Scenario

Walter, the information security officer at the state’s largest public university, is witnessing an explosion of mobile devices on campus that surpasses even his own predictions of several years ago, which some saw as dire. The move from laptops as the primary computing device to smartphones and tablets is taking far less time than the transition from desktops to laptops. As if the speed of adoption were not enough to worry about, the number of different devices and the rate at which new consumer products come to market cause considerable heartburn for Walter, charged with protecting the university’s information assets and services.

Mobile users are thrilled by the possibilities that their new devices enable, but most seem happy to download apps with little regard for their security or privacy. One student downloaded an app to his smartphone from a website that should have aroused suspicion, and that app gave unauthorized access to his e-mail and the university’s CMS. Another student downloaded an app that had formerly been safe, but hackers had inserted malicious code into the app and reposted it to an online app market. Over his 15 years working in computer security, Walter has seen awareness of online threats steadily rise, but the caution users applied to laptops doesn’t seem to extend to mobile devices. And students are not unique—faculty, administrators, and even a member of the IT staff have learned about mobile security the hard way. One instructor’s home was burglarized by thieves who knew she was out of town based on location data from her phone, and another staff member unwittingly downloaded a malicious app that then infected his computer when he connected his mobile device to sync them.

Walter has developed a mobile security seminar, which he is trying to make mandatory for all campus users, and he is continually on the lookout for threats to mobile devices and tools or practices that can mitigate those risks. He knows that the university cannot regulate the growing range of devices that access the institution’s network, so he takes steps to limit the damage that infected devices might cause to the network and its services. Walter values the convenience of his own smartphone, but he realizes that mobile security is largely uncharted territory.

1. Not Just Portable but Mobile

Simply by virtue of the fact that laptops are easier to misplace or steal than desktops, the introduction of “portable computing” brought with it greater risks to computer security. From a software standpoint, though, laptops and desktops are relatively close kin—both use “PC-based” operating systems and applications. By contrast, very small computing devices that use mobile operating systems and mobile apps represent a new frontier in the computer security war. Mobile devices (as distinct from traditional laptops) include smartphones, of course, but also emerging classes of devices, including tablets such as the Apple iPad, the Samsung Galaxy, and the Motorola Xoom. They run on operating systems such as Apple’s iOS, Google’s Android, Microsoft’s Windows Phone, and RIM’s BlackBerry OS. Mobile devices also tend to run different or scaled-down versions of browsers and other applications. Nonetheless, mobile devices are computers: You don’t have to go too far back in time to find desktops less powerful than today’s smartphones, and—notwithstanding the limitations of a small screen and keypad—consumers expect to be able to do virtually everything on their phones that they can do on a PC. The evolution of such powerful mobile devices raises a range of security concerns, some of which are familiar, while others present entirely new challenges.

2. Overlapping Insecurities

The moment you disconnect the network cable and begin transmitting data wirelessly, you open the door to a range of security threats. Encrypting data can go a long way toward securing wireless traffic, but this approach is only as good as the type of encryption used. Encryption standards for Wi-Fi have matured to the point that properly configured connections—and appropriate user behavior—can provide reasonably high levels of security. Still, inherent risks remain for wireless computing, and most people have an incomplete understanding of the full range of threats to wireless traffic and of the measures to limit their exposure. Traffic over cellular networks faces similar challenges, and the encryption for at least one type of cellular traffic has been compromised. As a result, mobile devices—which typically use cell service or Wi-Fi, depending on availability—are at least as susceptible to security threats as laptops.

3. Risk Amplification and Divergence

In a number of important ways, mobile devices amplify existing security concerns while introducing a new set of risks. Compared to PC-based operating systems, mobile operating systems are less mature—hackers have spent less time trying to poke holes in them, but by the same token, developers have spent less time protecting them. The same holds true for mobile applications, including antivirus software—despite the fact that malware targeting mobile device platforms has surfaced, panelists at a recent security conference noted that “the market for enterprise-grade smartphone antivirus solutions...is largely nonexistent.” The mobile antivirus software that does exist is generally considered less robust than for PCs. Unlike most laptops or desktops, mobile devices often do not have password protection enabled by default. Given these factors, mobile security becomes highly problematic: When a mobile device is lost or stolen, unauthorized users typically have much less difficulty accessing resources stored on the device or accessed through it, especially when users allow those devices to store passwords to online services. Security tools that allow users to delete all of the data from a lost or stolen device are increasingly common on laptops; such remote-wiping applications are far less common on mobile devices, though this appears to be changing.

Most mobile devices include cameras, which introduce a range of concerns, given the number of places and circumstances in which the ability to take clandestine photos or video can pose security and privacy risks to individuals and organizations. Even on platforms for which all apps must be approved, the marketplace for mobile apps is another avenue for security threats, and that risk may be greater for apps that have little or no oversight. In addition, mobile payment services connect mobile devices to bank accounts and let consumers use smartphones to pay for goods and services; this clearly has broad security ramifications. The convenience and opportunities that mobile devices provide are remarkable. Many consumers, however, fail to appreciate the risks that come with having full-featured, Internet-connected computers in their pockets.

4. The Other Side of the Security Coin Is Privacy

Mobile devices also diverge from laptops in the area of location awareness. Using GPS or other methods, many mobile devices can pinpoint their locations at any time—a feature rarely found on laptops—and can share that information with others.

Indeed, some services, such as the social network Foursquare, are built on a model of knowing where your friends are at any time. Similarly, people often use services like Twitter from mobile devices to say where they are (at a restaurant, out of town). Knowing where individuals are—or where they are not—can be powerful information in the hands of stalkers, burglars, advertisers, and others. Often users voluntarily provide location information, but frequently mobile apps transmit it, sometimes without the user’s knowledge, even when the device is turned off. Many mobile devices can be remotely activated, turning them into microphones without the user’s knowledge.

5. Mobile Floodgates Are Open

The severity of a given security risk is proportional to the number of users potentially affected. Large and fast-growing numbers of people from all walks of life use smartphones and other mobile devices for a widening range of activities, including conducting financial transactions and exchanging other sensitive information. On campus, mobile devices are becoming common tools for teaching and learning and for administrative functions, as well as for personal activities. One result of this widespread adoption and the gold-rush expansion of apps is that mobile devices become a honey pot for the unscrupulous and the criminal. Of course, developers of mobile operating systems and security software are also at work, and the inevitable power struggle ensues.

6. Special Concerns for Higher Education

Colleges and universities are the custodians of considerable amounts of sensitive information. Regulations such as HIPAA and FERPA hold institutions accountable for a wider range of data than many other organizations, and a litany of data breaches involving stolen laptops and misplaced flash drives chronicles higher education’s spotty record with electronic data. Meanwhile, the explosion of mobile devices quickly erodes the control that institutions might otherwise have had in terms of software updates and patches on devices that access campus networks. Most mobile devices are purchased and maintained by individuals, whether students, faculty, staff, or other users who access campus networks. Measures to limit the amount of data stored on mobile devices and tools (such as remote-wiping applications) can mollify the risk, but the days of tight control have likely passed.

7. People: The Security Wildcard

As with all forms of computer security, the biggest threat for mobile devices comes from people. To a considerable extent, mobile devices can securely store private data and conduct sensitive transactions, but only if those devices are configured and used appropriately. Users need to understand the trade-offs between security and functionality in order to make informed decisions about the things they do with mobile devices and the risks those activities incur. User education can be an important part of reducing security incidents, though they will never be eliminated. The rising tide of awareness of security risks for mobile devices will benefit the security of all devices, in terms of changed user habits and of more attention from security vendors to the threats posed.

March 2011

© 2011 EDUCAUSE
This work is licensed under a Creative Commons
Attribution-NonCommercial-NoDerivs 3.0 License.
http://creativecommons.org/licenses/by-nc-nd/3.0/

educause.edu

EDUCAUSE 7 Things You Should Know About™…

EDUCAUSE is a nonprofit membership association created to support those who lead, manage, and use information technology to benefit higher education. A comprehensive range of resources and activities are available to all EDUCAUSE members. For more information about EDUCAUSE, including membership, please contact us at info@educause.edu or visit educause.edu.