Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/12/2017
11:00 AM
Nathan Collier
Nathan Collier
Partner Perspectives
50%
50%

Securing your Privacy on Android

If you work at a company that allows you to use your mobile device to login to email, access company data, or connect to company Wi-Fi, you're more of a security risk than you think.

Whether you are a government employee with sensitive data stored on your mobile device or a casual user who can’t lose his precious cat pictures, turning on security settings to keep your privacy secure on an Android device is important.

But in an era of having to keep track of multiple complex passwords, policies to reset passwords as soon as you just started remembering the last one, and taking two or more steps of authentication to login to most things these days, it’s easy to see why people get lax with security on their personal mobile device. It’s a case of convenience vs security. Leave your device unlocked, and you make it easy for your private data to be stolen. Lock things down tight, and you may find yourself ready to chuck your device at the ground when it locks itself (again) when you’re in the middle of an important task. 

Let’s look at some of the common security settings available on Android devices.

Screen Locks: The Basics
Most Android devices come with these basic screen lock settings, listed least to most secure:

  • Pattern – Draw a pattern on dots to unlock device
    • Minimum 4 dots, max 9 dots
  • PIN – Enter a number to unlock device
    • Minimum 4 digits, max 17 digits
  • Password – Enter a good old password to unlock device
    • Minimum 4 characters, max 17 characters

Choosing which method, and how many elements used for that method, determines how secure it is. For example, a 6-character password will be more secure than an 8-dot pattern. No matter what you do with your mobile device, you should use at least one of these methods to secure it.

Screen Locks: Biometrics
It seems each new mobile device iteration comes with a clever new way to unlock your device, most of which involve biometric technology. Biometrics use your biology to recognize you and let you access your device, for example by fingerprint, retina (eye), or face.

The biggest concern with any biometric security method is that you can’t change your biology like you can with a password. As technology advances, we will see advances in the ability to hack these biometrics, and there are already several proof-of-concept hacks that can potentially exploit each. Still, it’s a lot easy to put your finger on a scanner than enter a PIN.

Sleep Timeout & Auto Lock Timeout
The sleep timeout determines the length of time before your mobile device goes to sleep. The auto lock timeout is the length of time after the device is asleep that it will lock itself. You can even go a step further and set the device to lock when the power button is pressed.

Start with shorter timeouts and work your way to longer ones in order to find the right balance of security and convenience. Or put another way, figure out how many times you can unlock your device throughout the day before you can’t take it anymore! Just remember, the longer the timeout, the more time there is for personal data to be stolen.

What's at Stake 
If you work at a company that allows you to use your mobile device to login to email, access company data, and/or connect to company Wi-Fi, you could be more of a risk than you think — especially if it’s a well-known company.  Targeted attacks are the easiest way for criminals to steal sensitive information from a company, and that device you carry around everywhere could easily be used against the company where you work.  If a mobile device is lost or stolen with no security settings, criminals could easily use it to gain access into sensitive business information, or information that is beyond the compromised user’s permissions.

There are other reasons to keep your mobile device secure. Stolen, unlocked devices can easily be factory reset and sold for profit. Criminals could do whatever they like with your personal information — like post those private pictures for all your followers to see on social media. So, it’s best to stay safe, turn on those security settings, and have a little piece of mind that your privacy is secure.

Full time mobile malware researcher, part time endurance mountain bike athlete and world traveler. As nerdy about biking as he is about mobile malware. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19698
PUBLISHED: 2019-12-10
marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.