October Cybersecurity Awareness Month

1
October Cybersecurity Awareness Month

• Purdue University proudly presents

PDAs Pretty Darn Accessible Without Security
Doug Couch Nathan Heck, IT Security Analysts
www.purdue.edu/securepurdue
2
Disclaimer

• Any security devices or software shown during
  this presentation is for demonstration purposes
  only. Purdue University does not endorse or
  support any PDA security device or software
  solutions at this time.

3
PDA Security Intro
4
PDA Security Intro

• BlackBerry Video

5
Threats to PDA Security - Understand the Risk

• Loss
• Biggest threat to PDAs
• In one Chicago cab company in 6 months
• 85,619 mobile phones
• 21,460 PDAs/Pocket PCs
• 4,425 laptops
• 80 of all passengers were reunited with phones
  and 96 with their Pocket PCs/PDAs and laptops
• In 2007 about eight million phones were lost
• Only about 72 were recovered

6
Threats to PDA Security - Understand the Risk
www.gizmag.com
7
Threats to PDA Security - Understand the Risk

• Theft
• Next biggest threat to PDAs
• Be aware that they are a target
• Know how to secure them
• Know what to do if they are stolen

8
Threats to PDA Security - Understand the Risk

• Unauthorized Access
• Your device can be under attack at any time
• Do
• Enable the built in security
• Double check your configuration
• Dont
• Use obvious PINs
• Write your PIN on your PDA

9
Threats to PDA Security - Understand the Risk

• Electronic Eavesdropping
• Network sniffing
• Spyware
• Wi-Fi hotspot impersonation
• Possibly even cellular network vulnerabilities

10
Threats to PDA Security - Understand the Risk

• Electronic Tracking
• Uses either GPS or cellular triangulation
• Is available for tracking family or employees
• Can be quickly enabled on unattended phones
• Some trackers are stealthy
• Tracking services may be vulnerable to compromise

11
Threats to PDA Security - Understand the Risk

• Electronic Tracking

12
Threats to PDA Security - Understand the Risk

• Spam
• Annoying (as always)
• Can be costly
• SMS spam may be charged per message
• Email spam may include images which take more
  bandwidth
• Can be used for Social Engineering
• Can be used to trick users into calling or
  texting a chargeable number
• Used for Phishing to trick users into giving up
  private info

13
Threats to PDA Security - Understand the Risk

• Malware
• Send mass SMS and MMS messages
• Dial premium-rate numbers without your knowledge
• Delete or steal your personal information
• Disable functions of the phone
• Use up the battery much faster than usual
• Send infected files to others (via email, Wi-Fi,
  Bluetooth etc.)
• Transfer malicious code to a PC during
  synchronization
• 30 of cell phone users in the U.S. receive
  e-mail attachments

14
What You Stand To Lose

• Your device
• Your personal data
• Your business data or trade secrets
• Money, due to an increased phone bill from
  unauthorized calls or data use
• Your reputation
• Possibly corporate data on servers

15
What You Can Do

• Be Proactive
• Configure user authentication and access controls
• Apply critical patches and upgrades
• Remove or disable unnecessary services or
  applications
• Install additional security software

16
What You Can Do

• Maintain the security of your PDA
• Maintain physical control of the device
• Reduce exposure of sensitive data
• Backup data frequently
• Use encryption
• Enabling wireless interfaces only when needed
• Enable and analyze device log files
• Test and apply critical patches in a timely
  manner
• Evaluate device security periodically

17
Physical SecurityDamage

• Plan ahead
• Use a PDA case
• Use a screen protector
• Use a surge protector when charging your PDA
• Avoid using your PDA near liquids (or in the
  rain)
• Use hands free options while driving
• Dont lend your PDA to someone
• Consider device insurance

18
Physical SecurityDamage
19
Physical SecurityTheft

• Treat a PDA like a credit card
• maintain control at all times and store it
  securely
• Be especially cautious while traveling
• Keep a low profile when using your PDA
• Record your PDAs Identifying numbers
• Engrave an ID number on it
• Remove your data card
• Dispose of properly

20
Physical SecurityShoulder Surfing
21
Physical SecurityShoulder Surfing
22
Physical SecurityLoss

• Enter your contact information in the owner
  fields
• Set a repeating alarm to go off on a regular
  interval
• Use a security sticker or label
• Third party recovery services
• IF YOUR PDA IS LOST, YOUR DATA MUST BE ASSUMED TO
  BE COMPROMISED!

23
Physical SecurityLoss
24
Security SoftwareBasics

• Enable your built-in security
• Configure to lock when inactive
• Change any default passwords
• Synchronize and backup data frequently
• Remove or disable unnecessary services and
  applications
• Don't store data on the SIM card
• Use removable storage cards to store data
  separately

25
Security SoftwareAdd-ons

• Password management databases
• Intrusion detection
• Anti-virus
• Anti-spam
• Personal firewall
• Device content and memory card encryption

26
Security SoftwareCool stuff

• Alternate authentication programs
• Remote locking/erasure
• Remote tracking
• GSM SIM lock
• Multimedia Card Security Standard

27
Security SoftwareSIM change notification
28
Security SoftwareIris Scanner
29
Secure CommunicationsWi-Fi

• Use only secured wireless networks
• Verify the SSID
• Use a VPN when possible
• Disable Wi-Fi ad-hoc mode
• Disable Wi-Fi when not in use

30
Secure CommunicationsBluetooth

• Disable the discover mode of your Bluetooth
• Always require a password to pair a device with
  your PDA
• Disable Bluetooth when not in use
• Keep a list of paired devices
• Configure Bluetooth for the lowest power setting

31
Secure CommunicationsOthers

• IR
• Disable or block if possible
• GPS
• Disable when not using, if possible
• USB

32
Secure CommunicationsSoftware

• VPN Clients
• Phone firewall
• SSH clients
• ActiveSync lock
• Email digital certificates

33
What To Do If Your Device Is Lost Or Stolen

• Make sure you have the following information
• Serial Number
• MAC Address (if Wi-Fi capable)
• IMEI for GSM
• If stolen, report it to the local law enforcement
• Call your cellular provider and report the loss
• At Purdue, report the loss to abuse_at_purdue.edu
  and provide the MAC address
• Add your PDA's information to the "Stolen
  Computer Registry" - www.stolencomputers.org
• Disable, lock, track, or erase it remotely
• Change your passwords

34
Outlook
35
October Cybersecurity Awareness Month