Ch.10 Flashcards
the Google operating system for mobile devices that is not proprietary
android
the tools and services responsible for distributing and controlling access to apps
application control or mobile application management (MAM)
maintaining an accurate record of company-owned mobile devices
asset tracking
a secure repository for storing valuable authentication information on a mobile device
credential management
using a mobile device’s GPS to define geographical boundaries where an app can be used
geo-fencing
adding or allowing geographical identification data in a mobile app
geo-tagging
the operation of stockrooms where mobile devices are stored prior to their dispersal
inventory control
the operating system for Apple mobile devices that is a closed and proprietary achitecture
IOS
services that can identify the location of a person carrying a mobile device or a specific store or restaurant
location services
a technology that prevents a mobile device from being used until the user enters the correct passcode
lock screen
the tools and services responsible for distributing and controlling access to apps. Also called APPLICATION CONTROL
mobile application management (MAM)
tools that allow a device to be managed remotely
mobile device management (MDM)
the ability to quickly remove devices from the organization’s network
off-boarding
the ability to rapidly enroll new mobile devices
on-boarding
the ability to remotely erase sensitive data stored on a mobile device
remote wiping
a small form factor storage media of a variety of different types and sizes
Secure Digital (SD)
a mobile cell phone that has an operating system for running apps and accessing the Internet
smartphone
portable computing device that is generally larger than smartphones and smaller than notebooks, and is focused on ease of use
tablet
Which technology is NOT a characteristic of a mobile device?
a. physical keyboard
b. small form factor
c. local nonremovable data storage
d. data synchronization capabilities
a
Each optional feature is found on most mobile devices EXCEPT ______.
a. digital camera
b. microphone
c. operating system
d. removable storage media
c
Tablet computers are designed for ______.
a. processing capabilities
b. ease of use
c. wireless connection speed
d. hardware upgrades
b
One of the first mobile devices was a ______.
a. personal digital assistant (PDA)
b. table
c. smartphone
d. notebook
a
Which of these is NOT a size of SD cards?
a. smallSD
b. miniSD
c. microSD
d. full SD
a
Which of these is NOT a risk of connecting a mobile device to a public network?
a. Public networks are beyond the control of the employee’s organization.
b. Public networks may be susceptible to man-in-the-middle attacks.
c. Public networks are faster than local networks and can spread malware more quickly to mobile devices.
d. Replay attacks can occur on public networks.
c
Mobile devices using ______ are at increased risk of targeted physical attacks.
a. GPS
b. captive portals
c. location services
d. Internet filters
c
What is one reason Android devices are considered to be at a higher security risk than iOS devices?
a. iOS hs been available longer and has more of its vulnerabilities worked out
b. Android apps can be sideloaded
c. All Android apps are free
d. Apple apps are written in a more secure binary language
b
Which of these can a QR code NOT contain?
a. image
b. URL
c. email address
d. phone number
a
What prevents a mobile decide from being used until the user enters the correct passcode?
a. swipe identifier (SW-ID)
b. keyboard
c. touch pad
d. lock screen
d
Bob has attempted to enter the passcode for his mobile device but keeps entering the wrong code. Now he is asked to enter a special phrase to continue. This means that Bob’s mobile device is configured to ______.
a. reset to factory settings
b. extend the lockout period
c. use PIN codes as passcodes
d. double the amount of time he is prevented from accessing his device
a
What does containerization do?
a. It splits operating system functions only on specific brands of mobile devices
b. It places all keys in a special vault
c. It slows down a mobile device to half speed
d. It separates personal data from corporate data
d
What allows a device to be managed remotely?
a. mobile device management (MDM)
b. mobile application management (MAM)
c. mobile resource management (MRM)
d. mobile wrapper management (MWM)
a
Which of these is NOT a security feature for locating a lost or stolen mobile device?
a. remote lockout
b. last known good configuration
c. alarm
d. thief picture
b
What enforces the location in which an app can function by racking the location of the mobile device?
a. location resource management
b. geo-fencing
c. geo-tagging
d. Graphical Management Tracking (GMT)
b
Which of these is NOT an advantage of BYOD for an organization?
a. flexibility
b. cost increases
c. increased employee performance
d. reduced internal service
b
Which mobile device is the smallest?
a. subnotebook
b. laptop
c. notebook
d. desktop
a
Where does a web-based computer store user files?
a. on its hard disk drive
b. on the Internet
c. on a microSD card
d. on a Type II PC card
b
Which of these is NOT type of SD card?
a. Standard-Capacity
b. High-Capacity
c. Low-Capcity
d. eXtended-Capacity
c
-TYPES OF MOBILE DEVICES-
Despite their ever-changing feature sets, however, there are some basic characteristics of mobile devices that differentiate them from other computing devices. These characteristics include:
- small form factor
- wireless data network interface for accessing the Internet, such as Wi-Fi or cellular data connection
- mobile operating system
- applications (apps) that can be acquired through different means, such as downloaded from the Web, included with the operating system, or provided by the wireless data carrier
- data synchronization capabilities with a separate computer or remote servers
- local nonremovable data storage
In addition, other features that may be optional can be found on most mobile devices. These features include:
- digital camera(s)
- global positioning system (GPS)
- microphone
- removable storage media
- support for using the device itself as removable storage for another computing device
- wireless cellular connection for voice communications
- wireless personal area network interfaces like Bluetooth or near field communications
p.406
-PORTABLE COMPUTERS-
As a class PORTABLE COMPUTERS are devices that closely resemble standard desktop computers. The primary difference is that portable computers are smaller self-contained devices that can easily be transported from one location to another while operating on battery power.
A LAPTOP computer is regarded as the earliest portable computer.
Weigh over 6 pounds (2.7 kilograms or kg)
A NOTEBOOK computer is a smaller version of a laptop computer and is considered a lightweight personal computer. Notebooks have a limited number of hardware ports, do not include optical drives, and often cannot be upgraded.
A relatively new class of portable computers is the SUBNOTEBOOK computer, sometimes called an ULTRABOOK (Intel/Windows) or AIR (Apple). These devices are even smaller than standard notebooks and use low-power processors and solid state drives (SSDs).
A new type of computing device that resembles a laptop computer is a WEB-BASED COMPUTER. Web-based computers are designed to be used primarily while connected to the Internet. No traditional software applications can be installed, and no user files are stored locally on the device. Instead, the device accesses online web apps and saves user files on the Internet.
p.407-408
Study graph Table 10-1 p. 407
-TABLETS-
TABLETS are portable computing devices that are generally larger than smartphones and smaller than notebooks, and are focused on ease of use.
Tablets are often classified by their screen size. The two most common categories of tablet screen sizes are 5-8.5 inches (12.7-21.5 cm) and 8.5-10 inches (12.7-25.4 cm). The weight of tablets is generally less than 1.5 pounds (0.68 kg), and they are less than 1/2 inch (1.2 cm) thick.
Tablets are designed for user convenience, tablets are thinner, lighter, easier to carry, and more intuitive to use than portable computers.
The most popular operating systems for tablets are Apple iOS, Google Android, and Microsoft Windows.
p. 408
-SMARTPHONES-
A FEATURE PHONE is a traditional cellular telephone that includes a limited number of features, such as a camera, an MP3 music player, and ability to send and receive SHORT MESSAGE SERVICE (SMS) text messages.
A SMARTPHONE has all the tools that a feature phone has but also includes an operating system that allows it to run apps and access the Internet.
p. 409
-WEARABLE TECHNOLOGY-
Devices called WEARABLE TECHNOLOGY can provide even greater flexibility and mobility.
GOOGLE GLASS can be activated in response to the user’s voice commands by saying “OK glass” or tilting the head 30 degrees upward.
Another wearable technology is a SMART WATCH. this device can serve as an accessory to a smartphone so that users can easily glance at the water to view messages without the need to remove the smartphone from a bag or pocket.
p. 410
-LEGACY DEVICES-
One of the first mobile devices was a PERSONAL DIGITAL ASSISTANT (PDA). A PDA was a hand-held mobile device that was intended to replace paper systems. These devices often included:
- appointment calendar
- address book
- to-do list
- calculator
- record limited notes
PDAs that included a wireless data connection also included an email client and a limited-edition web browser.
A NETBOOK computer was a small, inexpensive, and lightweight portable computer. The screen sizes ranged from 5 to 12 inches (12.7 to 30.4 cm) and weighed only 2.2 pounds (1 kg).
p.411
-LARGE FORM FACTOR STORAGE-
A credit card-sized peripheral that slides into a slot on a laptop computer can add additional functionality, much like a card device can be inserted into the bus expansion slot on a desktop computer. Originally these cards were known as PCMCIA (PERSONAL COMPUTER MEMORY CARD INTERNATIONAL ASSOCIATION) cards, and later the name changed to PC CARD.
All three card types are the same length and width and use the same 68-pin connector. The cards differ only in their thickness.
An enhanced type of PC CARD is the CARDBUS. CardBus is a 32-bit bus in the PC Card form factor. CardBus also includes a bus mastering feature, which allows a controller on the bus to talk to other devices or memory without going through the CPU
Today PC CARD and CARDBUS devices are being replaced by EXPRESSCARD technology, EXPRESSCARD is designed to deliver higher-performance modular expansion in a smaller size.
p. 411-412
Study table 10-3 PC card form factors
-SMALL FORM FACTOR STORAGE-
COMPACTFLASH (CF) is small form factor that is generally used as a mass storage device format for portable electronic devices. Similar to CF, a SECURE DIGITAL (SD) card is another small form factor storage media.
The four families are:
- standard-capacity (SDSC)
- high-capacity (SDHC)
- eXtended-capacity (SDXC)
- secure digital input output (SDIO)
Currently there are three sizes of SD cards:
- full SD
- miniSD
- microSD
Full SD memory cards are typically used in personal computers, video cameras, digital cameras, and other large consumer electronics devices. The microSD and miniSD cards cards are commonly used in smaller electronic devices like smartphones and tablets.
There are two types of speed classes, the standard speed class and the ultra high speed (UHS) speed class.
p.412-413
Study table 10-4 SD speed classes
-THE LIMITED PHYSICAL SECURITY-
The greatest asset of a mobile device- its portability-is also considered its greatest vulnerability. Devices can easily be lost or stolen, and any unprotected data on the device could be retrieved by the thief. These examples illustrate the problem:
- A mobile device like a laptop is stolen on average once every 50 seconds. The location were the most laptops are stolen in North America is Chicago, followed by Houston, Detroit, and Los Angeles.
- One-third of all laptops stolen in the U.S. go missing from public schools. Residential property is the second most common location.
- Consumer-owned laptops are most often stolen in August and September (as students return to school) and November and December (during holiday shopping).
p.414
Study Table 10-5 Top five areas for airport laptop theft
-CONNECTING TO PUBLIC NETWORKS-
Mobile devices must use public external networks for their Internet access. Because these networks are beyond the control of the organization, attackers can eavesdrop on the data transmission and view sensitive information. In addition, these open networks may be susceptible to man-in-the-middle or replay attacks
p.415
-LOCATION TRACKING-
Mobile devices with GLOBAL POSITIONING SYSTEM (GPS) capabilities typically run LOCATION SERVICES. These services can identify the location of a person carrying a mobile device or a specific store or restaurant.
Mobile devices using location services are at increased risk of targeted physical attacks. An attacker can easily determine where the user and the mobile device are currently located, and use that information to follow the user in order to steal the mobile device or inflict harm upon the person. Attackers can compile over time a list of people with whom the user associates and the types of activities they perform in particular locations in order to craft attacks.
p.415
-INSTALLING UNSECURED APPLICATIONS-
The Apple iOS operating system, developed by Apple for their mobile devices, is a closed and proprietary architecture. This makes it much more difficult for attackers to create an app that could compromise it and become a security risk.
All iOS apps must first be reviewed and approved by Apple before they can be made available on the iTunes Store. This allows Apple to screen for malicious apps and prevent them from being posted.
As a result, many app developers generate supplementary revenue by selling user data generated through the app to advertising networks and analytics companies. In addition, this user data collected by the app and sent back to the developer for distribution is transmitted without encryption so that an attacker could access it.
iOS apps exhibited a greater percentage of risky behaviors than Android apps. Approximately 91 percent of iOS apps exhibit at least one risky behavior (compared to 83 percent of Android apps).
Unlike Apple iOS, the Google Android operating system for mobile devices is not proprietary but is entirely open for anyone to use or even modify. Apps for Android devices can be downloaded from the Google Play store (which does not screen apps like Apple does) or can be downloaded from an unofficial third-party website (called SIDELOADING).
Generally this makes Android apps highly risky. One report says that the number of malicious Android apps worldwide increased by an additional 350,000 in one six-month period. Most of these malicious apps re imitations of legitimate popular apps or are Trojans. About 44 percent of these malicious apps are designed to trick users into downloading costly services, such as sending expensive text messages (with the malware developer receiving a portion of the charges). Other malicious Android apps steal user data (24 percent) or load adware (17 percent).
p415-416
Study Table 10-6 Apple iOS apps risky behavior
-ACCESSING UNTRUSTED CONTENT-
One example is QUICK RESPONSE (QR) codes. These codes are a matrix or two-dimensional barcode first designed for the automotive industry in Japan. QR codes consist of black modules (square dots) arranged in a square grid on a white background, which can be read by an imaging device such as a mobile device’s camera.
Applications for these codes include product tracking, item identification, time tracking, document management and general marketing. QR codes can store website URLs, plain text, phone numbers, email addresses, or virtually any alphanumeric data up to 4296 characters.
An attacker can create an advertisement listing a reputable website, such as a bank, but include a QR code that contains a malicious URL. Once the user snaps a picturee of the QR code using his mobile device’s camera, the code directs the web browser on his mobile device to the attackers’s imposter website or to a site that immediately downloads malware.
p.417
-BRING YOUR OWN DEVICE (BYOD) RISKS-
Several risks are associated with BYOD:
- Users may erase the installed built-in limitations on their smartphone (called JAILBREAKING on Apple iOS devices or ROOTING on Android devices) to provide additional functionality. However, this also disables the built-in operating system security features on the phone.
- Personal mobile devices are often shared among family members and friends, subjecting sensitive corporate data installed on a user’s device to outsiders.
- Different mobile devices have different hardware and different versions of operating systems, all of which contain different levels and types of security features. Technical support staff may be called upon to support hundreds of different of mobile devices, creating a nightmare for establishing a security baseline.
- Mobile devices may be connected to a user’s personal desktop computer that is infected, thus infecting the mobile device and increasing the risk of the organization’s network becoming infected when the mobile device connects to it.
- There may be difficulties in securing the personal smartphone from an employee who was fired so that any corporate data on it can be erased.
p. 418
-DISABLE UNUSED FEATURES-
It is important to disable unused features and turn off those that do not support the business use of the phone or that are rarely used. One of the features that should be disabled if it is not being regularly used is bluetooth wireless data communication in order to prevent bluejacking and bluesnarfing.
p.418
-ENABLE LOCK SCREEN-
A LOCK SCREEN prevents the mobile device from being used until the user enters the correct passcode such as a PIN or password. Most mobile devices can be set to have the screen automatically lock after anywhere 30 seconds to 30 minutes of inactivity.
Some mobile devices can be configured so that after a specific number of failed attempts to enter the correct passcode, such as when thief is trying to guess the code, additional security protections will occur, including:
- EXTEND LOCKOUT PERIOD- if an incorrect passcode is entered a specific number of times, the lockout period will be extended
- RESET TO FACTORY SETTINGS- if an incorrect passcode is entered a set number of times, the user will be prompted to enter a special phrase to continue. If the phrase is correctly entered, then the user will have only one more opportunity to enter the correct passcode. If an incorrect passcode is entered again, the device will automatically reset to its factory settings and erase any data stored on it.
Although they are the most secure option, strong passwords are seldom used on mobile devices. Instead, a popular but less secure option is to draw or swipe a specific pattern connecting dots.
The least effective code is a short PIN.
The PIN 1234 was used in more than one out of every 10 PINs.
Of the 10,000 potential PIN combinations, 26.83 percent of all PINs could be guessed by attempting just the top 20 most frequent PINs.
The research also revealed that the least common PIN was 8068 which appeared in only 25 of the 3.4 million PINs.
p420
Study Table 10-7 most common PINs
-USE ENCRYPTION-
Full device encryption can be enabled to apply protection to all data stored on the device. Another option on mobile devices that contain both personal and corporate data is separating data storage into “CONTAINERS” and encrypting only the sensitive data. This “CONTAINERIZATION” also helps companies avoid data ownership privacy issues and legal concerns regarding a user’s personal data stored in BYOD setting.
Third-party software is available to create containers on a mobile device’s internal memory or the data can be separately stored on the device’s removable storage microSD card.
p. 420
-CONTROL ACCESS-
A key to securing mobile devices is to control access to the device and its data by limiting who is authorized to use the information. thus organizations are now beginning to focus their efforts on the DATA instead of just the DEVICE by extending data loss prevention to mobile devices.
p. 420
-MOBILE DEVICE MANAGEMENT (MDM)-
MOBILE DEVICE MANAGEMENT (MDM) tools allow a device to be manage remotely by an organization. typically MDM involves a server component, which sends out management commands to the mobile devices, and a client component, which runs on the mobile device to receive and implement the management commands. An administrator can then perform OVER THE AIR (OTA) updates or configuration changes to one device, groups of devices, or all devices.
Some of the features that MDM tools provide include the ability to:
- Rapidly enroll new mobile devices (ON-BOARDING) and quickly remove devices (OFF-BOARDING) from the organization’s network
- Apply or modify default device settings
- Enforce encryption settings, antivirus updates, and patch management
- display an acceptable use policy that requires consent before allowing access
- configure email, calendar, contacts, Wi-fi, and virtual private network (VPN) profiles OTA
- Discover devices accessing enterprise systems
- Approve or quarantine new mobile devices
- distribute and manage public and corporate policies
- securely share and update documents and corporate policies
- detect and restrict jailbroken and rooted devices
- selectively erase corporate data while leaving personal data intact
MDM also can facilitate ASSET TRACKING, or maintaining an accurate record of company-owned mobile devices, as well as INVENTORY CONTROL, which is the operation of stockrooms where mobile devices are stored prior to their dispersal to employees.
p. 421
-MOBILE APPLICATION MANAGEMENT (MAM)-
MOBILE APPLICATION MANAGEMENT (MAM), also called APPLICATION CONTROL, comprises the tools and services responsible for distributing and controlling access to apps.
MAM initially controlled apps through APP WRAPPING, which sets up a “dynamic” library of software routines and adds to an existing program (binary) to restrict parts of an app.
p.422
-DEVICE LOSS OR THEFT-
In order to reduce the risk of theft or loss:
- keep the mobile device out of sight when traveling in high-risk area
- avoid becoming distracted by what is on the device. Always maintain an awareness of your surroundings.
- When holding a device, use both hands to make it more difficult for a thief to snatch.
- do not used the device on escalators or near transit train doors.
- white or red headphone cords may indicate they are connected to an expensive device. consider changing he cord to a less conspicuous color
- if a theft does occur, do not resist or chase the thief. Instead, take not of the suspect’s description, including any identifying characteristics and clothing, and then call the authorities. Also contact the organization or wireless carrier and change all passwords for accounts accessed on the device
- Security features-
- alarm
- last known location
- locate
- remote lockout
- thief picture
If a lost or stolen device cannot be located, it may be necessary to perform REMOTE WIPING, which will erase sensitive data stored on the mobile device.
p.422
Study table 10-8 SECURITY FEATURES FOR LOCATING LOST OR STOLEN MOBILE DEVICES
-MOBILE DEVICE APP SECURITY-
MDMs can support APPLICATION WHITELISTING, which ensures that only preapproved apps can run on the device.
MDMs also can enforce GEO-FENCING. Geo-fencing uses the device’s GPS to define geographical boundaries where the app can be used. Geo-fencing requires the app to support GEO-TAGGING, which is adding geographical identification data.
Geo-fencing is commonly used in law enforcement. An individual under house arrest is fitted with an ankle bracelet that will alert authorities if the individual leaves the house.
Many MDMs allow users to store usernames and passwords within the device itself. Known as CREDENTIAL MANAGEMENT it serves as a “vault” for storing valuable authentication information.
p.423
-BYOD SECURITY-
There are several benefits of BYOD for companies:
- MANAGE FLEXIBILITY
- LESS OVERSIGHT
- COST SAVINGS
- INCREASED EMPLOYEE PERFORMANCE
- SIMPLIFIED IT INFRASTRUCTURE
- REDUCED INTERNAL SERVICE
In addition, users are eager to accept this flexibility. The user BYOD benefits include:
- CHOICE OF DEVICE
- CHOICE OF CARRIER
- CONVENIENCE
- ATTRACTION
MDMs and MAMs are important in managing BYOD devices.
p.423-424
