Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/12/2017
11:00 AM
Nathan Collier
Nathan Collier
Partner Perspectives
50%
50%

Securing your Privacy on Android

If you work at a company that allows you to use your mobile device to login to email, access company data, or connect to company Wi-Fi, you're more of a security risk than you think.

Whether you are a government employee with sensitive data stored on your mobile device or a casual user who can’t lose his precious cat pictures, turning on security settings to keep your privacy secure on an Android device is important.

But in an era of having to keep track of multiple complex passwords, policies to reset passwords as soon as you just started remembering the last one, and taking two or more steps of authentication to login to most things these days, it’s easy to see why people get lax with security on their personal mobile device. It’s a case of convenience vs security. Leave your device unlocked, and you make it easy for your private data to be stolen. Lock things down tight, and you may find yourself ready to chuck your device at the ground when it locks itself (again) when you’re in the middle of an important task. 

Let’s look at some of the common security settings available on Android devices.

Screen Locks: The Basics
Most Android devices come with these basic screen lock settings, listed least to most secure:

  • Pattern – Draw a pattern on dots to unlock device
    • Minimum 4 dots, max 9 dots
  • PIN – Enter a number to unlock device
    • Minimum 4 digits, max 17 digits
  • Password – Enter a good old password to unlock device
    • Minimum 4 characters, max 17 characters

Choosing which method, and how many elements used for that method, determines how secure it is. For example, a 6-character password will be more secure than an 8-dot pattern. No matter what you do with your mobile device, you should use at least one of these methods to secure it.

Screen Locks: Biometrics
It seems each new mobile device iteration comes with a clever new way to unlock your device, most of which involve biometric technology. Biometrics use your biology to recognize you and let you access your device, for example by fingerprint, retina (eye), or face.

The biggest concern with any biometric security method is that you can’t change your biology like you can with a password. As technology advances, we will see advances in the ability to hack these biometrics, and there are already several proof-of-concept hacks that can potentially exploit each. Still, it’s a lot easy to put your finger on a scanner than enter a PIN.

Sleep Timeout & Auto Lock Timeout
The sleep timeout determines the length of time before your mobile device goes to sleep. The auto lock timeout is the length of time after the device is asleep that it will lock itself. You can even go a step further and set the device to lock when the power button is pressed.

Start with shorter timeouts and work your way to longer ones in order to find the right balance of security and convenience. Or put another way, figure out how many times you can unlock your device throughout the day before you can’t take it anymore! Just remember, the longer the timeout, the more time there is for personal data to be stolen.

What's at Stake 
If you work at a company that allows you to use your mobile device to login to email, access company data, and/or connect to company Wi-Fi, you could be more of a risk than you think — especially if it’s a well-known company.  Targeted attacks are the easiest way for criminals to steal sensitive information from a company, and that device you carry around everywhere could easily be used against the company where you work.  If a mobile device is lost or stolen with no security settings, criminals could easily use it to gain access into sensitive business information, or information that is beyond the compromised user’s permissions.

There are other reasons to keep your mobile device secure. Stolen, unlocked devices can easily be factory reset and sold for profit. Criminals could do whatever they like with your personal information — like post those private pictures for all your followers to see on social media. So, it’s best to stay safe, turn on those security settings, and have a little piece of mind that your privacy is secure.

Full time mobile malware researcher, part time endurance mountain bike athlete and world traveler. As nerdy about biking as he is about mobile malware. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Malwarebytes protects businesses against malicious threats that escape detection by traditional antivirus solutions. Malwarebytes Anti-Malware, the companys flagship product, has a highly advanced heuristic detection engine that has removed more than five billion malicious threats from computers worldwide. SMBs and enterprise businesses worldwide trust Malwarebytes to protect their data. Founded in 2008, the company is headquartered in California with offices in Europe, and a global team of researchers and experts. For more information, please visit us at www.malwarebytes.com/business.
Featured Writers
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.