102 Digital Life Security #6: Phone Security — The Computer in Your Pocket

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

We still call it a phone.

But calling a modern smartphone a telephone is a little like calling a pickup truck a radio because it happens to contain one.

Your phone may contain your email, text messages, photographs, contacts, passwords, banking apps, authentication codes, health information, location history, cloud storage, business information, and access to other computers and services.

It may also be the device that proves you are you when you log into another account.

That makes your phone one of the most important security devices you own.

Start With the Lock Screen

Imagine leaving your phone on a restaurant table and walking away.

What could someone do with it?

If the phone is properly locked, hopefully very little.

If it is unlocked, the answer could be very different.

A screen lock is the first barrier protecting the information and accounts accessible through the device.

Modern phones may offer a PIN, password, fingerprint, facial recognition, or a combination of these technologies.

The important thing is to use a strong device lock and configure the phone to lock automatically after a reasonable period of inactivity.

A Four-Digit PIN Is Not the Only Choice

Short PINs are convenient, but the number of possible combinations is limited.

Many devices allow longer PINs or alphanumeric passcodes.

That does not necessarily mean everyone needs an extremely long password every time they unlock a phone. Biometrics can make a stronger underlying device passcode much more practical.

You may use your face or fingerprint most of the time while retaining a stronger passcode as the underlying credential.

The goal is to balance security and usability so that the protection actually gets used.

What Is Your Fingerprint Actually Doing?

We touched on this in our discussion of authentication.

When you use a fingerprint or facial recognition system, your biometric information can be used locally by the device to authorize an action.

For example, the phone may use it to unlock protected cryptographic material or approve access to a stored credential.

This is different from sending your fingerprint across the internet every time you log into a website.

The distinction is important:

The biometric often helps your device decide whether you are allowed to use something the device is protecting.

The Lock Screen Can Still Reveal Information

Locking the phone does not necessarily mean the screen reveals nothing.

Notifications may display:

• Text messages
• Email subjects
• Calendar appointments
• Verification codes
• Names of people contacting you
• Information from applications

Review what your phone allows to appear while it is locked.

You may decide that seeing every message without unlocking the device is more convenience than you need.

Keep the Operating System Updated

Just as with browsers, phone updates are security tools.

Modern mobile operating systems are enormously complicated. Security researchers and developers regularly discover vulnerabilities, and updates frequently contain fixes.

Installing supported security updates reduces the amount of time your phone remains exposed to vulnerabilities that have already been identified and corrected.

This also raises an important question when keeping an older phone for many years:

Is the device still receiving security updates?

A phone can continue working perfectly well after official security support ends, but the security calculation has changed.

Applications Expand the Attack Surface

Every application adds software to your digital environment.

In security, we sometimes talk about the attack surface.

This means, broadly, the collection of places where an attacker might potentially interact with or attempt to exploit a system.

Installing more software can increase functionality.

It can also increase complexity.

This does not mean we should be afraid to install apps.

It means we should be selective.

If you no longer use an application, consider removing it.

Where Did the App Come From?

The source of software matters.

Official application stores provide an important layer of review, distribution control, signing, and update management.

They are not perfect, and malicious applications have occasionally made it through review systems.

But obtaining software from trusted sources reduces unnecessary risk compared with installing unknown software from random websites or links.

Be especially cautious when a message or website urgently tells you that you must install an application.

Applications Live in Sandboxes

Modern phone operating systems generally attempt to isolate applications from one another.

This concept is often called sandboxing.

An application should not automatically have unrestricted access to everything belonging to every other application.

The operating system creates boundaries.

This is similar to something we encountered with browsers, where websites are prevented from freely accessing one another's information.

Isolation is a recurring security principle.

If one component becomes compromised, good security architecture tries to limit how far the damage can spread.

Permissions Create Controlled Openings

Applications sometimes legitimately need access beyond their basic sandbox.

A navigation app may need your location.

A video application may need the camera and microphone.

A photo-editing application may need access to photographs.

A calling application may need your contacts.

Permissions allow those controlled openings.

But every permission should have a reason.

If a simple flashlight application wants your contacts, microphone, location, and photographs, asking why? is entirely reasonable.

Review App Permissions

Permissions tend to accumulate.

We install an application, approve something because we need it at that moment, and then forget about it.

Periodically look through the privacy and security settings on your phone.

Review which applications can access:

• Location
• Camera
• Microphone
• Contacts
• Photos
• Bluetooth
• Local network devices
• Notifications
• Other sensitive information

You may be surprised by what you find.

Does Location Access Need to Be Permanent?

Some applications genuinely need location information.

But they may not need it all the time.

Modern phones often provide choices such as allowing location access only while an application is being used or granting approximate rather than precise location.

Choose the level of access that makes sense for what the application actually does.

This illustrates another useful security principle:

Give software the access it needs to perform its job, but no more than necessary.

This is related to the security concept known as least privilege.

Least Privilege Is Bigger Than Phones

We are going to encounter least privilege repeatedly throughout this series.

An application should receive only the permissions it needs.

A website user should receive only the privileges needed for that account.

A server process should receive only the system permissions required to perform its function.

A network device should have access only to the parts of the network it needs.

If something goes wrong, limiting privileges can limit the damage.

This concept will become especially important when we eventually discuss servers and network security.

Your Phone May Contain Your Second Factor

Remember multifactor authentication?

Your phone may receive text-message verification codes.

It may contain an authenticator application.

It may receive login approval notifications.

It may store passkeys.

It may even be a trusted device used to recover other accounts.

This means protecting the phone also helps protect accounts elsewhere.

Think About What Happens If the Phone Is Lost

Do not wait until your phone disappears to learn how lost-device protection works.

Modern smartphone platforms commonly provide tools that can help locate, lock, or otherwise protect a missing device.

Make sure you know:

• Whether device-location features are enabled
• How you would access them without the missing phone
• What account credentials you would need
• Whether you have another trusted device
• How your data is backed up
• What options exist for remotely securing or erasing the phone if necessary

A security plan created before an emergency is much easier to use than one invented during the emergency.

Backups Are Part of Security

We sometimes think of backups as an information-management issue rather than a security issue.

They are both.

If a phone is lost, damaged, stolen, or erased, a good backup can dramatically reduce the consequences.

Security is not only about preventing unauthorized access.

It also involves protecting the availability of information we need.

This introduces another important security concept.

Confidentiality, Integrity, and Availability

Information security is often described using three fundamental goals:

Confidentiality — information should be available only to people or systems authorized to access it.

Integrity — information should not be improperly changed or corrupted.

Availability — information and systems should be accessible when authorized users need them.

These are sometimes called the CIA triad.

A screen lock helps protect confidentiality.

Security mechanisms can help protect integrity.

A reliable backup helps protect availability.

This simple model will help us think about many future security questions.

Encryption Protects Stored Information

Modern phones commonly use encryption to help protect data stored on the device.

Encryption transforms information so that it cannot simply be read without the necessary cryptographic key or access mechanism.

The phone's security architecture, device passcode, hardware protections, and encryption can work together to make information much harder to recover from a locked device.

This is another reason a strong device passcode matters.

The lock screen is not merely hiding the icons on your phone.

It can be part of a much larger system protecting access to encrypted information and cryptographic keys.

Public Wi-Fi: Understand the Risk

Public Wi-Fi deserves sensible caution, but not panic.

Modern HTTPS encryption means that much of the web traffic between your browser and legitimate HTTPS websites is encrypted even when the underlying Wi-Fi network is not yours.

That is a major improvement over the early days of public wireless networking.

But the network still matters.

A malicious or poorly configured network may attempt to manipulate DNS, redirect connections, observe unencrypted traffic, or deceive users with fake network names or login pages.

Pay attention to which network you are joining and avoid overriding certificate or security warnings simply because you are trying to get online.

Beware of the Evil Twin

Suppose you are sitting in a hotel and see two networks:

HotelGuest

and:

Hotel_Guest_WiFi

Which one is real?

An attacker can create a wireless network with a convincing name and hope people connect to it.

This is sometimes called an evil twin access point.

When the correct network is uncertain, verify it with the organization providing the service rather than simply choosing the strongest signal or friendliest-looking name.

Automatic Wi-Fi Connections Deserve Attention

Phones can remember networks and automatically reconnect to them.

This is convenient.

Periodically reviewing remembered networks and removing ones you no longer need is good digital housekeeping.

There is little benefit in maintaining automatic relationships with networks you may never use again.

Bluetooth Is Another Radio Door

Bluetooth allows our phones to communicate with headphones, vehicles, watches, keyboards, medical devices, and countless other products.

Like any communications technology, Bluetooth should be kept updated and configured thoughtfully.

Do not approve unexpected pairing requests.

Remove old devices you no longer use.

And remember that every communications capability is another part of the system we are protecting.

What About Charging in Public?

Public charging stations sometimes raise security concerns because traditional USB connections can potentially carry both power and data.

Modern devices include protections and may require approval before allowing data access, but the simplest approach when you are uncertain is to control the connection yourself.

Using your own charger and a normal electrical outlet or a trusted battery pack avoids unnecessary dependence on an unknown USB data connection.

Again, we do not need paranoia.

We simply remove unnecessary risk when doing so is easy.

Be Careful What You Install as a “Security” Tool

Ironically, fear about security can itself become an attack technique.

A webpage may announce:

Your phone has 7 viruses!

It then conveniently offers a button to install the application that will supposedly fix everything.

Do not let an unexpected webpage diagnose your device and then sell you the cure.

If you believe there is a problem, leave the page and investigate through trusted system settings, the device manufacturer, or another trusted source.

Physical Security Is Cybersecurity

This is another important lesson.

We sometimes imagine cybersecurity as something happening far away on the internet.

But possession of a device can change the security problem dramatically.

An unlocked phone left on a table may expose information that would be extremely difficult for a remote attacker to obtain.

A stolen laptop can create similar concerns.

An unattended server can create even larger ones.

Physical access and digital security are closely connected.

A Practical Phone Security Checkup

Take ten minutes and look through your phone.

• Is the operating system current?
• Is the device protected by a strong passcode?
• How quickly does the phone automatically lock?
• What information appears on the lock screen?
• Which apps can access your location?
• Which apps can use the camera?
• Which apps can use the microphone?
• Are there applications you no longer use?
• Are there old Bluetooth devices you can remove?
• Are there old Wi-Fi networks you no longer need?
• Is lost-device protection enabled?
• Do you know how to access it if the phone disappears?
• Is important information backed up?
• Are your important accounts protected if someone obtains the physical phone?

We Are Building a Security Vocabulary

Notice how far we have already come in this series.

We now understand ideas such as:

• Authentication
• Encryption
• Hashing
• Multifactor authentication
• Passkeys
• Phishing
• Digital signatures
• Permissions
• Sandboxing
• Attack surface
• Least privilege
• Confidentiality
• Integrity
• Availability

These are not simply cybersecurity vocabulary words.

They are tools for thinking about security.

Once we understand the concepts, we begin recognizing them in completely different technologies.

The Computer You Carry Everywhere

Your phone may be the computer you use more than any other.

It travels with you.

It knows where you are.

It receives your private communications.

It may contain your credentials.

It may approve access to other accounts.

And it may hold years of information about your life.

That makes protecting it worth a few minutes of thought.

Keep it updated.

Lock it.

Review its permissions.

Understand its connections.

Know how to protect it if it disappears.

And remember:

It may be called a phone, but it is one of the most powerful computers you own.