Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/12/2017
11:00 AM
Nathan Collier
Nathan Collier
Partner Perspectives
50%
50%

Securing your Privacy on Android

If you work at a company that allows you to use your mobile device to login to email, access company data, or connect to company Wi-Fi, you're more of a security risk than you think.

Whether you are a government employee with sensitive data stored on your mobile device or a casual user who can’t lose his precious cat pictures, turning on security settings to keep your privacy secure on an Android device is important.

But in an era of having to keep track of multiple complex passwords, policies to reset passwords as soon as you just started remembering the last one, and taking two or more steps of authentication to login to most things these days, it’s easy to see why people get lax with security on their personal mobile device. It’s a case of convenience vs security. Leave your device unlocked, and you make it easy for your private data to be stolen. Lock things down tight, and you may find yourself ready to chuck your device at the ground when it locks itself (again) when you’re in the middle of an important task. 

Let’s look at some of the common security settings available on Android devices.

Screen Locks: The Basics
Most Android devices come with these basic screen lock settings, listed least to most secure:

  • Pattern – Draw a pattern on dots to unlock device
    • Minimum 4 dots, max 9 dots
  • PIN – Enter a number to unlock device
    • Minimum 4 digits, max 17 digits
  • Password – Enter a good old password to unlock device
    • Minimum 4 characters, max 17 characters

Choosing which method, and how many elements used for that method, determines how secure it is. For example, a 6-character password will be more secure than an 8-dot pattern. No matter what you do with your mobile device, you should use at least one of these methods to secure it.

Screen Locks: Biometrics
It seems each new mobile device iteration comes with a clever new way to unlock your device, most of which involve biometric technology. Biometrics use your biology to recognize you and let you access your device, for example by fingerprint, retina (eye), or face.

The biggest concern with any biometric security method is that you can’t change your biology like you can with a password. As technology advances, we will see advances in the ability to hack these biometrics, and there are already several proof-of-concept hacks that can potentially exploit each. Still, it’s a lot easy to put your finger on a scanner than enter a PIN.

Sleep Timeout & Auto Lock Timeout
The sleep timeout determines the length of time before your mobile device goes to sleep. The auto lock timeout is the length of time after the device is asleep that it will lock itself. You can even go a step further and set the device to lock when the power button is pressed.

Start with shorter timeouts and work your way to longer ones in order to find the right balance of security and convenience. Or put another way, figure out how many times you can unlock your device throughout the day before you can’t take it anymore! Just remember, the longer the timeout, the more time there is for personal data to be stolen.

What's at Stake 
If you work at a company that allows you to use your mobile device to login to email, access company data, and/or connect to company Wi-Fi, you could be more of a risk than you think — especially if it’s a well-known company.  Targeted attacks are the easiest way for criminals to steal sensitive information from a company, and that device you carry around everywhere could easily be used against the company where you work.  If a mobile device is lost or stolen with no security settings, criminals could easily use it to gain access into sensitive business information, or information that is beyond the compromised user’s permissions.

There are other reasons to keep your mobile device secure. Stolen, unlocked devices can easily be factory reset and sold for profit. Criminals could do whatever they like with your personal information — like post those private pictures for all your followers to see on social media. So, it’s best to stay safe, turn on those security settings, and have a little piece of mind that your privacy is secure.

Full time mobile malware researcher, part time endurance mountain bike athlete and world traveler. As nerdy about biking as he is about mobile malware. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17476
PUBLISHED: 2020-08-10
Mibew Messenger before 3.2.7 allows XSS via a crafted user name.
CVE-2020-9525
PUBLISHED: 2020-08-10
CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attackers to perform a man-in-the-middle attack, as demonstrated by eavesdropping on user video/audio streams, capturing credentials, and compromising devices.
CVE-2020-9526
PUBLISHED: 2020-08-10
CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video/audio streams, capturing credentials, and compromising devic...
CVE-2020-9527
PUBLISHED: 2020-08-10
Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20, after 2018-08-09 through 2020), as used by many different vendors in millions of Internet of Things devices, suffers from buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code via ...
CVE-2020-9528
PUBLISHED: 2020-08-10
Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Things devices, suffers from cryptographic issues that allow remote attackers to access user session data, as demonstrated by eavesdropping on user video/audio strea...