Smart Use of Smart Phones

by Thomas L. Roberts, ITS Information Security Analyst

As cell phone technology continues to advance so do the useful benefits for mobile business users. In addition to traditional phone services, modern cell phones are “smart” devices that provide remote access to email, Web services, file shares, calendar information, instant messaging and can connect to the Internet via multiple wireless technologies. Smart phones are really just small multifunctional computers that integrate a variety of communication methods and services.

Unfortunately, smart phones can be a contributing factor to loss of sensitive information, virus/malware infections and raise many privacy concerns. Proper management of these devices is mandatory to ensure they function only as intended.  During research for this article, I found a product that easily and quickly extracts information from most cell phones (including all deleted messages) and transfers it to a PC. This tool in the wrong hands could be disastrous. However, not all access to data requires that level of effort.  A phone with no access controls in place can be browsed by someone who possesses your phone by simply accessing the information the same way you do. That is why we emphasize the on-going importance of maintaining physical security when using a smart phone containing any sensitive business or personal data.

As with other computing equipment, it is important to use these smart devices wisely and keep abreast of evolving vulnerabilities, threats and privacy issues.  Consider the following tips:

• Modern smart phones are actually small mobile computers and may have vulnerabilities. Do not open unexpected email attachments and avoid installing untested software.
• Enable the existing security protections provided with the phone. Set a password to avoid unwanted access.
• Smart phones are portable, easily concealed and unfortunately often misplaced or stolen. Thieves are not usually as interested in the phone itself as they are the information the phones contain or access to services that they do not have to pay for. Some phones contain protections that erase, lock or completely disable all services and data on the phones if they are stolen. The new Exchange email system implemented at BGSU has this capability.
• Be advised—remote wiping of the phone only works if you have accessed the Exchange system from the phone at some point prior to its disappearance. If you lose or misplace your phone you can log into the Outlook Web Access (OWA) to wipe the phone yourself. If you need assistance, please contact the Technology Support Center, at 2-0999, tsc@bgsu.edu.
• Older phones or phones that have not been connected to the Exchange email system may not be able to be wiped or disabled remotely. Before donating, selling or disposing of any cell phone find out how to “safely” or “permanently” erase the personal information it contains. This process is often more complicated than simply deleting the information. Read the owner documentation or contact the manufacturer for recommended deletion techniques.
• Many smart phones have the ability to connect to 802.11 wireless networks often used by laptops. Examples are wireless services available at airports, restaurants and hotels. When connecting to these services you are also accepting the existing wireless network security (or lack thereof). Ask questions regarding the trustworthiness of the wireless network before connecting.
• Smart phones come with multiple wireless technologies, many enabled by default. One example is Bluetooth, which is useful for transferring information over short distances. Configure the available security settings and disable Bluetooth when not in use. Not only will this help prevent loss of data but it will help prevent hijacking phone services from your account.
• Syncing phones with other devices is useful for transferring information. It is also important to consider the security of all devices with which the cell phone is synced. Have virus protection on all devices to avoid the spread of malware, viruses or trojan software. Before traveling with a smart phone, only sync the information necessary.
• Evaluate smart phone encryption technologies to avoid sensitive information exposures. Keep in mind that phone encryption technologies continue to evolve and many only offer limited protection capabilities.