Security · Topic 10 of 13
Securing Mobile Devices
Secure phones and tablets with screen locks, biometrics, remote wipe, encryption, updates, authenticator apps, MDM and BYOD policies at work.
- 4 min
- A swipe screen lock provides no real security.
- Biometrics and a strong PIN are common screen locks.
- Restrict failed login attempts, and wipe after too many failures if policy requires it.
What it is
Phones and tablets hold email, contacts, photos, credentials and company data, and they are easy to lose. Securing them combines device settings, apps and company policy. The exam asks which method fits a scenario, such as a lost phone or a user who wants work email on a personal device.
How it works
Screen locks
| Method | Notes |
|---|---|
| Personal identification number (PIN) or passcode | Strong when long enough. A short PIN is easy to guess |
| Pattern | Easy to use but patterns can be seen as smudges or watched |
| Fingerprint | Fast and convenient |
| Facial recognition | Convenient, quality varies between devices |
| Swipe | No security. Only unlocks the screen |
Settings can also erase the device after a set number of failed attempts and add a delay between attempts. This is a restriction on failed login attempts.
Remote actions
A locator application uses GPS (Global Positioning System) and network data to find a lost device on a map. A remote lock secures it while you search.
A remote wipe erases the data when the device is not recoverable. This works only if the device can reach the network, so set it up before the device is lost.
Encryption and updates
Modern phones encrypt storage by default when a screen lock is set, so the strength of the lock matters. Keep the mobile operating system (OS) and apps updated, because updates fix security flaws. A device that no longer gets updates is a growing risk.
Backups
Remote backup applications save contacts, photos and settings to the cloud or a computer. This lets the user restore data to a new device after a loss or a wipe.
Authenticator apps and antimalware
An authenticator app makes one time codes for multifactor authentication. Antivirus and antimalware apps scan apps and files, and they are more common on Android than iOS because of how the platforms handle apps. A mobile firewall app can monitor and block unwanted connections.
Safe app and connection habits
- Install apps from the official store only, and review the permissions an app asks for.
- Avoid jailbreaking an iPhone or rooting an Android phone, which removes built in protections.
- Turn off Bluetooth and Wi-Fi when not needed, and avoid unknown networks.
- Use a virtual private network (VPN) on public Wi-Fi.
Mobile device management (MDM)
MDM lets information technology (IT) enforce policy from a central console. It can require a passcode, force encryption, push apps, block risky settings, locate a device and wipe it. A related approach manages only a work profile or container, so company data can be removed without touching personal files.
Content filtering blocks risky or inappropriate sites and categories on a phone. It is applied through MDM, a Domain Name System (DNS) filter or a filtering app.
Policies for company and personal devices
| Model | Meaning |
|---|---|
| Corporate owned | The company owns and controls the device |
| BYOD (bring your own device) | The user owns the device and installs a work profile |
A BYOD policy sets what the company may see and wipe, which apps are allowed and what security the device must meet. Profile security requirements describe the minimum settings, such as a passcode and encryption, before the device can connect to company resources.
If a scenario says an employee lost a phone with company email, the answer is remote wipe through MDM. If it says the employee wants work email on a personal phone, think BYOD policy and MDM enrollment.
What to remember for the exam
- A swipe screen lock provides no real security.
- Biometrics and a strong PIN are common screen locks.
- Restrict failed login attempts, and wipe after too many failures if policy requires it.
- Locator apps find a lost device, and remote wipe erases it.
- Remote backup protects data against loss.
- Keep the OS and apps updated.
- Authenticator apps provide multifactor authentication (MFA) codes.
- MDM enforces policy, installs apps and can wipe a device.
- BYOD needs a policy and often a managed work profile.
- Do not jailbreak or root a device.
Common mistakes
Relying on a short PIN. A weak lock undermines encryption.
Setting up remote wipe after the loss. The service has to be enabled in advance.
Installing apps from unofficial sources. This is a common way for mobile malware to arrive.
Treating BYOD like a company device. The company has limited rights over personal data, so the policy must say what is managed.
Check yourself
Which feature erases a lost phone's data from a distance?
Remote wipe.
Which screen lock offers no security?
Swipe.
What does BYOD mean?
Bring your own device, where a user uses a personal device for work under a policy.
Topic 10 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.