Wireless Security

Derived From: NIST Guidelines on Cell Phone and PDA Security, Special Pub. 800-124 Oct. 2008

Cell phones and Personal Digital Assistants (PDAs) have become indispensable tools for today's highly mobile workforce. Small and relatively inexpensive, these devices can be used not only for voice calls, simple text messages, and Personal Information Management (PIM) (e.g., phonebook, calendar, and notepad), but also for many functions done at a desktop computer. The latter includes sending and receiving electronic mail, browsing the Web, storing and modifying documents, delivering presentations, and remotely accessing data. Mobile handheld devices may also have specialized built-in hardware, such as a camera, a Global Positioning System (GPS) receiver, and reduced-size removable-media card slots, and employ a range of wireless interfaces, including infrared, Wireless Fidelity (Wi-Fi), Bluetooth, and one or more types of cellular interfaces.

While these devices provide productivity benefits, they also pose new risks to an organization, including the following.

• Because of their small size and use outside the office, handheld devices can be easier to misplace or to have stolen than a laptop or notebook computer. If they do fall into the wrong hands, gaining access to the information they store or are able to access remotely can be relatively easy.
• Communications networks, desktop synchronization, and tainted storage media can be used to deliver malware to handheld devices. Malware is often disguised as a game, device patch, utility, or other useful third-party application available for download. Once installed, malware can initiate a wide range of attacks and spread itself onto other devices.
• Similar to desktop computers, cell phones and PDAs are subject to spam, but this can include text messages and voice mail, in addition to electronic mail. Besides the inconvenience of deleting spam, charges may apply for inbound activity. Spam can also be used for phishing attempts.
• Electronic eavesdropping on phone calls, messages, and other wirelessly transmitted information is possible through various techniques. Installing spy software on a device to collect and forward data elsewhere, including conversations captured via a built-in microphone, is perhaps the most direct means, but other components of a communications network, including the airwaves, are possible avenues for exploitation.
• Location tracking services allow the whereabouts of registered cell phones to be known and monitored. While it can be done openly for legitimate purposes, it may also take place surreptitiously.
• It is possible to create a clone of certain phones that can masquerade as the original. Once popular with analog phones, it is not as prevalent today with the rise of digital networks, but some early generation digital equipment has been shown to be vulnerable.
• Server-resident content, such as electronic mail maintained for a user by a network carrier as a convenience, may expose sensitive information through vulnerabilities that exist at the server.

To date, incidents from malware and other identified dangers that have occurred against handheld devices have been limited when compared with those against desktop and networked computers. One factor is that no single operating system dominates handheld devices to the same extent, fragmenting the number of potential homogeneous targets. Cellular network carriers have also favored a closed system approach in which they exerted control over devices and applications, as well as their networks. Nevertheless, an increasing amount of mobile malware has been reported over the past several years, which raises concerns for the future, particularly when coupled with the recent trend towards establishing a more open system environment for cellular handheld devices. Such an open environment would not only facilitate application development and allow flexibility in choosing devices and applications from other sources, but it would also expedite malware development and potentially provide more attractive avenues of attack to exploit.

See also Can Spam Act: Wireless Spam

Derived From: Security Tip (ST06-007), Defending Cell Phones and PDAs Against Attack, US CERT Aug. 9, 2006

What can you do to protect yourself?

• Follow general guidelines for protecting portable devices - Take precautions to secure your cell phone and PDA the same way you should secure your computer (see Cybersecurity for Electronic Devices and Protecting Portable Devices: Data Security for more information).
• Be careful about posting your cell phone number and email address - Attackers often use software that browses web sites for email addresses. These addresses then become targets for attacks and spam (see Reducing Spam for more information). Cell phone numbers can be collected automatically, too. By limiting the number of people who have access to your information, you limit your risk of becoming a victim.
• Do not follow links sent in email or text messages - Be suspicious of URLs sent in unsolicited email or text messages. While the links may appear to be legitimate, they may actually direct you to a malicious web site.
• Be wary of downloadable software - There are many sites that offer games and other software you can download onto your cell phone or PDA. This software could include malicious code. Avoid downloading files from sites that you do not trust. If you are getting the files from a supposedly secure site, look for a web site certificate (see Understanding Web Site Certificates for more information). If you do download a file from a web site, consider saving it to your computer and manually scanning it for viruses before opening it.
• Evaluate your security settings - Make sure that you take advantage of the security features offered on your device. Attackers may take advantage of Bluetooth connections to access or download information on your device. Disable Bluetooth when you are not using it to avoid unauthorized access (see Understanding Bluetooth Technology for more information).
• Cell Phone Security, Consumer Reports
• Mobile Device Security, WMATA
• NIST Guidelines on Cell Phone and PDA Security, Special Pub. 800-124 Oct. 2008
• NIST Updates Guidelines for Mobile Device Security From NIST Tech Beat: July 11, 2012
• DRAFT Guidelines for Managing and Securing Mobile Devices in the Enterprise draft_sp800-124-rev1.pdf
• FCC Smartphone Security Checker
• US CERT
• Security Tip (ST06-007), Defending Cell Phones and PDAs Against Attack, US CERT Aug. 9, 2006
• Security Tip (ST05-017) Cybersecurity for Electronic Devices Last revised: February 06, 2013
• Security Tip (ST04-020) Protecting Portable Devices: Data Security Original release date: January 27, 2010 | Last revised: February 06, 2013
• “Technical Information Paper: Cyber Threats to Mobile Devices”
• Security Tip (ST04-017) “Protecting Portable Devices: Physical Security”
• DOD
• Improvements Needed with Tracking and Configuring Army Commercial Mobile Devices, Inspector General, US Department of Defense, March 26, 2013
• Army, DOD IG disagree over mobile device management, FCW April 5, 2013
• “Use of Commercial Mobile Devices in the Department of Defense ,” April 6, 2011
• “U.S. Army Guidance on Piloting Commercial Mobile Devices,” November 3, 2011
• DoD Directive 8500.01E, “Information Assurance,” April 23, 2007
• DoD CIO Memorandum, “Use of Commercial Mobile Devices in the Department of Defense,” April 06, 2011
• DOD Commercial Mobile Device Interim Policy, DoD Jan. 17, 2012
• Mobile Commuting Devices, April 3, 2013
• DON Security Guidance for Personal Electronic Devices DTG 202041Z AUG 07 - Publish Date: 08/20/07

Other Activities

REORGANIZATION OF THE PUBLIC SAFETY AND HOMELAND SECURITY BUREAU.   To promote a more effective organizational structure and to enhance the agency's capabilities to address critical communications issues for the nation's first responders. Action by:  the Commission. Adopted:  02/07/2011 by ORDER. (FCC No. 11-18).  OMD TXT: To promote a more effective organizational structure and to enhance the agency's capabilities to address critical communications issues for the nation's first responders, the Commission has concluded that the proper dispatch of its business and the public interest will be served by reorganizing the Public Safety and Homeland Security Bureau (Bureau or PSHSB). This reorganization will convert the Emergency Response and Interoperability Center (ERIC) into a division-level office within the Bureau and will rename the Bureau's current Policy Division, Communications Systems Analysis Division, and Public Communications Outreach and Operations Division to, respectively, the Policy and Licensing Division, the Cybersecurity and Communications Reliability Division, and the Operations and Emergency Management Division.

News

• FCC TO HOLD WORKSHOP ON CYBERSECURITY ROADMAP, FCC 10/21/2010
• FTC Files Comments on FCC's Proposed Cyber Security Certification Program, FTC 10/12/2010
• USTelecom Comments on FCC Cybersecurity Roadmap, USTelecom 9/24/2010

© Cybertelecom ::