Mobile Device Security And Privacy

With some researchers estimating that by 2018, 25 percent of business data will move directly through personal devices and the cloud (avoiding network security perimeters) – and with an unprecedented 35 percent of Bank of America research staff acknowledging that their first thinking of the day is to their smartphones rather than their partners – it is clear that mobile technologies are becoming an important part of the future.

Challenges To Physical Security

Mobile devices are small, lightweight, and handy, particularly for thieves and pickpockets. And devices with moderate form factors, laptops, or notepads are easy enough to steal.

And if your laptop isn’t secured by a password, lock screen, or biometrics, it’s easy for someone who gets their hands on your computer to obtain unauthorized access to a treasure chest of sensitive records, intellectual property, apps, and messaging features. With poor passwords reasonably easy to guess or hack, hackers may hijack your email or other accounts, allowing them the opportunity to expand their traffic to data and properties that you might have in the cloud.

Remote data wiping facilities are also open to corporate BYOD (Bring Your Own Device) and mobile device management (MDM) systems managers – but even here, the stolen device’s security advantage is just as strong as the data shredding algorithm used by the wiping tool. Technology is widely accessible for forensic data recovery – the sorts of techniques that are life-saving in situations where vital files have been incorrectly scrubbed or a power surge trigger file corruption, but are still a valuable weapon for cybercriminals wishing to reconstruct data from improperly removed files.

It can take weeks or months before users are given access to security patches and upgrades for their smartphones. And even though they have, these changes could have gone through a tiresome process of negotiation between the parent company of the OS and the multiple computer vendors who need to change the code to fit their respective hardware models. It is then up to the mobile network operators to validate and deliver these updates to their customers.

This of which takes time for leveraging system vulnerabilities to run rampant – and older computer versions can be removed from the upgrade image altogether if vendors stop promoting them. And it’s not just operating systems that will keep out of date since many smartphone applications are not fixed or remodeled for long periods of time either.

Mobile Malware And Malvertising

Sources of malicious code expressly designed for the smartphone world continue to proliferate, with ransomware embedded in otherwise legal games, services, security fixes, and productivity applications. Ransomware is a common alternative for cybercriminals, along with more conventional key loggers and spyware that allows attackers to record user activity and gather intelligence and sensitive data.

Malicious advertisement or malvertising for the Mobile Landscape is also on the rise, not so much because of its potential to spread malicious payloads specifically but because of its capacity to draw consumers to exclusive deals, websites, and services where they can be hammered off at their destination. And with the idea of smartphone anti-virus and anti-malware software being relatively new to the majority of consumers – and with those technologies missing as built-in on too many smartphones – protective tools remain thin on the horizon.

Device Attacks and Takeovers

Perpetrators usually threaten computers to gain control of them, capture data from them, or use them as means for larger attacks (such as a Denial of Service or DoS). Mobile browsers remain vulnerable along with SMS (Short Message Service) and Multimedia Message Service (MMS) capabilities.

Intercepted Communications

Cellular data transmission protocols and non – secured wireless networks, such as WiFi hotspots, are the prime target of hackers who can use any of the numerous resources available online to capture, steal, or corrupt messages and eavesdrop. So-called “man-in-the-middle” attacks are becoming more frequent, along with attacks such as hijacking user sessions to gain access to online information and services.

The lack of security knowledge and the inherent propensity to make errors are also a significant factor in widening the dangerous environment. The lack of due diligence in installing applications – either from official stores (where consumers can not take the time to read fine printing) or from third-party download pages (where the unsuspected customer plays a lot of lotteries) – leads to the continued delivery of malware.

Jail-breaking or wrapping software to circumvent limitations imposed by the computer or operating system vendor makes users exposed not only to ransomware but may also deprive them of the defense of upgrades and security patches provided to customers who have not moved outside the manufacture’s rules. And for cybercriminals, insiders hired inside a company can use mobile devices to ship off-site data to external servers, download enterprise data to portable storage media, or encourage intrusions into corporate networks.

Confidentiality And Disclosure

Corporations and individuals whose smartphone applications are hosted by an application service provider or ASP are at risk of putting their private data and security at risk if the protections set in effect by their service contracts are not adequately stringent. In addition to the ASP guarantee, there is also a risk that sensitive information will be exposed to third parties, such as advertising networks or partner organizations. Users who connect with the ASP may obtain written clarification of the hosting agency’s own security policies and protocols for maintaining data protection. Beyond this, virtual private networks or VPNs can have additional security.

Services And Client Confidentiality

Customer security and the protection of data privacy are often of interest to consultants, advisories, and service-based businesses whose industry depends on an intimate knowledge of customer case information and specifications. Hackers can target personally identifiable information (PII) transmitted to such agencies or stored on user computers.