Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/12/2017
11:00 AM
Nathan Collier
Nathan Collier
Partner Perspectives
50%
50%

Securing your Privacy on Android

If you work at a company that allows you to use your mobile device to login to email, access company data, or connect to company Wi-Fi, you're more of a security risk than you think.

Whether you are a government employee with sensitive data stored on your mobile device or a casual user who can’t lose his precious cat pictures, turning on security settings to keep your privacy secure on an Android device is important.

But in an era of having to keep track of multiple complex passwords, policies to reset passwords as soon as you just started remembering the last one, and taking two or more steps of authentication to login to most things these days, it’s easy to see why people get lax with security on their personal mobile device. It’s a case of convenience vs security. Leave your device unlocked, and you make it easy for your private data to be stolen. Lock things down tight, and you may find yourself ready to chuck your device at the ground when it locks itself (again) when you’re in the middle of an important task. 

Let’s look at some of the common security settings available on Android devices.

Screen Locks: The Basics
Most Android devices come with these basic screen lock settings, listed least to most secure:

  • Pattern – Draw a pattern on dots to unlock device
    • Minimum 4 dots, max 9 dots
  • PIN – Enter a number to unlock device
    • Minimum 4 digits, max 17 digits
  • Password – Enter a good old password to unlock device
    • Minimum 4 characters, max 17 characters

Choosing which method, and how many elements used for that method, determines how secure it is. For example, a 6-character password will be more secure than an 8-dot pattern. No matter what you do with your mobile device, you should use at least one of these methods to secure it.

Screen Locks: Biometrics
It seems each new mobile device iteration comes with a clever new way to unlock your device, most of which involve biometric technology. Biometrics use your biology to recognize you and let you access your device, for example by fingerprint, retina (eye), or face.

The biggest concern with any biometric security method is that you can’t change your biology like you can with a password. As technology advances, we will see advances in the ability to hack these biometrics, and there are already several proof-of-concept hacks that can potentially exploit each. Still, it’s a lot easy to put your finger on a scanner than enter a PIN.

Sleep Timeout & Auto Lock Timeout
The sleep timeout determines the length of time before your mobile device goes to sleep. The auto lock timeout is the length of time after the device is asleep that it will lock itself. You can even go a step further and set the device to lock when the power button is pressed.

Start with shorter timeouts and work your way to longer ones in order to find the right balance of security and convenience. Or put another way, figure out how many times you can unlock your device throughout the day before you can’t take it anymore! Just remember, the longer the timeout, the more time there is for personal data to be stolen.

What's at Stake 
If you work at a company that allows you to use your mobile device to login to email, access company data, and/or connect to company Wi-Fi, you could be more of a risk than you think — especially if it’s a well-known company.  Targeted attacks are the easiest way for criminals to steal sensitive information from a company, and that device you carry around everywhere could easily be used against the company where you work.  If a mobile device is lost or stolen with no security settings, criminals could easily use it to gain access into sensitive business information, or information that is beyond the compromised user’s permissions.

There are other reasons to keep your mobile device secure. Stolen, unlocked devices can easily be factory reset and sold for profit. Criminals could do whatever they like with your personal information — like post those private pictures for all your followers to see on social media. So, it’s best to stay safe, turn on those security settings, and have a little piece of mind that your privacy is secure.

Full time mobile malware researcher, part time endurance mountain bike athlete and world traveler. As nerdy about biking as he is about mobile malware. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Malwarebytes protects businesses against malicious threats that escape detection by traditional antivirus solutions. Malwarebytes Anti-Malware, the companys flagship product, has a highly advanced heuristic detection engine that has removed more than five billion malicious threats from computers worldwide. SMBs and enterprise businesses worldwide trust Malwarebytes to protect their data. Founded in 2008, the company is headquartered in California with offices in Europe, and a global team of researchers and experts. For more information, please visit us at www.malwarebytes.com/business.
Featured Writers
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.