I know that many security 'professionals' will scaremonger and preach doom and gloom at every turn in order to drive up sales. However, they're not always wrong. I read the article 'Mobile device users fail to take basic steps to protect themselves, survey finds' and wanted to relate an event that happened this weekend. Many people are saying that mobile device security threats are hype and that nobody is actually exploiting them. That's possibly true to a certain extent at the moment, but for how long? Another article claims that identity theft is now more profitable than car theft! A mobile phone is a very good start for this purpose.
An interesting figure that comes from the article above is that 160,000 mobile phones are lost or stolen every day. I assume that this is just in America, as in Britain the figure is around 20,000 a day. Whether or not these figures are accurate is immaterial, the fact remains that a lot of phones go missing. What do you have access to from your mobile?
The recent incident that I mentioned above happened on Sunday. Someone left their iPhone at a sports training ground I was at. On inspection of the phone, there was no authentication set on it at all. I was able to see photographs, names, addresses and telephone numbers of family and friends. In addition to this, they had a Facebook App, which was still signed in. It would have been very easy to update their status with a malicious link for all their friends to visit. Worse than this, however, was the fact that they had access to their corporate email and address book from the phone - a FTSE 100 company. Again, this was still signed in with no additional authentication required. What corporate information could I have gained access to?
As it was, a phone call to the telephone number entered as 'Home' enabled the phone to be returned without stripping data off it or sending phishing messages. However, what if someone else had picked it up? The survey in the article stated that, of those interviewed, over 65% used their mobile phone to access corporate email and networks. "Do you send or receive sensitive information via email?" should have been the next question.
Businesses and employees should think carefully about the data held on their devices and the level of access they have to the corporate network. At the very least people should always have some form of authentication set on their phone, e.g. a PIN, password or stronger authentication. The majority of users leave applications, such as email and social media accounts, perpetually logged in and many users leave their devices unlocked. Even when they are forced to lock them due to policies, they don't always really secure the device. I have seen many users with corporate phones that require passwords use simple passwords (such as 'qwerty') so that they are easy to type. They site difficulties in typing complex passwords as being the major reason for choosing simple passwords, which is in line with the findings of the survey.
The bottom line is that these devices are part of the corporate network, whether the IT department is aware of them or not. They need protection. Even as an individual, protect your identity and your contacts by employing automatic locking of your mobile with passwords or long PIN numbers and don't leave apps permanently logged in. (I find it surprising/worrying that I have to give this warning/advise!)
Showing posts with label mobile devices. Show all posts
Showing posts with label mobile devices. Show all posts
Tuesday, 11 October 2011
Friday, 29 April 2011
InfoSecurity Europe 2011
InfoSecurity Europe is over for another year. Once again there were several interesting companies and sessions worth noting. The 'themes' (if they can be called that) or 'hot topics' were cloud security again, social media and mobile access/the consumerisation of IT. The big difference seemed to be in the attitudes of people - more 'how can we reduce the risks to an acceptable level?' rather than 'we can't secure it, so we won't allow it!'
We are seeing a shift in the types of systems end users are accessing the corporate network from. The IT department are no longer dictating what will or will not be allowed. More and more users want to use their own personal devices, such as iPhones or iPads, on the network. In the past IT departments have resisted this and said no to the users. However, this attitude is beginning to change and there were a raft of organisations with solutions to help secure these devices and manage the data they contain. However, an awareness of risk and what it means to consumer devices and ownership must be understood beforehand.
With cloud security a big issue, and still stopping some organisations from adopting cloud services, I decided to speak to some of the cloud services providers about their security. Many of them couldn't give me the real technical details, but some of them did have some reassuring things to say. Unfortunately, not all services are equal and organisations are still going to have to do a lot of research on the providers and make sure that they ask to see independant reports on the security of any potential provider. Make sure you ask them the difficult technical questions and only use their service if you are happy with their answers. Again, always remember that you can't outsource risk, so think carefully about what you want to use the cloud for.
Social media is still an issue that some organisations are solving by blocking it and others are ignoring. With the latest generation of products, again we can be quite granular with the level of access granted to social media, so a default blocking isn't necessary in all circumstances. The (ISC)2 have conducted a very interesting survey on security that shows some interesting trends, not least of which is that 49% of organisations block Facebook and around 20% don't monitor social networks at all. As social engineering and backdoors through user activity are some of the main causes of problems, this is worrying. Indeed, the survey showed that security professionals put education and policy mechanisms as the top 6 security security solutions required, with software and technologies coming in 7th and 8th respectively.
We are seeing a shift in the types of systems end users are accessing the corporate network from. The IT department are no longer dictating what will or will not be allowed. More and more users want to use their own personal devices, such as iPhones or iPads, on the network. In the past IT departments have resisted this and said no to the users. However, this attitude is beginning to change and there were a raft of organisations with solutions to help secure these devices and manage the data they contain. However, an awareness of risk and what it means to consumer devices and ownership must be understood beforehand.
With cloud security a big issue, and still stopping some organisations from adopting cloud services, I decided to speak to some of the cloud services providers about their security. Many of them couldn't give me the real technical details, but some of them did have some reassuring things to say. Unfortunately, not all services are equal and organisations are still going to have to do a lot of research on the providers and make sure that they ask to see independant reports on the security of any potential provider. Make sure you ask them the difficult technical questions and only use their service if you are happy with their answers. Again, always remember that you can't outsource risk, so think carefully about what you want to use the cloud for.
Social media is still an issue that some organisations are solving by blocking it and others are ignoring. With the latest generation of products, again we can be quite granular with the level of access granted to social media, so a default blocking isn't necessary in all circumstances. The (ISC)2 have conducted a very interesting survey on security that shows some interesting trends, not least of which is that 49% of organisations block Facebook and around 20% don't monitor social networks at all. As social engineering and backdoors through user activity are some of the main causes of problems, this is worrying. Indeed, the survey showed that security professionals put education and policy mechanisms as the top 6 security security solutions required, with software and technologies coming in 7th and 8th respectively.
Friday, 30 April 2010
InfoSecurity Europe 2010
Once again InfoSecurity Europe was an interesting place to visit. Lots of good sessions and interesting people to talk to. Most of the usual protagonists were there and the organisers have increased the educational part of the exhibition as well, which is good.
I thought I would put down a few things that I thought were noteworthy from the exhibition. I've already blogged about the GrIDsure anti-phishing sender verification and the new 3M mobile phone privacy filters, but there were a few other things I want to mention.
The first one is Panda Security's new Panda Cloud Internet Protection. This is a cloud-based service that provides consistent security and access policies to all machines within an organisation. The key thing is that it will protect mobile machines that are outside the corporate network with the same policies as those within the network. Protecting corporate machines when mobile is a big concern and a good way to reduce malware or hacking problems on the main network.
The usual problem is that mobile devices connect to public, unsecured (or badly secured) networks and either pick up some malware that they bring back with them, or they connect back remotely and open a soft doorway into the corporate network. By securing machines with this cloud service, it should stop them from being a soft target and weak link in your security chain. If you already do something similar by allowing VPN access into the corporate network and allowing them to create connections out, you are using additional bandwidth for this traffic and having to open a VPN connection, which isn't always wise.
Another topic talked about (mainly by Sophos) was the security, or lack thereof, when using social media. Graham Cluley gave a really good talk on the subject on the Sophos stand including the use of SPAM avatars on sites such as Twitter. The attack is centred around the fact that anti-SPAM filtering finds it hard to scan the content of images, e.g. by doing Optical Character Recognition (OCR). So, people have been putting written messages in their ID picture to get past any filtering. You can find out more from his blog.
The final mention has to go to Ian Mann from ECSC. He, once again, talked about several Social Engineering techniques to get past security. He stated that he always likes to see security guards when trying to gain unauthorised access, as it usually makes the system much less secure. He gave a talk in one of the main theatres as well as several talks on the ECSC stand, all of which were interesting. He has written a book called Hacking the Human, which is worth a read if you want to find out more.
Beyond that, most of the usual suspects were there and many things were as before with incremental changes and updates. There didn't seem to be a central theme or message from all the vendors or industry in general. Everyone seemed to be concentrating on their own topics and products. One new addition to the exhibition was the University Pavilion. I think this could be put to good use to show people what's coming over the horizon or how these technologies that the vendors are pushing actually work.
I thought I would put down a few things that I thought were noteworthy from the exhibition. I've already blogged about the GrIDsure anti-phishing sender verification and the new 3M mobile phone privacy filters, but there were a few other things I want to mention.
The first one is Panda Security's new Panda Cloud Internet Protection. This is a cloud-based service that provides consistent security and access policies to all machines within an organisation. The key thing is that it will protect mobile machines that are outside the corporate network with the same policies as those within the network. Protecting corporate machines when mobile is a big concern and a good way to reduce malware or hacking problems on the main network.
The usual problem is that mobile devices connect to public, unsecured (or badly secured) networks and either pick up some malware that they bring back with them, or they connect back remotely and open a soft doorway into the corporate network. By securing machines with this cloud service, it should stop them from being a soft target and weak link in your security chain. If you already do something similar by allowing VPN access into the corporate network and allowing them to create connections out, you are using additional bandwidth for this traffic and having to open a VPN connection, which isn't always wise.
Another topic talked about (mainly by Sophos) was the security, or lack thereof, when using social media. Graham Cluley gave a really good talk on the subject on the Sophos stand including the use of SPAM avatars on sites such as Twitter. The attack is centred around the fact that anti-SPAM filtering finds it hard to scan the content of images, e.g. by doing Optical Character Recognition (OCR). So, people have been putting written messages in their ID picture to get past any filtering. You can find out more from his blog.
The final mention has to go to Ian Mann from ECSC. He, once again, talked about several Social Engineering techniques to get past security. He stated that he always likes to see security guards when trying to gain unauthorised access, as it usually makes the system much less secure. He gave a talk in one of the main theatres as well as several talks on the ECSC stand, all of which were interesting. He has written a book called Hacking the Human, which is worth a read if you want to find out more.
Beyond that, most of the usual suspects were there and many things were as before with incremental changes and updates. There didn't seem to be a central theme or message from all the vendors or industry in general. Everyone seemed to be concentrating on their own topics and products. One new addition to the exhibition was the University Pavilion. I think this could be put to good use to show people what's coming over the horizon or how these technologies that the vendors are pushing actually work.
3M's Mobile Phone Privacy Filter
At this year's InfoSecurity Europe I visited the 3M stand again to see what developments they had for their privacy filters. They had their excellent Gold filter there of course, which is now properly on sale in the UK and the best on the market in my opinion. I previously blogged about this filter in my post "Why do I need a privacy filter? (3M's new Vikuiti Gold Privacy Filter)".
So what's this blog post about? Well, they have now produced privacy filters for mobile phones. Let's add a bit of context to this decision. How many businesses provide mobile devices to their employees that are connected to the corporate network with access to email, contacts, calendars and corporate documents? If you were reading an email from a client or reviewing a sensitive document would you be happy for someone to peer over your shoulder? Maybe you're paranoid like me and try to avoid reading emails in public places and stand with your back to the wall, shielding the screen when you have to read something urgently (Note: you shouldn't really store sensitive documents on a mobile phone in the first place, but that's another topic). However, 3M have made the whole thing a bit easier and allowed people to look a bit more normal than I do when using email in a public place.
I had a bunch of questions that I wanted to ask 3M about this new filter and I got some answers that I will share with you here. Firstly, I'll give you a brief introduction to their product, which can be seen in the image below. This is basically a screen protector with the privacy filter combined. It uses the standard matte grey louvered filter that gives privacy in one plane (I'll explain this in a bit and the problem with it). It uses the matte film as reflective films would get scratched with the type of use that a mobile gets according to the guys on the stand. The film is self-adhesive, using 3M's Post-It note glue, so it should come off with no residue and be easy to fit. This is effectively a replacement for your standard screen protector with the added benefit of including the privacy filter.
Now to some of the questions I had:
So what's this blog post about? Well, they have now produced privacy filters for mobile phones. Let's add a bit of context to this decision. How many businesses provide mobile devices to their employees that are connected to the corporate network with access to email, contacts, calendars and corporate documents? If you were reading an email from a client or reviewing a sensitive document would you be happy for someone to peer over your shoulder? Maybe you're paranoid like me and try to avoid reading emails in public places and stand with your back to the wall, shielding the screen when you have to read something urgently (Note: you shouldn't really store sensitive documents on a mobile phone in the first place, but that's another topic). However, 3M have made the whole thing a bit easier and allowed people to look a bit more normal than I do when using email in a public place.
I had a bunch of questions that I wanted to ask 3M about this new filter and I got some answers that I will share with you here. Firstly, I'll give you a brief introduction to their product, which can be seen in the image below. This is basically a screen protector with the privacy filter combined. It uses the standard matte grey louvered filter that gives privacy in one plane (I'll explain this in a bit and the problem with it). It uses the matte film as reflective films would get scratched with the type of use that a mobile gets according to the guys on the stand. The film is self-adhesive, using 3M's Post-It note glue, so it should come off with no residue and be easy to fit. This is effectively a replacement for your standard screen protector with the added benefit of including the privacy filter.
Now to some of the questions I had:
- Does it work with touch screens? - Yes it does. They had an iPhone there and it worked perfectly.
- Does it work with a stylus? - Yes it does. They had an Windows Mobile-based XDA there, which also worked with no problems.
- Does it make the mobile hard to use? - No, the dimming of the screen caused by the filter is not too much of a problem. With the backlight off you pretty much can't read the screen, but how many people use their mobile with the backlight off? There is some drop in brightness, but you can increase the brightness of the screen to compensate. However, this does have the big side-effect of reducing battery life - a major problem on smartphones.
- What if I have a mobile that I can use in landscape as well as portrait, like an HTC or iPhone? - Well, you have a problem. It comes back to what I said above: the filter only works in one plane. The filter has vertical louvres so that as you move to the side they overlap and block out the screen, like vertical blinds. However, vertical movement doesn't change the overlap of the louvres, so there is no blocking of the screen in this plane. So, you have to decide which way you want the filter, portrait or landscape - it will only provide privacy in one plane. Now, this isn't a problem for a lot of phones, particularly the majority of Blackberries, which are still the preferred business machine by many organisations. It is a problem, however, for iPhones (which aren't business phones in my opinion) and many Windows Mobile phones with the iPhone-esque interface.
- Couldn't we have the Gold filter on a mobile to sort this problem? - Unfortunately, not yet, but they are working on it. There are a few technical difficulties apparently. Firstly, there is the point I made earlier, that mirror finished filters would scratch too readily on a mobile device that is thrown in a bag or stuffed into a pocket with other things. Apparently, they have a matte version of the Gold Filter in the lab, but it isn't available yet or in the near future. There is a second problem. Apparently, the Gold Filter doesn't take to being glued so easily as the grey filter. However, they are working on this as well and hope to have a solution soon.
- Do they come pre-cut to my mobile? - Yes and no. If you have a Blackberry or iPhone then yes, otherwise no. You buy a sheet and cut it yourself. I believe that there are other companies, such as wrappz.com, that will be able to cut one for your device in the future. I think this is a must for the uptake of the filter. How many business executives are going to sit down with a craft knife and straight-edge to cut their filter to the exact shape and size of their phone as well as the holes for the buttons, cameras, speakers, microphones, etc.? The problem for 3M is that mobiles come in all shapes and sizes, with absolutely no standardisation. Laptops and monitors, on the other hand, do have standard sizes.
Wednesday, 28 October 2009
PhoneFactor Security
I was asked recently to look at the security of the PhoneFactor 2-factor authentication solution. If you don't know what it is, then you can find out more here, but essentially you enter your username and password, then they phone you on your pre-defined number and press the # key to validate the authentication. The problem with just pressing the # key is obvious, but they allow you to configure entering a PIN number rather than just pressing the # key. To my mind, there should be no other option than having to type in the PIN number. However, this isn't necessarily a brilliant idea. As I've said before in this blog, a lot of phones log the digits dialled, in which case that PIN isn't secure.
I was also told that the PSTN and GSM networks are secure, so this is a good solution. I'm not sure I agree that PSTN and GSM networks have good security. Analogue PSTN is easy to listen in to with proximity and GSM can theoretically be cracked, and probably will be within 6 to 12 months. So that PIN number isn't really secure. Plus there is the cloned SIM card problem as well.
The one advantage is that I have to intercept every login attempt, and wait for you to login before I can gain access. Without a 2-factor system, once I've read your username/password combination I can login whenever I like. PhoneFactor would appear to mitigate some of this risk by doing the authentication out of band. However, there is still an attack vector for a MITM attack. In the same way as before, you login to my portal, I forward your credentials, PhoneFactor phone you and you put in your PIN, they enable my session! Obviously, there are other attack vectors as well.
Another potential issue is that you are charged for the phone calls made by PhoneFactor on your behalf. These can be significant costs. In the UK calls to landlines are free, but am I always at my desk when I want to log in? No, I'd want it on my mobile; that will cost me $0.23 per login (East Timor $3.25). So, I could rack up the bill for you company by getting them to call through to someone. If I do this enough times (especially if that person is on holiday in another country with higher charges) I can use up all your credit and none of your users can login.
There is a privacy issue as well. PhoneFactor will know every time you log in or access your bank, etc. How do they protect that data? Do you want them to know that information, even if you do trust they won't accidentally disclose it?
However, I am not against 2-factor authentication. Indeed I think it is a good thing, as users will choose poor passwords, reuse them everywhere and write them down. Similarly, they will give them away to phishing scams. 2-factor authentication removes all of those problems, but by no means is it absolutely secure. PhoneFactor seems OK, but it's not particularly cheap or phenomenally secure. There are some other good software solutions that are pretty cheap as well, and that can combat shoulder-surfing when entering PIN numbers, etc. There are a couple of examples on a blog post I did a couple of months ago: http://blog.rlr-uk.com/2009/06/user-friendly-multi-factor.html
The bottom line is that they are more secure than username/password, but none of them are absolutely secure against all attacks.
I was also told that the PSTN and GSM networks are secure, so this is a good solution. I'm not sure I agree that PSTN and GSM networks have good security. Analogue PSTN is easy to listen in to with proximity and GSM can theoretically be cracked, and probably will be within 6 to 12 months. So that PIN number isn't really secure. Plus there is the cloned SIM card problem as well.
http://www.mobileindustryreview.com/2009/08/gsm-encryption-can-be-cracked-for-500.html
Having said that, PhoneFactor looks quite good as you enter the PIN on the phone line, not the login dialogue. The problem that Bruce Schneier has referred to is that of a Man-in-the-Middle attack. Most 2-factor authentication methods are susceptible to a MITM attack, including RSA tokens and other hardware tokens. Basically, if I set up a website, for example, to mimic your corporate portal, then you will enter all your details into my page, including your one-time pass code. I will forward them on to the real portal and do whatever I like logged in as you.The one advantage is that I have to intercept every login attempt, and wait for you to login before I can gain access. Without a 2-factor system, once I've read your username/password combination I can login whenever I like. PhoneFactor would appear to mitigate some of this risk by doing the authentication out of band. However, there is still an attack vector for a MITM attack. In the same way as before, you login to my portal, I forward your credentials, PhoneFactor phone you and you put in your PIN, they enable my session! Obviously, there are other attack vectors as well.
Another potential issue is that you are charged for the phone calls made by PhoneFactor on your behalf. These can be significant costs. In the UK calls to landlines are free, but am I always at my desk when I want to log in? No, I'd want it on my mobile; that will cost me $0.23 per login (East Timor $3.25). So, I could rack up the bill for you company by getting them to call through to someone. If I do this enough times (especially if that person is on holiday in another country with higher charges) I can use up all your credit and none of your users can login.
There is a privacy issue as well. PhoneFactor will know every time you log in or access your bank, etc. How do they protect that data? Do you want them to know that information, even if you do trust they won't accidentally disclose it?
However, I am not against 2-factor authentication. Indeed I think it is a good thing, as users will choose poor passwords, reuse them everywhere and write them down. Similarly, they will give them away to phishing scams. 2-factor authentication removes all of those problems, but by no means is it absolutely secure. PhoneFactor seems OK, but it's not particularly cheap or phenomenally secure. There are some other good software solutions that are pretty cheap as well, and that can combat shoulder-surfing when entering PIN numbers, etc. There are a couple of examples on a blog post I did a couple of months ago: http://blog.rlr-uk.com/2009/06/user-friendly-multi-factor.html
The bottom line is that they are more secure than username/password, but none of them are absolutely secure against all attacks.
Thursday, 24 September 2009
Personal Mobile Devices Violate Compliance
Computer Weekly recently conducted a survey via Twitter on how many organisations allow their users access to corporate email from their own private phone. Unfortunately, I haven't seen any results from this survey as yet, but it made me think about organisations that do allow private devices to attach to the network, not just mobile phones. I have also had many comments on my blog post entitled 'Mobile Device Data Breaches', which have fed into this post.
In one of those comments, someone pointed out that in their experience users are often a weak link. Isn’t it always the case that users are the weakest link? A poorly educated/trained user can compromise the best security. Unfortunately, I have seen so many organisations that do not adequately train their users or make them aware that there are policies, let alone what they mean to their daily usage of the corporate systems. I have also come across one organisation where a top executive had all the system passwords stored, unencrypted, on his PDA. He didn’t see a problem with this as he always carried it with him!
How many organisations these days have push email onto a mobile? How many of those organisations send sensitive documents around via email? Do they have encryption and password access on those devices? Not many that I’ve seen. The typical Blackberry users that I see have no password or PIN access to their phone, but it does have full access to the corporate mail exchange. These devices also have the ability to store, and even sync, corporate documents. What policies do you have to cover them?
Quoting from ISO-27002:2005 11.7.1: A formal policy should be implemented, and appropriate security measures adopted, for mobile computing and communications activities. Controls should apply to laptop, notebook, and palmtop computers; mobile phones and "smart" phone-PDAs; and portable storage devices and media. Controls include requirements for:
I think it’s asking for trouble to allow users to connect their own private devices to the network or services. I don’t see how you can comply with any standards or your own security policies when allowing this, as you don’t know what’s connected or how it’s configured. Even if they are secure (a very big IF), by not knowing the configuration or being able to audit it, you are surely in violation of any accreditation or certification that you may have because you cannot test or 'prove' your compliance.
In one of those comments, someone pointed out that in their experience users are often a weak link. Isn’t it always the case that users are the weakest link? A poorly educated/trained user can compromise the best security. Unfortunately, I have seen so many organisations that do not adequately train their users or make them aware that there are policies, let alone what they mean to their daily usage of the corporate systems. I have also come across one organisation where a top executive had all the system passwords stored, unencrypted, on his PDA. He didn’t see a problem with this as he always carried it with him!
How many organisations these days have push email onto a mobile? How many of those organisations send sensitive documents around via email? Do they have encryption and password access on those devices? Not many that I’ve seen. The typical Blackberry users that I see have no password or PIN access to their phone, but it does have full access to the corporate mail exchange. These devices also have the ability to store, and even sync, corporate documents. What policies do you have to cover them?
Quoting from ISO-27002:2005 11.7.1: A formal policy should be implemented, and appropriate security measures adopted, for mobile computing and communications activities. Controls should apply to laptop, notebook, and palmtop computers; mobile phones and "smart" phone-PDAs; and portable storage devices and media. Controls include requirements for:
- physical protection;
- data storage minimization;
- access controls;
- cryptographic techniques;
- data backups;
- anti-virus and other protective software;
- operating system and other software updating;
- secure communication (e.g., VPN) for remote access; and
- sanitization prior to transfer or disposal.
"I feel that you can lock down with security policy and tools but this is a complex problem as the combination of mobility and technology diversity, e.g. I can use my iPhone to connect to the enterprise network and store sensitive data on it, is creating a major headache for infosec professionals. As well as the problem with laptops and USB drives we are also seeing a growing use of employee-owned mobile devices, netbooks, games consoles, smart phones, all having IP and WiFi capabilities and all capable of picking up enterprise data and email."There are a number of things we can do to stop these devices from compromising the network by blocking their use. We can block USB devices from being able to connect unless they are a managed resource, so that users can't just plug anything they bring in from home. All USB devices have an ID, which can be registered with a central authentication server to check before a computer allows it to be used. Of course this needs third-party software, but can be done quite easily. We can also block devices from being able to obtain an IP address or connect to the corporate network in the first place. We shouldn't have a free-for-all attitude on the network. It should be locked down to approved devices only. Only managed devices can connect and they will have to authenticate.
I think it’s asking for trouble to allow users to connect their own private devices to the network or services. I don’t see how you can comply with any standards or your own security policies when allowing this, as you don’t know what’s connected or how it’s configured. Even if they are secure (a very big IF), by not knowing the configuration or being able to audit it, you are surely in violation of any accreditation or certification that you may have because you cannot test or 'prove' your compliance.
Friday, 4 September 2009
Mobile Device Data Breaches
Several recent data breaches at major enterprises and governmental agencies stemmed from the loss or theft of mobile computers and USB drives. While encrypting the data on these devices isn’t a bad idea, the larger question is why was sensitive personal information stored on the mobile device in the first place?
See my first video blog for Comodo Vision here.
Subscribe to:
Posts (Atom)