2.8 2.8 Given a scenario, implement methods for securing mobile devices. Flashcards
2.8 Given a scenario, implement methods for securing mobile devices.
2.8 Given a scenario, implement methods for securing mobile devices.
• Screen locks
Screen locks • Restrict access to the device • You’re going to leave it somewhere.
- Failed attempts
- iOS: Erase everything after 10 failed attempts
• Android: Lock the device and require a Google login
- Fingerprint lock
Settings>display>screen lock > fingerprnt
A device, usually integrated into a mobile device, that reads the user’s fingerprint to determine whether to grant access to the device.
- Face lock
•Settings>display>screen lock > face recognition.
- Swipe lock
Swipe lock- Settings>display>screen lock >
- Passcode lock
Settings>display>screen lock >Enter passcode twice>ok.
• Remote wipes
Locator applications and remote wipe • Built-in GPS • And location “helpers” • Find your phone on a map
- Control from afar • Make a sound • Display a message
- Wipe everything • At least your data is safe
• Locator applications
Locator applications and remote wipe • Built-in GPS • And location “helpers” • Find your phone on a map
- Control from afar • Make a sound • Display a message
- Wipe everything • At least your data is safe
• Remote backup applications
- Difficult to backup something that’s always moving • Backup to the cloud
- Constant backup - No manual process
- Backup without wires - Use the existing network • Restore with one click
- Restores everything • Authenticate and wait
• Failed login attempts restrictions
- iOS: Erase everything after 10 failed attempts
* Android: Lock the device and require a Google login
• Antivirus/Anti-malware
- Apple iOS • Closed environment, tightly regulated • Malware has to find a vulnerability
- Android • More open, apps can be installed from anywhere • Easier for malware to find its way in
- Windows Phone • Closed environment • Apps run in a “sandbox” • You control what data an app can view
• Patching/OS updates
Patching/OS updates • All devices need updates - Even mobile devices
- Device patches - Security updates • Operating system updates - New features, bug fixes
- Don’t get behind! - Avoid security problems
• Biometric authentication
- Fingerprint, face, iris • A phone is always with you • And you’re a good source of data
- Biometrics have a long way to go •
• Full device encryption
- Encrypt all device data • Phone keeps the key
- iOS 8 and later • Personal data is encrypted with your passcode
- Android - Full device encryption can be turned on
• Multifactor authentication
- More than one factor • Passcode, password, swipe pattern • Fingerprint, face, iris • A phone is always with you • And you’re a good source of data
- We’re just figuring this out • Biometrics have a long way to go
- Biometric authentication • Multi-factor authentication
• Authenticator applications
Authenticator apps • Pseudo-random token generators • A useful authentication factor
- Carry around physical token devices • Where are my keys again?
- You’re carrying your phone around • And it’s pretty powerful
• Trusted sources vs. untrusted sources
- Once malware is on a phone, it has a huge amount of access
- Don’t install Android Apps (APK files) from an untrusted source
- Android • Apps can be downloaded from • Google Play or sideloaded • This is where problems can occur
- iOS • All apps are curated by Apple
• Firewalls
Firewalls • Mobile phones don’t include a firewall • Most activity is outbound, not inbound
- Some mobile firewall apps are available • Most for Android
- None seem to be widely used • Enterprise environments can control mobile apps
- Firewalls can allow or disallow access
• Policies and procedures
FOR HW- BYOD vs. corporate-owned
- Manage company-owned and user-owned mobile devices • BYOD - Bring Your Own Device
- Centralized management of the mobile devices • Specialized functionality
- Set policies on apps, data, camera, etc. • Control the remote device • The entire device or a “partition”
- Manage access control • Force screen locks and PINs on these single user devices
• Policies and procedures
FOR - User Profile security requirements
- Manage access control • Force screen locks and PINs on these single user devices *Biometric authentication
- Multi-factor authentication • More than one factor • Passcode, password, swipe pattern
- Fingerprint, face, iris
