A Window into Mobile Device Security by “Carey Nachenberg & VP, Fellow”

796 Words2 Pages

Class: NCS 320 Information Assurance Fundamentals
A Window into Mobile Device Security by “Carey Nachenberg & VP, Fellow”
The article had discussed the security weaknesses related to the two most widely used OS’s: Android and iOS along with the possible risks associated with those weaknesses. Nowadays, phones became more than just a mean of communication, now they serve more as portable computer that can be used to access corporate services, view data and conduct various transactions. Most of these devices have no administrative control over them, thus leaving sensitive data vulnerable.
Both Operating systems have their own security flaws. Each OS was tested to determine their resistance towards web-based and network-based attacks, malware, social engineering, resource and service availability abuse, malicious and unintentional data loss and attacks on the integrity of the device’s data.
Apple iOS
IOS’s primarily based on access control, encryption, application provenance, and isolation.
Traditional access control: (Just like any other smartphone, iOS gives the administrator option to setup password and choose its strength, the classic way to prevent unauthorized entity to access the system. Another option is account lock out, which means that there are only a certain number of failed login attempts. Once the maximum number of attempts is reached, the device will lock or wipe itself
One of the strongest aspects of the iOS is its Application Provenance technique. The registration is required for each developerEach developer is required to go through registration process with Apple and pay annual licensing fee in order to release its software to general public. Developers must digitally sign each app with Apple-issued digita...

... middle of paper ...

...had been granted permission to access.
Permission-based Access Control: The problem with this approach is that it relies upon user to make security decisions, and decide whether an app’s requested combination of permissions is safe or not.
Application Provenance: Unlike Apple, software developers need not apply to Google to obtain a code-signed certificate. Instead, app developers can generate their own signing signatures, as often as they like. The result is that malware author can generate “anonymous” digital certificates, leaving author untraceable.
Encryption: Only the latest generations of Android tablet devices support hardware encryption to protect data. However, earlier versions relied upon isolation rather than on encryption. So if an attacker is able to obtain physical access to the device or jailbreak it, he can access every byte of data on the device.

Open Document