If you're an organization that's deploying mobile devices you have a lot of responsibility.
And that's what this episode is about.
What I call mobile enforcement.
So I want to break this episode into two big pieces.
The first one are some of the evil actions that your users can do to your individual devices.
And the second part is some of the monitoring.
In fact a little bit kind of Big Brother type of monitoring that enterprises should at least consider
to cover themselves from potential liability depending on how their users use their phone.
So let's go and start off with some of the evil things that people can do.
First of all there's something called side loading.
Now normally when you're installing software you take advantage of whatever the name of the store is
for your platform.
For example with an android it's called the Google Play store.
And that's the only place you can install software.
So the reason we do that is because Google and then Apple work very hard to make sure that the software
that's installable is good.
It's not doing evil things it doesn't have malware.
It's not stealing your social security number whatever it might be side gloating is the process of getting
around that store.
Now on Apple's this is very difficult to do.
You have to set up a developer account and all this stuff on Androids.
It's actually pretty easy to do.
And you can actually go to certain Web sites and you can download a particular file downloaded onto
your Android device and double tap on it and you install it just like you would install a program on
a Windows desktop.
Now side loading can be a good thing or a bad thing.
A lot of people who are doing development work they're not ready to go to the store.
And so you do side loading to test things out and that type of thing.
But it can also be incredibly incredibly dangerous and it's something we want to try to prevent our
users from doing so.
The quick and easy answer is get an apple and it's going to be really really hard.
Also there are certain tools we can use within the Android world to monitor and to stop side loading
much safer is something called Carrier unlocking.
Traditionally these individual smartphones were distributed by a particular carrier here in the United
States they have names like AT&T Verizon and T-Mobile and basically they are locked to that particular
carrier by being locked it means you can only put if it's AT&T locked you can only put AT&T sims in
it.
If it's Verizon locked you can only put Verizon sims in it and in the United States you are actually
required by law to be given a way to unlock the phone if you want by unlocking the phone you can do
some pretty cool stuff.
For example you can take advantage of third party folks like Google fi anting who will provide you their
sims.
Now these guys will piggyback on major carriers and you can often get very very inexpensive rates can't
tell you many people have seen you're using AT&T or something like that and paying a 70 80 90 100 dollars
a month and all of a sudden now they're down to 35 simply by yanking out a sim and putting in another
one.
The security issues that you might run into this are pretty small.
The only real downside that I would be concerned is that if I issue a phone on an AT&T account I would
have the ability to track things and if I were in a scenario where suddenly a particular phone that
I issued had no data use had no voice use I might be wondering if they unlock that phone.
That phone far more nefarious is the concept of routing.
If it's an android or jailbreaking if it's an apple you've got to remember that when you are handed
a smartphone you don't have root access.
You don't have the administrator super user account that's actually held in control by the actual distributor
of the software itself.
And they do this for some really good reasons.
It's a lot harder to have people do bad things to their system to reformat the firmware to install malware
all kinds of things like that.
If you don't give them access to it.
However there are situations where a very technical person like me would like to get what's known as
root access.
When I get root access I can install very very powerful software that should not be in the hands of
normal people.
And I can do a lot of really interesting things.
For example one of the things I can do is called custom firmware.
So I want you to take a look at the screen right here.
So what we're looking at is this particular phone has been routed.
So every time I booted up it gives me a screen that looks like this that screen is just Google's way
of saying I really really don't like the fact that you have routed this phone.
So with my phone I also do things like install custom firmware.
So if you take a look at this screen in essence what you're looking at right here with the little robot
on his back that is the equivalent of going into the phone's bias and they just call it firmware here
what I'm doing is I'm getting rid of the firmware that came with the Android device and putting in a
custom firmware.
Now custom firmware sounds like a great idea.
It does have some big benefits for example with my phone.
There's a lot of companies that put out what we call crapware.
Lots of little applications that you can't uninstall and do things that you're uncomfortable with.
And because I have a level of sophistication I use these custom firmwares to get rid of that.
I also use these to take advantage.
There's all kinds of hardware inside my phone that is turned off by default and using custom firmware
allows me to turn them on.
You know every Android phone comes with an FM radio using a custom firmware I can turn that radio on.
Now these sound like a good idea but it also exposes you to a lot of issues.
For example once you've routed a phone and install custom firmware all those wonderful automatic updates
that you enjoy so much they stop working.
Also a lot of times you have trouble accessing the store.
Now for me it's worth it because I've got an extra phone that I do extra stuff with my primary phone
that I live on a day to day basis that if you called me this is what I'd pick up I've never routed that.
So as the person who is issuing the phone routing devices is a really really bad idea if somebody wants
to read a phone let them go get their own phone and go about routing it routing exposes you to all kinds
of malware to all kinds of dangerous programs.
And it's a risk that I'm not willing to take if I'm offering somebody else a phone.
So those are the issues that we can run into that individuals can do to our devices.
Now let's take a moment and let's talk about what I'm just going to call Big Brother.
Hi I'm evil Mike.
OK so evil Mike is an unfair thing to say.
If I'm issuing smart devices to people there are a lot of features on there that I should be actively
monitoring to look for misuse.
So what I want to do is just run through these really really quick so you understand why we need to
avoid them.
Do you mind if I get this.
How do I put a mustache on a mustache OK.
Real quick.
First of all is firmware over the air updates now firmware does get updated and that's usually going
to be dispersed by the actual people who run the operating system themselves.
Although in some enterprises if you're big enough you can control that.
The downside to firmware over the air updates is that it can cost outrageous sums of money.
So if you just want to double your data bill any one given month just make sure everybody has firmware
over their updates turned on so they can do it.
Make sure that that's turned off across the board and on all of these different smart operating systems.
That's a policy you can turn off from one control point.
Second is Camerer use.
Now this is a little bit maybe I should put the mustache back on.
I get nervous about monitoring my people's camera use.
I've discovered that usually the better thing to do is have a written policy saying we are monitoring
all of the things you're doing on your camera and you'll be surprised how much more careful people would
be.
However there is some serious litigation issues involved with mis use of cameras and don't go think
in naked pictures.
There's all kinds of other things that can go on that are far more nefarious taking pictures of competitors
products stealing barcodes there's all kinds of things and direct monitoring is really the only way
you can watch for stuff like this.
The next one I want to talk about is this and then basically texting.
The issue we run into these is number one what are people as a messaging and texting out between each
other.
But more importantly than that is really again just cost.
It's shocking how much people can overrun in terms of their bills just by texting.
It depends on what your billing system is.
But I have seen nightmare scenarios specially when people kick into roaming things where they're in
another geographical area and suddenly bills go absolutely sky high.
So be sure to watch for that next as external media.
Now what we're talking about external media we're talking about two different things here.
Number one have you actually plugged in a external storage device to your particular phone or more commonly.
What are we talking about an extra SD card that you can slide onto your phone to do whatever you might
want to do.
The downside to these is that if this phone is being used for company information there is no easy way
to prevent a user from copying that data from your phone onto the external media.
So if you've got proprietary information if you have confidential information you need to either get
phones that absolutely turn it off or at the very least have a good policy that people understand what
they can and can't do in terms of external media.
Now the next to it I'm going to kind of hit him at once.
Our recording microphone and GPS tag and the reason I'm putting these two things that sound disparate
together is because these are used for that scariest of situation.
When somebody loses a phone all operating systems have some kind of find my phone feature and that's
great.
But you can often take that a step further.
There are third party apps and tools out there that for example if you press a button three times in
quick succession it will turn on the microphone.
It will send out GPS tagging.
It will start pinging via text two or three or four different people until someone else can come in
and punch in a code.
If somebody is in a scary situation where they're uncomfortable those types of tools can be incredibly
important.
So it goes way beyond simply losing a phone and last payment methods payment methods are amazing.
I love taking advantage of my Google pay features.
I'm not an Apple person but I know Apple has one as well.
Even things like Pay-Pal provide all kinds of incredibly easy payment method tools where your credit
card or your bank account is connected to these things.
In many situations direct real time monitoring is absolutely required.
All of the tools that I use have real time tracking to them.
Now luckily I don't have a ton of employees but in my situation if anybody uses any of these devices
the moment they use it I instantly get a text showing the amount and the device and the source what
store they went to to be able to get something like that.
This is the first place that bad guys go to if they steal a phone is they're going to try to use some
of these payment methods.
Granted most payment methods take advantage of fingerprint tools and pass codes but it's never a guarantee
specially if somebody is under duress with a very very scary person.