FLASH CARDS

7.08 Explain common methods for securing mobile and embedded devices

  • What is the primary purpose of a screen lock on mobile devices?

  • To prevent unauthorized access to the device and protect personal information from theft.

  • Name three common authentication methods used to secure mobile devices.

  • PIN/Password, Fingerprint, Facial Recognition.

  • What is the weakness of a pattern lock?

  • It can be easily observed, guessed, or revealed by smudges on the screen.

  • How does a fingerprint sensor work on mobile devices?

  • The user’s fingerprint is scanned and stored as a template. Future scans are compared to this template for authentication.

  • What is required as a backup when using fingerprint or facial recognition?

  • A PIN or password is required as a backup or for high-privilege tasks (e.g., factory reset).

  • What is an enterprise wipe?

  • An enterprise wipe removes only corporate data and accounts, leaving personal apps and files untouched.

  • What is a full device wipe?

  • A full device wipe erases all data, apps, and settings, restoring the device to factory defaults.

  • What does Mobile Device Management (MDM) software do?

  • MDM applies security policies, controls app installations, manages corporate data, and enforces updates on mobile devices.

  • What is the key difference in patch management between iOS and Android devices?

  • iOS updates are more consistent due to Apple’s control over both hardware and software, while Android updates depend on the device manufacturer.

  • How do antivirus/anti-malware apps work on mobile devices?

  • They block access to known phishing sites, prevent spyware/adware, detect configuration errors, and monitor app permissions.

  • What is Google Play Protect?

  • It is a built-in malware scanning and threat detection tool for Android devices.

  • What is the purpose of firewall apps on mobile devices?

  • To monitor network activity and block unauthorized connections to certain ports or IP addresses.

  • What is the risk of using BYOD (Bring Your Own Device) in a corporate environment?

  • Security vulnerabilities from unmonitored personal devices.

  • What does COBO (Corporate Owned, Business Only) mean in mobile device management?

  • The device is owned by the company and may only be used for business purposes.

  • What is the difference between COPE (Corporate Owned, Personally Enabled) and CYOD (Choose Your Own Device)?

  • COPE provides employees with company-owned devices that allow personal use, while CYOD lets employees choose a device from a list provided by the company.

  • What are key functions of locator apps like Find My iPhone and Find My Device?

  • (a) Remote lock, (b) display “please return” message, (c) ring the device, (d) disable wallet, (e) block passcode changes, (f) prevent disabling of location services.

  • How do GPS and high accuracy location services help locate lost or stolen devices?

  • GPS uses satellites, and high accuracy services use Wi-Fi and Bluetooth triangulation to determine device location.

  • Why is encryption important for mobile devices?

  • Encryption protects sensitive data on mobile devices by making it unreadable without the correct key.

  • What is Data Protection encryption in iOS?

  • An additional layer of encryption for certain apps (e.g., email), protected by the user’s passcode.

  • What encryption method does Android use as of Android 10?

  • File-level encryption, which encrypts user data on a file-by-file basis when a secure screen lock is configured.

  • What are remote backup services, and why are they important for mobile devices?

  • Remote backup services, like iCloud and Google Sync, automatically back up data to the cloud, protecting it in case of loss or theft.

  • What is shadow IT, and why is it a risk in corporate environments?

  • Shadow IT occurs when employees use unapproved devices or services, bypassing official security policies, which can introduce vulnerabilities.

  • What steps can mitigate the risks of IoT devices in corporate networks?

  • Regular security audits and employee security awareness training can help mitigate risks.