In this lesson,
we're going to discuss a few key concepts
that can lead to mobile device
insecurity, as well as some things we can do
to increase the security
of our mobile devices in our organization.
This includes the discussion of some key things to avoid,
like jailbreaking, rooting, side loading,
and unauthorized application stores, as well
as some best practices to utilize.
First, let's talk about jailbreaking.
Now, jailbreaking is a term that's used
to describe an exploit that enables a user
to obtain root privileges, side load applications, change,
or add carriers, and customize the interface
of an iOS device like an iPhone or an iPad.
The problem with jailbreaking device is
that it essentially removes all the protections
that Apple has created for that device in addition to all
of the restrictions on that device.
Now, jailbroken devices are actually the largest threat
vector that's going to be exploited
by an attacker when it comes to iOS devices.
When you jailbreak a device,
you no longer have the protections
and restrictions that Apple gives you.
If a phone is jailbroken,
it also can't receive proper vendor patches and upgrades,
and this makes your device much more vulnerable to attack.
In the old days, you could jailbreak the device
and boot it up with a patch kernel
each time the phone was reset.
Apple continually was hard at work, trying
to eliminate jailbreaking,
and so they've made it much harder to perform.
Currently, most jailbreaks are known
as tethered jailbreaks,
which means the device must be attached
to a computer when it's being booted up in order for
that patch curl to actually be loaded
and give you root access.
Because of this, jailbreaking iPhones
and iPads is not nearly as prevalent as it once was.
Android devices, on the other hand,
use a technique known as rooting.
Now, rooting is an exploit that enables the user
to obtain root privileges on an Android device
so they can perform whatever they want on that device.
There are some authorized rooting techniques though, as well
that are performed by some vendors if you
have those type of phones.
This goes to the more open nature of Android versus iOS.
Now, most users though should not have a reason
or need to actually root their device.
If the vendor doesn't provide a rooting mechanism,
then you'd have to root it using an exploit
to a vulnerability, and that way you can gain access as root
or you could load a custom firmware into your phone instead.
Now, a custom firmware is a new Android OS image
that can be applied to your device,
and this custom firmware is also known as a custom ROM,
and some people have created their own versions of Android
with different settings and interfaces using
these custom ROMs too.
Now, these custom ROMs though could contain malicious code,
bugs or other vulnerabilities that you're not aware of,
and they're usually not supported
by larger security communities
or the manufacturer itself when things break, and so
therefore, you need to be careful if you're
going to use a custom ROM.
Another type of root level access
that you can achieve on an Android device is
known as systemless root.
Now, systemless root is a method
that does not modify the system partitions or files, and
therefore it is less likely to be detected than a custom ROM
or firmware based rooting.
Next, we have sideloading.
Now, sideloading is the practice
of installing an application on a mobile device directly
from an installation package instead of downloading
through an official store, like the Google Play Store
or the Apple App Store.
Now, when an application is submitted by a developer
to the official store, it has to pass a number
of security checks before it becomes available to users
to download, but if the user simply installs an application
they find online, it can actually have vulnerabilities in it
or malicious code that they're not aware of.
Now, by default, Android
and iOS devices block the installation of third party apps
by using sideloading,
but a user can enable the installation
of third party apps under their settings in Android devices.
To prevent this, organizations should use mobile device
managers to prevent the installation of unauthorized apps
or third-party apps.
Another security issue with applications is the installation
of unsigned apps.
Now, when an application comes from the official store,
it's going to be digitally signed by the developer
to ensure its code has been verified
and has not changed since they signed it.
If these are downloaded and installed
and unsigned application, there is no way
of knowing if the application has been tampered with
between the time it was developed
and the time the user downloaded it.
To prevent the introduction of malware into our devices,
we should only download
and install applications
through an official application store
and ones that are digitally signed by those devices.
Next, let's talk about some security best practices
that you can use in your mobile devices.
This includes device configuration profiles,
full device encryption, VPNs, location services,
and geofencing and geotagging.
First, we have device configuration protocols.
Now, device configuration protocols are used
to implement different settings
and restrictions for your mobile devices from your
centralized mobile device management systems,
and then those are going to be deployed
to your mobile devices across your organization.
Most device configuration protocols are written
as XML files,
but this does depend on your mobile device management suite.
These XML files contain all the configuration details
for a specific user or device,
depending on your MDM.
These device configuration protocols are then going to be
installed on a device either manually
or through an automated deployment using your MDM
after the device has been enrolled into the mobile device
management suite.
Profiles are most commonly used
for security, but they also provide a vulnerability
that can be exploited by an attacker
because profiles can be pushed to a device by email,
text message, or as a download from a rogue webpage.
In these cases, an attacker will try
to trick a user into accidentally installing the profile in
order to gain access to enterprise data
or the enterprise network by using that mobile device
as a zombie or pivot point.
Similarly, digital certificates can also be delivered
and distributed to a device like a rogue profile can,
so you should always be careful when accepting
and trusting new digital certificates
that are presented over an email, text message,
or rogue webpage.
Second, you should consider implementing full device
encryption on all of your mobile devices.
Every mobile device has an internal solid state storage
device that contains the operating system, application
files and data files.
In addition to this, many Android devices also have an
additional card slot for additional or expansion storage.
To protect the data stored on these devices, you need
to implement full disc encryption
to provide data at rest protection.
While many organizations may not bother
to use full disc encryption on their desktops,
it is extremely important
to use it on your laptops and mobile devices.
Many data breaches have come as a result
of an employee's laptop, tablet,
or smartphone being stolen from their home or car,
and that data was easily read from the storage device
because full disc encryption was not being utilized.
Now, iPhones and iPads use a 256 bit unique ID
for each device, and you can combine that
with the user's password in order
to encrypt the storage device
for full device encryption on Apple devices.
Android devices, prior to Marshmallow,
which was version 6.0.1,
used full disc encryption using 128 bit AES key, protected
with a password, but starting with Android version seven,
file-based encryption was also introduced to allow
for the independent encrypting and decrypting of files.
As of Android version nine,
metadata encryption was also supported,
and this allows Android to provide full device, file-based
and metadata encryption to provide you
with additional protections and data at rest.
To aid in all of this encryption, a lot
of these devices have an embedded microSD hardware security
module, also known as an HSM,
which stores the different cryptographic keys securely
inside that mobile device, similar
to the way a TPM module does in a laptop or desktop.
The third security configuration you should implement is the
use of virtual private networks or VPNs.
Just like traditional desktops
and laptops, mobile devices must rely on A VPN
to access our organization's network resources when they're
not connected directly to the organization's network.
Mobile devices have a few options that they can use
to create this VPN.
Most mobile operating systems natively support VPNs
through their settings.
To configure these VPNs,
they're going to rely normally on a username
and password.
To create a more secure VPN solution though,
some mobile device management solutions will also
provide a third party VPN client
that can support digital certificates
and other forms of authentication, such as a fingerprint,
to be able to establish a secure VPN connection
through the mobile device management gateway server.
With implementing A VPN, our organization needs
to decide which type of encryption is going to be utilized,
such as secure socket layer tunnels, transport layer
security tunnels, or some other form of encryption.
Remember, when you're configuring a device to use A VPN,
be sure you follow both your organization's traditional VPN
security policies and any mobile specific
policies you may have.
Now, as I said, mobile devices have extensive support
for virtual private networks,
and you can actually do this at three different layers.
The operating system layer, the application layer,
and the web-based layer.
At the operating system level.
A VPN provides an always-on protection capability that'll
capture all the device traffic
and forward it through an encrypted tunnel
to your VPN's endpoint.
If you're using an application level VPN,
this will focus on providing a VPN on a per app basis.
These app level VPNs can then be configured
to protect the traffic generated by a single application
instead of tunneling all the device's
network traffic through that VPN.
A web-based VPN solution
works within the web browser on a mobile device
to protect traffic by masking
or changing the device's true location
to bypass geo restrictions or firewall restrictions.
Now, web-based VPNs do not provide as much protection
as an OS level VPN,
but they may be useful depending on your
business case and your needs.
Our fourth security configuration we need
to think about is location services.
Now, the location services setting refers to how
a mobile device is allowed to use your cellular,
Wi-Fi, GPS, and Bluetooth
to determine your physical location.
For example, if you want to determine a user's device
and where it is precisely, you can triangulate
that device using GPS with a highly accurate result,
or you can actually triangulate the device using the
cellular modem and multiple cellular towers to get a rough
or course position if GPS is not working.
Now, different applications on your device will ask
for permission to access your course or precise location,
and you can configure their ability to read
and access that information in your profile
or your MDM policies.
Now, the fifth security configuration we need
to discuss is also related to location services
and it's known as geolocation, which is used by geofencing
and geotagging.
Now, geolocation uses a device's ability
to detect its location in order to determine if access
to a particular resource should be granted.
This can be accomplished by using the device's public IP
address, the GPS coordinates
of the device's current location
or even the location based on the triangulation
of its position to the cellular towers in its local area
that it's using for data access.
As I said, geolocation is closely related
to location services.
Now, based on this location data, your app policy,
your network policy, or your MDM policy can enable
or disable certain functionality of the device
or even prevent authentication entirely.
This is done through geofencing, which is the creation
of virtual boundaries based on geographical
locations and coordinates.
Geofencing can also be used to track a user's location
and keep them within a certain area.
For example, there's applications out there
that a parent can install on their child's smartphone
that'll send a text or alert if the child tries
to leave a predefined boundary that was set by the parent,
but parents aren't the only ones using geofencing.
Let's pretend for a moment that you're the CIO
for a small company here in the United States
and you don't have any international employees.
You might enable geofencing as a way
to prevent any users from outside
the United States from logging into your systems.
You could do this based on the location of the source
of the IP address of that user
or the GPS coordinates
of the device the user is using when they're trying
to log into your systems.
This is geofencing at work.
Finally, a related topic is known as geotagging.
Now, geotagging is the addition of location metadata
to files or devices.
Often this is used by our mobile device management systems
and asset tracking systems to ensure the devices are located
where we believe that they should be located.
For example, let's pretend you run a small chain
of coffee shops and each point
of sale system is really an iPad
with a credit card reader attached to it.
You could implement geotagging of all the transactions
to be able to ensure they occurred from the proper location,
or you could geotag the device itself
and only allow it to operate when it's within the local area
of its designated coffee shop.