-: Security of Apps.
How do you know the app you want to install is secure?
How do you know it's not going to be spying on you?
How do you know there's no malware embedded in it?
Well, you don't.
But the best way to ensure that you don't
get those type of things is by installing applications
from the official mobile stores only.
If you're using an Android device,
that's the Google Play store.
If you're using an iPhone,
that's going to be the App Store.
Now, some people have taken their phones
and done what's called jailbreaking it or rooting it.
On an Apple device,
jailbreaking it means you're going to remove
the security protections that Apple has put in place
so that you can take it from your wireless carrier
to a different wireless carrier,
or install third-party apps outside of the App Store.
As you can probably guess,
these are both bad security practices
and should not be done.
Now, when you have an Android device,
we don't call jailbreaking it,
we call it rooting it.
The reason is because Android is at heart
a Linux operating system.
So, if you root the device,
you now have administrative permissions over it.
And you can install whatever applications you want
and make the phone do things
that it wasn't necessarily designed to do.
Again, making sure that you don't jailbreak
or root your device is a good first step
to ensuring you have a secure device.
Next, you want to think about what browser
and what applications you're actually running.
For example, if you're using the Chrome browser,
that's a fairly secure web browser.
But if you decide to get a third-party web browser,
you don't know who it is that put that out there
and if you can trust them.
Maybe they're giving you this web browser
but they're also taking a copy
of all your data going through it.
To avoid those type of issues,
always get official applications, when possible.
And speaking of web browsers,
one of the things you want to ensure
is whenever you're browsing the web on your mobile device,
you're always going to the secure version of a website.
That's denoted by the https at the front of the web address.
This ensures that you have a TLS tunnel created
between your phone and the server.
What's TLS?
Well, it's Transport Layer Security.
It's going to put an encryption layer and a tunnel
between your device and the server
to ensure you have confidentiality and nobody
is conducting a man-in-the-middle attack from you.
Now, as businesses, we are increasingly going mobile
all of the time.
An Enterprise Mobility has a couple of things
that we need to think about
when we talk about securing our apps as well.
One of those is making sure we have control
over those devices and what apps are installed.
If your organization is going to be
providing the cellphone to its employees,
you have the right to install
mobile device management software.
MDM or Mobile Device Management
is a centralized software solution
that allows your system administrators to create
and enforce policies across all of the mobile devices.
This can ensure that people don't install games
like Angry Birds or they don't put third-party apps
or that they could only go to certain websites.
Whatever precautions you want to enable
and whatever policies you want to enforce
is really up to your organization.
But in the end, it's the thing that lets you do that.
Now, one of the things that you want to consider
with your phones is they have location access based on GPS.
Should you allow location access to an application?
For example, if you're trying to get/use the Yelp app,
it needs to know your location
so it can make recommendations
of the restaurants around you.
Well, if you enable location access to apps
and you're not sure who that app is,
that app can now track your location and where you're going.
This is a privacy concern
and something you need to think about.
It's highly recommended that you turn location services off
for any apps that you don't need it for.
Obviously, you're going to need it for your GPS app
but for most other apps, you don't need GPS enabled.
So, you can turn it off for those particular apps
in your settings.
Another privacy concern is the use of Geo tags.
What exactly is Geotagging?
Well, Geotagging is embedding the geolocation coordinates
or GPS coordinates into a piece of data.
Most commonly, this is done with a photo or a video.
By default, on your iPhone when you take a picture,
your GPS coordinates are embedded
into that photo as metadata.
That means, wherever you post that photo
like on Facebook or Twitter or Flicker,
you could take that photo and read those coordinates
and figure out where all those photos were taken.
Now, this is really handy if you went
and took a trip around the world
and want to figure out
which picture went with which location.
But, it does bring some dangers to your organization.
For example, what if every morning your manager
went to a local coffee shop
and they decide to take a picture
and post it on Facebook everyday around 8am.
This would tell an attacker that that manager
is not in the office everyday at 8am
instead, they are at the coffee shop.
They can now target that manager either at the coffee shop
or target that manager's office
because they know the location of the manager
and where they won't be, in the office.
So, geotagging is something that needs to be considered
when developing your organization's security policies.
It's up to your organization to decide
whether or not you want to allow geotagging
but I highly recommend turning it off
for privacy and security concerns.