Mobile device security

1. Mobile device security Practical advice on how to keep your mobile device and the data on it safe

2. Air, water, food… mobile devices Mobile devices are now an integral part of our lives

3. Huge growth in smartphone use 400x 31% increase in UK web traffic from a mobile device • September 2009 - 0.02% • January 2011 - 8.09% of US cell phone users own smartphones 1.6 billion 72% growth in worldwide smartphone sales in 2010 mobile devices sold in 2010

4. And they’re taking over from PCs • 28% • of tablet users use the device as their primary computer iPhone traffic responsible for • 4.5% • of all UK website traffic (not just mobile)

5. My life is in there “If a smartphone lives up to what it should be then it is something, as human beings, we will have an emotional relationship with because it's there all the time, it's our window on the world, it's our mouthpiece, it's everything we are and have. ‘My life is in there’ you hear people scream.” – Stephen Fry

6. So how did we get here? Mobile devices are developing quicker than ever before: 20 6 1 years years year 1stcell phone call 1st person-to-person SMS message 1st internet use on a cell phone 1st Windows tablet PC launched 1stBlackBerry launched 1st iPhone launched 1st Android OS launched between 1st cell phone call and 1st SMS between 1st SMS and 1st internet use on a cell phone between 1st iPhone and 1st Android OS 2007 2001 2002 2008 1973 1993 1999

7. Blurring the home-work boundaries Whoever owns the device, with smartphones and tablets the boundaries between personal and work use merge. • Accessing personal websites from work devices • Reading work emails on personal devices • Accessing corporate systems outside the office

8. The benefits of mobile devices at work • Work from any location • Work at any time • Reduced operating costs • People prefer them • Greater productivity • Greater flexibility • Increased response times • Happier staff

9. But it’s not all good news • Which in turn lead to: • Mobile security risks include: Data loss Data loss Financial theft Financial theft Lost or stolen devices Lost or stolen devices Mobile malware (e.g. viruses) Mobile malware (e.g. viruses)

10. Lost or stolen devices Unattended device Data theft Unauthorized access

11. Mobile malware Mobile malware (e.g. malicious apps, Trojans etc.) is still in its infancy. But it does exist and the focus is on data theft: • 2010: Google removed banking malware that had gathered information on more than 1m Android users • 2011: Zeus malware for Android steals financial data • But it will be come a major threat in the future.

12. Data = £ $ € ¥ Criminals can convert data to money in many different ways: Bank details Company data Steal money Blackmail Blackmail Steal money Make fraudulent purchases Make fraudulent purchases Sell to other parties Sell to other parties Sell to other criminals Sell to other criminals Email addresses Sell to spammers Sell to spammers Personal identities Make fraudulent purchases Make fraudulent purchases Sell to other criminals Sell to other criminals

13. How secure are your devices? If your personal or work devices fell into the wrong hands, what could people access? Your contacts? Your contacts? Your work emails? Your work emails? Your bank account? Your bank account? Your online store accounts? Your online store accounts? Your company’s data? Your company’s data? Your holiday plans? Your holiday plans? Your photos? Your photos?

14. Widespread lack of awareness 89% • unaware that smartphones can transmit confidential payment information such as credit card details without the user being prompted 65% • worry more about security on their laptop or desktop PC than their mobile device 67% • do not use keypad locks or passwords

15. How to secure your mobile... and your life As a basic rule, consider your device like your computer

16. For individuals Secure your device Be data aware Always lock it Always lock it Be careful what you share Be careful what you share Apply a complex passcode Apply a complex passcode Encrypt sensitive data Encrypt sensitive data Shield your passcode Shield your passcode Stay compliant Apply the latest patches Apply the latest patches Know and follow your organization’s security policies Prevent malware infection Don’t click on unsolicited links Don’t click on unsolicited links Think before downloading apps Think before downloading apps Don’t “jailbreak” or “root” Don’t “jailbreak” or “root”

17. For organizations Secure email access Secure email access Define what’s OK: devices, OS, versions Define what’s OK: devices, OS, versions Deal with lost or stolen phones Deal with lost or stolen phones Get visibility of connected devices and data usage Get visibility of connected devices and data usage Enable the user to manage their own device Enable the user to manage their own device Secure the device: require passcodes, control apps, remote management Secure the device: require passcodes, control apps, remote management Create mobile security policy Create mobile security policy

18. What’s next for mobile devices? Near Field Contact (NFC) Near Field Contact (NFC) The digital wallet The digital wallet Augmented reality Augmented reality Watch this space! Watch this space!

19. www.sophos.com/loveyourphone