All
right, so mobile application, security best practices, ensure apps don't save
passwords, use code obfuscation, two factor authentication, that's huge.
Use SSL TLS, send data over secure channels, avoid caching app data,
validation checks on input data, and implement secure session management.
Our best practice is encrypt the data, enable over the air encryption.
Some applications don't encrypt by default, which is scary.
Back up your mobile data periodically.
Don't store extremely sensitive information on mobile devices.
Don't store passwords or pins as contacts on your phone.
Use private data centers to store data and implement device authentication.
More than once, I've cautioned people to
not do that passwords or pins contacts on your phone.
User their own contact and all their data in the notes pane.
Mobile network security guidelines.
Disable interfaces that are not needed.
That is the basic premise of system learning.
Set Bluetooth enabled devices to non discoverable mode.
Avoid connected to unknown WiFi networks,
just don't do it or use VPNs if you have to.
Connect your device to encrypt the WiFi
networks only and connect your web accounts to use secure connections.
Avoid installing too many applications.
Everybody's guilty of putting too many applications on their phone.
Don't auto upload photos to social networks.
Of course, security assessment on the
application architecture, configuration control management.
This is repeating information.
Secure the wipe or delete data.
Don't share information within GPS enabled apps.
Disable wireless.
It's not in use, that was in the previous slide.
Never connect two separate networks
simultaneously can actually bridge between the two.
Some examples of Android security tools.
I've always liked my malware bytes, Kuspersky.
Been using it for years.
So far it doesn't let me down.
Various Android device tracking tools.
There's lots of them. Find my device.
There's a ton of remote tracking, wipe, and utilities.
Same for iPhone.
Ios has its own mobile security tools.
Norton LastPass, Lookout, Flash ID, WebRoute.
That is going to wrap up our module.
All right, so remember, mobile devices, anything with a battery.
Most often we're thinking of cellular
tablets, things like that, but it really can be anything.
General concerns, again, or use of it for business, losing the device, loss of
control of the device, lots of eaves dropping attacks, lots of power attacks.
Mobiles are little small form factor PCs.
Use wireless web apps, install apps, and
have additional social engineering vectors like SMS.
All right, so that's going to wrap us up for Module 12, Mobile device security.