come from unverified alternative markets, the more risk they pose to the devices that run them — regardless of how often those apps are used. Such applications can potentially open a backdoor for threat actors to gain access to the device and compromise the user or other key assets.
Business leaders should carefully consider whether they want to allow alternative app marketplaces to provide apps for workers. However, if companies ultimately want to take advantage of side-loaded apps, they must implement tools and policies to gain visibility into every app installed on enterprise devices. Understanding the origin and update frequency of these applications is critical to assessing a device’s risk posture. Investing in solutions like mobile device management (MDM) can effectively help achieve this.
Given the interconnectedness of applications and Internet browsing, organizations must consider implementing policies to mitigate web-based threats. Their goal should be to filter Internet access through company-configured applications or browsers to prevent phishing attacks and other network risks. Historically, these rules would work across all apps and browsers on an iOS device, but DMA also introduces the ability for alternative browsers, opening the door for apps to potentially bypass local rules; organizations should consider this in their decision matrix for allowing applications to be installed.
Along with these considerations, organizations should emphasize Zero Trust Network Access (ZTNA), where corporate data is transmitted through secure channels, isolating it from other traffic, including that from side-loaded applications. This approach ensures that organizational data remains protected while personal user data remains private.
Overall, DMA-induced change requires a balanced approach that leverages Apple’s security enhancements while acknowledging the broader risk landscape. Both business leaders and security teams play key roles in navigating this new terrain, ensuring that the organization’s integrity and security posture remain intact. Embracing these challenges with informed and proactive measures will be critical to maintaining a strong security posture in the evolving digital ecosystem.
Image author: daboost / photo deposit
Michael Covington is vice president of strategy at Jamf.