Incident Handling - Mobile Security and Privacy
How you can see which apps are using or have access to use specific types of private data on your device.
Mobile operating systems have defined permissions that control which app has access to which systems or data. Each OS has a list of permissions and the app requests access to the specific permissions that it needs.
What kind of sensitive or personal data can a mobile device can have?
Email, personal files, photos, health data, location data and so on.
But what about protecting the data on your device from an app that's installed on your device?
End users should be able to control which apps on their mobile device have access to what data.
What if someone steals the device and reboots it or takes it apart to get at the storage directly?
To help protect against this enable storage encryption on your mobile devices. On some devices this is done by default. But if it isn't you should enable that feature.
What kinds of challenges can a lock screen present
You might enter a pin or password, you might draw a pattern on screen or you might use biometric data like a fingerprint or even your face to unlock the device.
Determining the device's location uses a lot of
battery power and is also very sensitive from a privacy point of view.
No protection is perfect so we should use
defense in depth to protect the data on your mobile devices.q
A mobile device can use its GPS cellular networking and Wi-Fi networking to
determine the location of the device.
Mobile apps will request permission either when they are first installed or when they
first try to use the permission.
At times an end user might deny an app access to a permission that it needs making that app unable to
function properly.
You can also use the app permission settings on your device to control which apps have access to
location services when they are on.
One of the most basic protections you can enable on a smartphone or tablet is a
lock screen
Mobile devices travel with us and they aren't protected by the same level of physical security as a
server in a data center.
A screen lock presents some kind of challenge that you have to respond to in order to
unlock the device.
