Mobile Device Security Annual Computer Security Awareness Day 2015 PowerPoint Presentation, PPT - DocSlides

Mobile Device

SecurityAnnual Computer Security Awareness Day 2015

Christopher Sheppard

10 Nov 2015

CHRIS

SHEPPARDApple Desktop Engineercshepp@fnal.gov@cshepp1111/6/2015Chris Sheppard | Mobile Device Security2

AGENDA

Best Practices and RecommendationsApple iOSAndriodMobile Devices @ Fermilab11/6/2015Chris Sheppard | Mobile Device Security3

#1 Keep a Clean Drive

Keep OS current: Having the latest mobile security software, web browser, and operating system are the best defenses against viruses, malware and other online threats.Delete when done: We may have previously downloaded apps that are no longer useful or interesting to us. It’s a good security practice to delete all apps you no longer use.

BEST PRACTICES & RECOMMENDATIONS

11/6/2015

Chris Sheppard | Mobile Device Security

4

Percentage of infections by device type, according to Alcatel-Lucent. (Image: Alcatel-Lucent)

#2 Protect Your Personal Information

Secure your phone: Use a strong passcode to lock your phone.Don’t use devices to store confidential info: The loss of a device can be specially disturbing if you store passwords to other accounts (bank, email, Fermi systems). Remember, it is against Fermi policy to have Fermi related passwords stored on any device.BEST PRACTICES & RECOMMENDATIONS11/6/2015

Chris Sheppard | Mobile Device Security

6

#3 Connect with Care

Get savvy about public wireless networks: The words “free” and “open” should warn you to be cautious. Limit the type of business you conduct and use a VPN connection when accessing Fermi resources.Protect your $$$: When banking and shopping, check to be sure the site is security enabled. Look for web addresses with https:// or “shttp://”, which means the site takes extra measures to help secure your information. http:// is not secure.BEST PRACTICES & RECOMMENDATIONS11/6/2015

Chris Sheppard | Mobile Device Security

7

#4 Bluetooth

Attacks do happen: It’s important to be aware of the pitfalls of leaving this technology on when not in use. Hackers have found ways to remotely access a phone and use it to make calls, access data, listen in on conversations and browse the internet.Set default Bluetooth configuration to “non-discoverable” mode.BEST PRACTICES & RECOMMENDATIONS11/6/2015Chris Sheppard | Mobile Device Security

8

#5 Backup and Protect Your Data

Back up your data regularly: sync your mobile device with you computer or with a trusted secure online backup service.Delete any text messages or emails that contain sensitive information: It is recommended that you never disclose sensitive personal information about yourself via text or email.When in doubt, don’t respond: Fraudulent texting, calling and voicemails are on the rise. Just like email, requests for personal information or for immediate action are almost always a scam.BEST PRACTICES & RECOMMENDATIONS11/6/2015

Chris Sheppard | Mobile Device Security

9

#6 Don’t Alter Security Settings

Default Settings: Vendors spend a great deal of time researching the optimal settings to secure your device. Be careful altering these settings. If you DO change the default settings, increasing the security is often recommended.Think before you app: There are many apps that want/need to access other apps or certain functions of your device. Read the fine print as allowing these changes can leave holes in your security.BEST PRACTICES & RECOMMENDATIONS11/6/2015Chris Sheppard | Mobile Device Security

10

#7 Put a Boot to the Root & Jailbreaking

Rooting/Jailbreaking essentially involves modifying the file system: this allows users access to read-only files and parts of the operating system that the manufacturer or service provider do not want you to change.Rooting/Jailbreaking also opens up system-level resources for potential infection by malware: Part of the reason why this critical data is inaccessible is to protect it from such threats.BEST PRACTICES & RECOMMENDATIONS11/6/2015Chris Sheppard | Mobile Device Security

11

Turn off the simple passcode feature

so you can enter more than a 4 digit passcode.Set the Auto Lock feature to require a new passcode after a set period of time. It is recommended no longer than 5 minutes.In conjunction with Auto Lock, also set the Require Passcode feature which activates after the display has been idle for a certain period of time or if you press the iPhone Sleep button. You will be required to enter a passcode on wakeup.APPLE iOS11/6/2015

Chris Sheppard | Mobile Device Security

12

Enable Data Erase by setting the number of failed passcode attempts

prior to all data being erased from your phone. It’s recommended you do not allow more than 10 attempts. Note: As lone as you regularly backup your device by syncing, you will not lose your data.Set up “Find my iPhone” to help locate your phone if it gets lost or stolen to remotely wipe information from the iPhone.Only connect to networks you trust. Enable the “Ask to Join Networks” function.APPLE iOS11/6/2015

Chris Sheppard | Mobile Device Security

13

For applications that contain sensitive data,

set a separate passcode (different than any other you are using) for each application.Delete any messages with sensitive information.Only download applications form the Apple App Store.Use Apple’s iCloud service to backup you Apple devices.APPLE iOS

11/6/2015

Chris Sheppard | Mobile Device Security

14

Create a password that is easy for you to remember but difficult for others to guess.

Set the “Lock phone after” feature (Note: feature names may differ depending on device) to require a new password after a set period of time.Turn off the “Visible Passwords” feature to keep your password from displaying on the screen so others can’t easily learn your password.ANDROID11/6/2015

Chris Sheppard | Mobile Device Security

15

Turn off “Use secure credentials”

which automatically allows applications to access secure certificates and credentials.Turn off “Wi-Fi” when you are not connecting to a wireless network to ensure you don’t inadvertently connect to a wireless network.Download applications from trusted app stores such as the Android Market or the Amazon App Store. There are other app stores selling Android apps; take time to research them prior to downloading.ANDROID11/6/2015

Chris Sheppard | Mobile Device Security

16

Delete any messages with

sensitive information.Set a separate password for every application you access that contains sensitive data or information.Google provides updates to the Android OS which may contain security patches. Check with your service provider for information on how to get the most recent updates.Use antivirus software such as Avast! Mobile Security and Antivirus.ANDROID

11/6/2015

Chris Sheppard | Mobile Device Security

17

Service Desk Assistance

for Fermi and Personal DevicesNetwork Registration – MISCOMPEmail Setup – Configure ExchangeLoaner iPads @ FermilabFermilab offers loaner iPads for work purposes. Requests can be made through Service Now.Report Lost or Stolen Fermilab devices to security promptly. As with any Fermilab owned item, the quicker the item is reported missing, the quicker it may be recovered.

MOBILE DEVICES @ FERMILAB

11/6/2015

Chris Sheppard | Mobile Device Security

18

Questions

11/6/2015Chris Sheppard | Mobile Device Security19

RESOURCES

Motive Security Labs malware report – H1 2015http://resources.alcatel-lucent.com/asset/189669Apple Security Pagehttps://support.apple.com/en-us/HT201222Avast Mobile Security and Antivirushttps://www.avast.com/en-us/android11/6/2015

Chris Sheppard | Mobile Device Security

20