With that increased utility, though, comes more vulnerability. Having a wealth of information--personal and otherwise--in your device makes your phone a target, and as the bad guys ramp up their efforts to infiltrate it, the good guys are gearing up their efforts to keep the bad guys out.
Does Smartphone Security Really Matter?
Create An Iphone App
The short answer is yes, absolutely, more and more. The degree to which it matters, however, depends on the individual user, or the individual company.
Threats to your mobile security are not always easy to see. They range from the simple (such as when someone finds your phone and reads all of your e-mail) to the highly complex (such as Trojan horses, viruses, or third-party apps that share your personal information).
Here are some common security risks, with tips, tricks, and tools to combat them.
Don't Lose Your Phone:
This may seem like a no-brainer, but don't put your phone down on a bar (especially if you work for Apple and have a prototype that no one is supposed to see). If you're in a public area, don't put it in a pocket or an open bag where it's visible and could be grabbed easily. Obvious suggestions, sure, but these kinds of on-the-street situations account for most cases of phone theft.
Your First Line of Defense:
Set your phone to lock, or time out, after a certain period of inactivity, requiring a password to get back in. All of the major smartphone operating systems support this function.
You'll want your password to be something hard for you to forget and easy to type since you'll enter it frequently throughout the day, yet difficult for someone else to guess. Anything containing your name, information found on a driver's license, or a number as simple as "1234," for example, are not good passwords.
Here's how to find time-out settings on various smartphone OSs:
* Android:
Previously, Android supported only pattern unlock (in which you draw a pattern to access the phone), but with version 2.2 of the OS, it now supports PINs and passwords. From the home screen, press Menu, Settings, Location & Security, and under Screen Unlock you'll find many options for setting passwords. To set the screen time-out, however, you must go back to the Settings menu and this time click Display. (Hint: If you decide to go with the pattern unlock, create a complex one that crosses over itself, or someone might deduce your pattern from the repeated smudge marks on your screen).
* BlackBerry:
From the home screen click Options, Security Options, General Settings. There you'll see options to enable the password, set or change the password, and set the security time-out options.
* iOS:
Earlier versions of iOS allow only for a four-digit PIN unlock code (which isn't ideal). Luckily iOS 4 introduced the option to set a longer password. Open the Settings app, and then select General, Passcode Lock. Just above Passcode Lock is the Auto-Lock option, which controls the time-out.
* Windows Phone 7:
Open Settings, and then select Lock and Wallpaper. From there you can set or change the password, and also set the screen time-out.
Your Second Line of Defense:
Remote wipe, plus the aforementioned password protection, is the bare minimum that most IT departments will require, although the specific steps you'll need to take very much depend on the level of security at your company.
Remote wipe means that if your phone is lost or stolen, you can remotely clear all of your data--including e-mail, contacts, texts, and documents--off of the handset, thus keeping that information out of the wrong hands.
You or your IT department can set this feature up for any of the major OSs, as well as use Microsoft Exchange to wipe the device (provided that you have an Exchange account). Those people without Exchange accounts or IT departments have other, simpler options.
* Android, BlackBerry, and Windows Phone 7:
If your OS is among one of these, you're in luck, as you can find many fantastic third-party Applications that allow you to remotely wipe your device. Lookout Mobile Security is just one example that not only enables you to wipe your device via the Web but also lets you track a lost device through GPS, back up your data over the air, and even scan for viruses. Its basic version is free, but to enable advanced features such as remote wipe you will have to pay for a Premium account ( a month or a year). You'll encounter big players in the security-app game, too; for instance, NotifyMDM, Symantec, and Zenprise sell multiple-mobile-device management systems to companies.
* iOS:
iPhone Application-store screening process, attempting to weed out any bad eggs before they get in. Again, however, undesirable things slip through.
Android takes a different approach, having looser central control but providing the end user with more information. Before you install an application on Android, the app must ask you for specific permissions. Don't simply ignore such messages. If you're just trying to install a simple wallpaper, ask yourself why it needs access to your contacts and your location. Be judicious when granting permissions.
Additionally, with all platforms, always pay close attention to app ratings and read the comments to see what other users have said. If an app has merely 50 downloads and a two-star rating, do a little digging and find out why. The best protection here really is common sense. Failing that, Lookout Premium can provide you with an overview of the permissions you have granted.
Even major companies including Facebook and Pandora have been sharing (read: selling) more user information than was commonly thought. Your options are pretty much limited to avoiding these applications or starting a letter-writing campaign.
Which OS Is the Most Secure?
There is no easy answer to this question. All of the major smartphone OSs have made significant strides in the last year.
"From an enterprise control and security standpoint, BlackBerry is still the gold standard," says Khoi Nguyen, director of product management for mobile security at Symantec. RIM's phones also feature advanced, device-wide encryption--including for the SD Card--that's cleared for usage at some of the highest levels of government.
Yet in the last six months Apple and Android have expanded support for security management, and more companies appear comfortable using them, Nguyen adds. Also, to enable further security, device manufacturers such as HTC and Motorola have added proprietary software on top of the various OSs their phones support.
With Windows Phone 7, Microsoft is following a similar strategy to that of Apple and Google in that it's starting out by keeping its mobile OS consumer-focused. The company is likely to add more business-friendly security in days to come, however.
One of the biggest holes in Android's security that's slowing its mass adoption in the business world is its lack of encryption, especially on the SD Card. That's a significant risk for business users, who save their e-mail attachments on unencrypted SD Cards.
BlackBerry phones offer the option to encrypt SD Cards, whereas iOS and Windows Phone 7 do not currently support removable storage. That said, many companies are willing to accept phones with unencrypted SD Cards, as long as remote wiping is set up. This arrangement will be fine for most consumers, too. It's important to note, though, that in order to wipe a phone remotely, it must be powered on and have a data connection. So if someone pulls the battery out of your Droid before you wipe it, you cannot erase your SD Card.
Smartphone Security For the IT Crowd:
The enterprise ecosystem has changed dramatically in the past year. Each end user wants to stick with the device they prefer personally, and they want to use it for work. Denying them that freedom doesn't always go over so well.
"The days of the IT department trying to regulate what devices users can and can't have--that battle is lost. So they should focus on their real mission, which is providing security to their users," says Datoo of Zenprise.
With so many platforms and new devices flooding the market, how can the IT pro at a small company possibly develop software to track them all, and keep them virus-free? More companies are turning that job over to software developers such as NotifyMDM, Symantec, and Zenprise, which enable management of a company's devices from a single interface.
Third-party software allows an IT admin to search all devices at the same time--whether for 5 or 57,000 users--while still accommodating the latest, most cutting-edge phones.
It's a brave, new, constantly evolving world out there. While we have yet to see an attack on smartphones that rivals the scale of PC attacks, attempts are becoming more and more frequent, and they will continue to proliferate. It's a brave, new, constantly evolving world out there. While we have yet to see an attack on smartphones that rivals the scale of PC attacks, attempts are becoming more and more frequent, and they will continue to proliferate. Critical thinking and consistent communications with your IT dept. may be your best line of defense.
SmartPhone Security (Part II)
No comments:
Post a Comment