- [Narrator] Applications are a core part
of the mobile device user experience.
Apps allow users to access critical business information,
send and receive email messages,
manage their calendars, access files,
and perform many other tasks
that many involve the use of sensitive information.
Therefore, security administrators must be certain
that they have strong security practices
around the use of mobile applications in the enterprise.
The first step to securing application use
is implementing application control policies
that restrict the types of applications
that may be used on mobile devices.
We discussed application control in detail
in the mobile device management video of this course.
Let's take a look at some of the other
important mobile application security issues
that you should know for the CISSP exam.
You'll want to examine how each of these issues
applies to each of the mobile apps
used in your business environment.
First, applications that allow access
to data or resources should require authentication.
The credential management practices
around these applications should be the same
as you'd use for access to any other sensitive resource.
If the application uses password authentication,
for example, you'll want to ensure
that the passwords it uses match the strength
of your organization's password security policy.
Whenever possible, you should rely upon
transitive trust relationships
for your application authentication.
If you can tie application authentication
back to your organization's central authentication services,
that's usually the best approach.
Users won't need to learn
a new password or other authentication technique,
and you'll retain central control
over application access.
If a users leaves the organization,
you can revoke their central authentication account
and they will automatically lose access to the apps.
If apps have their own authentication mechanisms,
security administrators will need to manually disable
that access as part of the account deprovisioning process.
Transitive trusts for authentication
also come with a drawback.
In many cases, applications rely upon
the authentication technologies
made available by other identity providers,
such as the applications you see that allow you
to log on with your Google, Twitter, or Facebook account.
Think carefully before allowing this type of trust
in your environment.
When you allow users to adopt
these authentication mechanisms,
you're placing control over access
to your organization's sensitive information
in the hands of a third party.
This is not necessarily a bad practice
but it is one that you should only adopt
after careful risk assessment.
Applications do store, process, and transmit
sensitive information and it's incumbent upon you
as a security professional to ensure
that this information is handled appropriately.
You should ensure that all sensitive information
is encrypted both in transit
between the application and other servers
and at rest when it is stored on the device.
Good encryption also requires
strong key management practices.
You should know what encryption keys
are used to protect your sensitive information,
where they are stored, and who has access to them.
The final issue you should consider
when evaluating mobile application security
is the use of geotagging.
Mobile devices now routinely incorporate
GPS technology to allow the device
to pinpoint its location on the planet
down to a matter of feet or inches.
Many applications take advantage of this information
to improve the services they provide to users.
For example, camera applications
often automatically geotag photos
with the GPS coordinates where the photo was taken.
This may introduce both security
and privacy concerns if the organization
does not want to expose this location information.
Modern mobile devices allow users
and administrators to specify exactly
the applications that may access location information
and the circumstances under which they may access it.
Be sure to understand these settings
and apply them appropriately.
Smartphone and tablet apps
offer users a powerful set of features
that improve their productivity.
Security administrators must be sure
to carefully evaluate each app
to ensure that its use of data
meets the organization's security policies.