Cybersecurity of mobile devices: My top 12 recommendations

It was a major decision to switch from Blackberry to iPhone in 2010. I was already using a MacBook Pro, and was familiar with the Apple ecosystem, but somehow the phone switch was difficult. Since then, I’ve never looked back. iPhones were the first in many mobile advances. Apple hypes the security of its ecosystem, including iOS devices. However, the reality is not as rosy as its commonly thought. It’s true that Android devices are more susceptible to hacks, but iPhones are not far off. A recent report from Amnesty International highlights the real problem with iOS vulnerabilities.1 In collaboration with various media organizations and the University of Toronto’s Citizen Lab, they published a damning report on a particular spyware product, Pegasus, by an Israeli company NSO Group. It has been used to penetrate mobile devices of world leaders, journalists, and activists. French president Emmanuel Macron had his phone affected by Pegasus. So were several other presidents, prime ministers, and a king! The report underlined that iOS devices are far from being robustly protected from malware as most of us think. READ: My top 10 cybersecurity tips Android devices are not shining in this realm either. Security news about vulnerabilities affecting them appear almost daily.2 Combined, Apple iOS and Google Android devices account for 98% of the mobile market share. Therefore, the risk posed to these devices can have massive implications for anyone, including physicians. Obviously, most physicians are not important enough to any major criminal group or foreign government to be targeted with Pegasus or other spyware. However, what we miss to see is that any assets or information can be up for grabs. If you have anything online or on your mobile device that you’d like protected, then I’m sure there’s someone out there who would like to gain malicious access to it. Most people would pay dearly to get their data back. It could be your old family photos and videos, important financial information, or access to EMR records. The risk of malicious access to any of these is the reality of living in the digital age. In this environment, I approach mobile device security using the same principles as cybersecurity in general, using zero trust and layered security models. Zero trust model assumes that no one should have easy non-credentialed access to any information or asset at all times. Every access needs to be authenticated. Only those with absolute need require access to data. Access needs to be restricted to only specific files. Once need for such access has passed, it should be terminated. A lot of recent ransomware attacks have happened using old, unused, but functional accounts, including ones for long-gone interns and former employees. If, for example, you need to share a research file with your clinical group using a secure cloud-based service, I recommend that you share only that file, only with people who need to access it, and remember to terminate sharing when the need is gone. Make sure your colleagues login to access the file, as opposed to a direct link access. Ask your colleagues to make sure they’ve implemented stringent login protocols for their respective accounts, such as complex passwords and multifactor authentication. Do not share a folder with them when all they need to see is a single file. Layered security model implies that no single technique or modality provides 100% security. Having a secure browser, but a bad router won’t provide 100% security. Turning on incognito mode without a VPN and believing that your data is encrypted is simply not true. It’s a combination of multiple approaches that it going to tighten your information security. The more layers of security, the harder they will be to penetrate. Below is a list of my top 12 recommendations for tightening mobile device security. Update your device OS as soon as you receive a prompt. iPhone recently updated iOS to 14.7. It fixed a major “no click” wi-fi vulnerability, where your phone could be infected with malware just passing next to a malicious wi-fi access point. Scary stuff! Not even a week passed, when Apple updated iOS again to 14.7.1. It provided a fix to another critical security vulnerability, which was being actively exploited. Have a complex password on your mobile device. It encrypts your device. It prevents someone random from grabbing your phone and seeing your data when you’ve temporarily put the phone down. Even law enforcement can have difficulty accessing a locked device, though there are ways around it. Purchase iVerify app. It costs only $3.99. It will guide you through a multitude of security and privacy options. It includes guidance on theft protection, limiting software exploits, review for compromise, protection of wireless data and your communications, as well as prevention of ad data leakage. Consider rebooting your device weekly. It prevents attackers from maintaining control of your device. It may also help speed up your device by clearing its memory. Turn off Caller ID if you are calling patients from your mobile device. Patients do not need to have your private cell phone number. They can call your office if need be. Use a dedicated password management software on your mobile device and elsewhere. Most recommendations currently are leaning toward dedicated password managers as opposed to those that come preinstalled on a phone or with browsers. Change notification previews on your mobile device to show them only when the phone is unlocked. Otherwise, all your messages can be seen on a locked device by anyone nearby. Consider a VPN service for your phone. Most VPN providers offer mobile friendly options. You phone is just another computer, so if you have a VPN on your computer, there is no reason to not have one on your mobile device. VPN encrypts your data, such that your hospital or a coffee shop or telecom provider can’t read it. Use Signal for mobile communications. WhatsUp, Telegram, iMessage, Facebook messenger are very poor alternatives. Signal is end-to-end encrypted with no meta-data being shared with others. Before sharing photos online or emailing acquaintances, consider removing the meta-data using iVerify. Use the option “Share without Metadata” before sending the photo. Otherwise, the precise time, location, device, and its photo settings can all be seen by others. Mobile apps are useful but can be dangerous. Delete the apps you don’t use. Your phone is not a graveyard of apps from years ago. Many apps “use” your data without you knowing. Delete those you don’t need. Use only original app stores. Never load apps from shady app stores, especially for Android devices. Before downloading a new app, carefully read the privacy report about it below the app description. If the app collects random information about you that it really does not need, consider not downloading it. Dr. Artur Gevorgyan is a otolaryngologist-head and neck surgeon practicing in Oshawa, Ont. References: Massive data leak reveals Israeli NSO Group's spyware used to target activists, journalists, and political leaders globally. Accessed on July 31, 2021. Android apps with millions of downloads are vulnerable to serious attack Accessed on July 31, 2021

Cybersecurity of mobile devices: My top 12 recommendations

Register for free access or login.

Related Topics