Information Security: Better Implementation of Controls for Mobile Devices Should Be Encouraged
Released: 2012-09-18T00:00:00

Letter

Background

Consumer adoption of mobile devices is growing rapidly, enabled by affordable prices, increasingly reliable connections, and faster transmission speeds. According to a recent analysis, mobile devices are the fastest growing consumer technology, with worldwide sales increasing from 300 million in 2010 to an estimated 650 million in 2012. Advances in computing technology have resulted in increased speed and storage capacity for mobile devices. The advances have enhanced consumers’ abilities to perform a wide range of online tasks. While these devices provide many productivity benefits to consumers and organizations, they also pose security risks if not properly protected.

A Variety of Entities Provide Products and Services to Consumers

Several different types of private sector entities provide products and services that are used by consumers as part of a seamless mobile telecommunications system. These entities include mobile device manufacturers, operating system developers, application developers, and wireless carriers.

WiFi and Bluetooth are commonly used technologies that allow an electronic device to exchange data wirelessly (using radio waves) with other devices and computer networks. recent report,January 2012.

Google Inc. led the development of Android, an operating system for mobile devices, based on the Linux operating system. Android, like Linux, is an “open” operating system, meaning that its software code is publicly available and can be tailored to the needs of individual devices and telecommunications carriers. Thus, many different tailored versions of the software are in use. To run on Android devices, software applications need to be digitally signed by the developer, who is responsible for the application’s behavior. Android applications are made available on third-party application marketplaces, websites, and on the online official Android application store called Google Play.

Research In Motion, Corp. Research In Motion developed a proprietary operating system for its BlackBerry mobile devices. Although a proprietary system, it can run any third-party applications that are written in Java.

Applications are tested by Research In Motion before users can download them. In addition, any application given access to sensitive data or features when installed is required by Research In Motion to be digitally signed by the developer. BlackBerry applications are available for download on the online store called BlackBerry App World.

Mobile application developers develop the software applications that consumers interact with directly. In many cases, these applications provide the same services that are available through traditional websites, such as news and information services, online banking, shopping, and electronic games. Other applications are designed to take into account a user’s physical location to provide tailored information or services, such as information about nearby shops, restaurants, or other elements of the physical environment.

Wireless carriers manage telecommunications networks and provide phone services, including mobile devices, directly to consumers. While carriers do not design or manufacture their own mobile devices, in some cases they can influence the design and the features of other manufacturers’ products because they control sales and interactions with large numbers of consumers. Major wireless carriers with the largest total market shares in the United States include Verizon Wireless, AT&T Inc., Sprint, and T-Mobile USA Inc.

Carriers provide basic telephone service through wireless cellular networks which cover large distances. However, other types of shorter- range wireless networks may also be used with mobile devices. These shorter-range networks may be supported by the same carriers or by different providers. Major types of wireless networks include cellular networks, WiFi networks, and wireless personal area networks.

Cellular networks. Cellular networks are managed by carriers and provide coverage based on dividing a large geographical service area into smaller areas of coverage called “cells.” The cellular network is a radio network distributed over the cells and each cell has a base station equipped with an antenna to receive and transmit radio signals to mobile phones within its coverage area. A mobile device’s communications are generally associated with the base station of the cell in which it is located. Each base station is linked to a mobile telephone switching office, which is also connected to the local wireline telephone network. The mobile phone switching office directs calls to the desired locations, whether to another mobile phone or a traditional wireline telephone. This office is responsible for switching calls from one cell to another in a smooth and seamless manner as consumers change locations during a call. Figure 1 depicts the key components of this cellular network.

WiFi networks. WiFi networking nodes may be established by businesses or consumers to provide networking service within a limited geographic area, such as within a home, office, or place of business. They are generally composed of two basic elements: access points and wireless-enabled devices, such as smart phones and tablet computers. These devices use radio transmitters and receivers to communicate with each other. Access points are physically wired to a conventional network and provide a means for wireless devices to connect to them. WiFi networks conform to the Institute of Electrical and Electronics Engineers 802.11 standards.

Other wireless personal area networks. Other wireless personal area networks may be used that do not conform to the WiFi standard. For example, the Bluetooth standard is often used to establish connectivity with nearby components, such as headsets or computer keyboards.

Federal Agencies Have Roles in Addressing Mobile Security

While federal agencies are not responsible for ensuring the security of individual mobile devices, several are involved in activities designed to address and promote cybersecurity and mobile security in general.

The Department of Commerce (Commerce) is responsible under in coordination with Homeland Security Presidential Directive 7other federal and nonfederal entities, for improving technology for cyber systems and promoting efforts to protect critical infrastructure. Within Commerce, the National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum requirements for unclassified federal information systems, as part of its statutory responsibilities under the Federal Information Security Management Act (FISMA). For example, NIST has developed guidelines on cellphone and Bluetooth security. These standards and guidelines are generally made available to the public and can be used by both the public and private sectors. NIST also serves as the lead federal agency for coordinating the National Initiative for Cybersecurity Education (NICE) with other agencies. According to NIST, NICE seeks to establish an operational, sustainable, and continually improving cybersecurity education program for the nation. NICE includes an awareness initiative, which is led by the Department of Homeland Security (DHS), which focuses on boosting national cybersecurity awareness through public service campaigns to promote cybersecurity and responsible use of the Internet, and making cybersecurity a popular educational and career pursuit for older students. As we previously reported, NIST developed a draft strategic plan for the NICE initiative. This plan includes strategic goals, supporting objectives, and related activities for the awareness component. Specifically, the draft strategic plan calls for (1) improving citizens’ knowledge to allow them to make smart choices as they manage online risk, (2) improving knowledge of cybersecurity within organizations so that resources are well applied to meet the most obvious and serious threats, and (3) enabling access to cybersecurity resources. The plan also identifies supporting activities and products designed to support the overarching goal, such as the “Stop. Think. Connect.” awareness campaign.

According to Commerce’s National Telecommunications and Information Administration (NTIA), it serves as the President’s principal adviser on telecommunications policies pertaining to economic and technological advancement and to the regulation of the telecommunications industry, including mobile telecommunications. NTIA is responsible for coordinating telecommunications activities of the executive branch and assisting in the formulation of policies and standards for those activities, including considerations of interoperability, privacy, security, spectrum use, and emergency readiness.

Federal law and policy tasks DHS with critical infrastructure protection responsibilities that include creating a safe, secure, and resilient cyber environment in conjunction with other federal agencies, other levels of government, international organizations, and industry. The National Strategy to Secure Cyberspace tasked DHS as the lead agency in promoting a comprehensive national awareness program to empower Americans to secure their own parts of cyberspace. Consistent with that tasking, DHS is currently leading the awareness component of NICE.

The Federal Communications Commission’s (FCC) role in mobile security stems from its broad authority to regulate interstate and international communications, including for the purpose of “promoting In addition, FCC has established the safety of life and property.” Communications, Security, Reliability, and Interoperability Council (CSRIC). CSRIC is a federal advisory committee whose mission is to provide recommendations to FCC to help ensure, among other things, secure and reliable communications systems, including telecommunications, media, and public safety. A previous CSRICincluded a working group that was focused on identifying cybersecurity best practices (including mobile security practices), and had representation from segments of the communications industry and public safety communities. The current CSRIC has focused on the development and implementation of best practices related to several specific cybersecurity topics. FCC has also established a Technological Advisory Council, which includes various working groups, one of which has been working since March 2012 to identify, prioritize, and analyze mobile security and privacy issues.

The Federal Trade Commission (FTC) promotes competition and protects the public by, among other things, bringing enforcement actions against entities that engage in unfair or deceptive acts or practices. An unfair act is an act or practice that causes or is likely to cause substantial injury to consumers that is not reasonably avoidable by consumers and is not outweighed by countervailing benefits to consumers or to competition. A deceptive act or practice occurs if there is a representation, omission, or practice that is likely to mislead the consumer acting reasonably in the circumstances, to the consumer’s detriment. According to FTC, its authority to bring enforcement actions covers many of the entities that provide mobile products and services to consumers, including mobile device manufacturers, operating system developers, and application developers. FTC’s jurisdiction also extends to wireless carriers when they are not engaged in common carrier activities. For example, mobile phone operators engaging in mobile payments functions such as direct-to-carrier billing are under FTC’s jurisdiction.

The Department of Defense (DOD) is responsible for security systems, including mobile devices that use its networks or contain DOD data. While it has no responsibility with regards to consumer mobile devices, its guidance can be useful for consumers. For example, the DOD Security Technical Implementation Guides are available to the public. These guides contain technical guidance to secure information systems or software that might otherwise be vulnerable to a malicious computer attack. In addition, certain guides address aspects of mobile device security.

The Office of Management and Budget (OMB) is responsible for overseeing and providing guidance to federal agencies on the use of information technology, which can include mobile devices. One OMB memorandum to federal agencies, for example, instructs agencies to properly safeguard information stored on federal systems (including mobile devices) by requiring the use of encryption and a “time-out” function for re-authentication after 30 minutes of inactivity.

Mobile Devices Face a Broad Range of Security Threats and Vulnerabilities

Threats to the security of mobile devices and the information they store and process have been increasing significantly. Many of these threats are similar to those that have long plagued traditional computing devices connected to the Internet. For example, cyber criminals and hackers have a variety of attack methods readily available to them, including using software tools to intercept data as they are transmitted to and from a mobile device, inserting malicious software code into the operating systems of mobile devices by including it in seemingly harmless software applications, and using e-mail phishing techniques to gain access to mobile-device users’ sensitive information. The significance of these threats, which are growing in number and kind, is magnified by the vulnerabilities associated with mobile devices. Common vulnerabilities in mobile devices include a failure to enable password protection, the lack of the capability to intercept malware, and operating systems that are not kept up to date with the latest security patches.

Attacks on Mobile Devices Are Increasing

Cyber-based attacks against mobile devices are evolving and increasing. Examples of recent incidents include: In May 2012, a regulatory agency in the United Kingdom fined a company for distributing malware versions of popular gaming applications that triggered mobile devices to send costly text messages to a premium-rate telephone number.

In February 2012, a cybersecurity firm, Symantec Corporation, reported that a large number of Android devices in China were infected with malware that connected them to a botnet.operator was able to remotely control the devices and incur charges on user accounts for premium services such as sending text messages to premium numbers, contacting premium telephony services, and connecting to pay-per-view video services. The number of infected devices able to generate revenue on any given day ranged from 10,000 to 30,000, enough to potentially net the botnet’s operator millions of dollars annually if infection rates were sustained.

In January 2012, an antivirus company reported that hackers had subverted the search results for certain popular mobile applications so that they would redirect users to a web page where they were encouraged to download a fake antivirus program containing malware.

In October 2011, FTC reached a settlement of an unfair practice case with a company after alleging that its mobile application was likely to cause consumers to unwittingly disclose personal files, such as pictures and videos, stored on their smartphones and tablet computers. The company had configured the application’s default settings so that upon installation and set-up it would publicly share users’ photos, videos, documents, and other files stored on those devices.

Symantec Corporation, Internet Security Threat Report, 2011 Trends Vol.17 (Mountain View, Calif.: April 2012). an estimated half million to one million people had malware on their Android devices in the first half of 2011; and

3 out of 10 Android owners are likely to encounter a threat on their device each year as of 2011.

According to a networking technology company, Juniper Networks, malware aimed at mobile devices is increasing. For example, the number of variants of malicious software, known as “malware,” aimed at mobile devices has reportedly risen from about 14,000 to 40,000, a 185 percent increase in less than a year. Figure 2 shows the increase in malware variants between July 2011 and May 2012.

The increasing prevalence of attacks against mobile devices makes it important to assess and understand the nature of the threats they face and the vulnerabilities these attacks exploit.

Sources of Threats and Attack Methods Vary

Mobile devices face a range of cybersecurity threats. These threats can be unintentional or intentional. Unintentional threats can be caused by software upgrades or defective equipment that inadvertently disrupt systems. Intentional threats include both targeted and untargeted attacks from a variety of sources, including botnet operators, cyber criminals, hackers, foreign nations engaged in espionage, and terrorists. These threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary gain or political advantage, among others. For example, cyber criminals are using various attack methods to access sensitive information stored and transmitted by mobile devices.

Table 1 summarizes those groups or individuals that are key sources of threats for mobile devices.

These threat sources may use a variety of techniques, or exploits, to gain control of mobile devices or to access sensitive information on them. Common mobile attacks are presented in table 2.

Attacks against mobile devices generally occur through four different channels of activities:

Software downloads. Malicious applications may be disguised as a game, device patch, or utility, which is available for download by unsuspecting users and provides the means for unauthorized users to gain unauthorized use of mobile devices and access to private information or system resources on mobile devices.

Visiting a malicious website. Malicious websites may automatically download malware to a mobile device when a user visits. In some cases, the user must take action (such as clicking on a hyperlink) to download the application, while in other cases the application may download automatically.

Direct attack through the communication network. Rather than targeting the mobile device itself, some attacks try to intercept communications to and from the device in order to gain unauthorized use of mobile devices and access to sensitive information.

Physical attacks. Unauthorized individuals may gain possession of lost or stolen devices and have unauthorized use of mobile devices and access sensitive information stored on the device.

A Range of Vulnerabilities Facilitate Attacks

Mobile devices are subject to numerous security vulnerabilities, including a failure to enable password protection, the inability to intercept malware, and operating systems that are not kept up to date with the latest security patches. While not a comprehensive list of all possible vulnerabilities, the following 10 vulnerabilities can be found on all mobile platforms.

Mobile devices often do not have passwords enabled. Mobile devices often lack passwords to authenticate users and control access to data stored on the devices. Many devices have the technical capability to support passwords, personal identification numbers (PIN), or pattern screen locks for authentication. Some mobile devices also include a biometric reader to scan a fingerprint for authentication. However, anecdotal information indicates that consumers seldom employ these mechanisms. Additionally, if users do use a password or PIN they often choose passwords or PINs that can be easily determined or bypassed, such as 1234 or 0000. Without passwords or PINs to lock the device, there is increased risk that stolen or lost phones’ information could be accessed by unauthorized users who could view sensitive information and misuse mobile devices.

Two-factor authentication is not always used when conducting sensitive transactions on mobile devices. According to studies, consumers generally use static passwords instead of two-factor authentication when conducting online sensitive transactions while using mobile devices. Using static passwords for authentication has security drawbacks: passwords can be guessed, forgotten, written down and stolen, or eavesdropped. Two-factor authentication generally provides a higher level of security than traditional passwords and PINs, and this higher level may be important for sensitive transactions. Two-factor refers to an authentication system in which users are required to authenticate using at least two different “factors”—something you know, something you have, or something you are—before being granted access. Mobile devices themselves can be used as a second factor in some two-factor authentication schemes. The mobile device can generate pass codes, or the codes can be sent via a text message to the phone. Without two-factor authentication, increased risk exists that unauthorized users could gain access to sensitive information and misuse mobile devices.

Wireless transmissions are not always encrypted. Information such as e-mails sent by a mobile device is usually not encrypted while in transit. In addition, many applications do not encrypt the data they transmit and receive over the network, making it easy for the data to be intercepted. For example, if an application is transmitting data over an unencrypted WiFi network using hypertext transfer protocol (http) (rather than secure http), the data can be easily intercepted. When a wireless transmission is not encrypted, data can be easily intercepted by eavesdroppers, who may gain unauthorized access to sensitive information.

Mobile devices may contain malware. Consumers may download applications that contain malware. Consumers download malware unknowingly because it can be disguised as a game, security patch, utility, or other useful application. It is difficult for users to tell the difference between a legitimate application and one containing malware. For example, figure 3 shows how an application could be repackaged with malware and a consumer could inadvertently download it onto a mobile device.

Mobile devices often do not use security software. Many mobile devices do not come preinstalled with security software to protect against malicious applications, spyware, and malware-based attacks. Further, users do not always install security software, in part because mobile devices often do not come preloaded with such software. While such software may slow operations and affect battery life on some mobile devices, without it, the risk may be increased that an attacker could successfully distribute malware such as viruses, Trojans, spyware, and spam, to lure users into revealing passwords or other confidential information.

Operating systems may be out-of-date. Security patches or fixes for mobile devices’ operating systems are not always installed on mobile devices in a timely manner. It can take weeks to months before security updates are provided to consumers’ devices. Depending on the nature of the vulnerability, the patching process may be complex and involve many parties. For example, Google develops updates to fix security vulnerabilities in the Android OS, but it is up to device manufacturers to produce a device-specific update incorporating the vulnerability fix, which can take time if there are proprietary modifications to the device’s software. Once a manufacturer produces an update, it is up to each carrier to test it and transmit the updates to consumers’ devices. However, carriers can be delayed in providing the updates because they need time to test whether they interfere with other aspects of the device or the software installed on it.

In addition, mobile devices that are older than 2 years may not receive security updates because manufacturers may no longer support these devices. Many manufacturers stop supporting smartphones as soon as 12 to 18 months after their release. Such devices may face increased risk if manufacturers do not develop patches for newly discovered vulnerabilities.

Software on mobile devices may be out-of-date. Security patches for third-party applications are not always developed and released in a timely manner. In addition, mobile third-party applications, including web browsers, do not always notify consumers when updates are available. Unlike traditional web browsers, mobile browsers rarely get updates. Using outdated software increases the risk that an attacker may exploit vulnerabilities associated with these devices.

Mobile devices often do not limit Internet connections. Many mobile devices do not have firewalls to limit connections. When the device is connected to a wide area network it uses communications ports to connect with other devices and the Internet. These ports are similar to doorways to the device. A hacker could access the mobile device through a port that is not secured. A firewall secures these ports and allows the user to choose what connections he or she wants to allow into the mobile device. The firewall intercepts both incoming and outgoing connection attempts and blocks or permits them based on a list of rules. Without a firewall, the mobile device may be open to intrusion through an unsecured communications port, and an intruder may be able to obtain sensitive information on the device and misuse it.

Mobile devices may have unauthorized modifications. The process of modifying a mobile device to remove its limitations so consumers can add additional features (known as “jailbreaking” or “rooting”) changes how security for the device is managed and could increase security risks. Jailbreaking allows users to gain access to the operating system of a device so as to permit the installation of unauthorized software functions and applications and/or to not be tied to a particular wireless carrier. While some users may jailbreak or root their mobile devices specifically to install security enhancements such as firewalls, others may simply be looking for a less expensive or easier way to install desirable applications. In the latter case, users face increased security risks, because they are bypassing the application vetting process established by the manufacturer and thus have less protection against inadvertently installing malware. Further, jailbroken devices may not receive notifications of security updates from the manufacturer and may require extra effort from the user to maintain up-to-date software.

Communication channels may be poorly secured. Having communication channels, such as Bluetooth communications, “open” or in “discovery” mode (which allows the device to be seen by other Bluetooth-enabled devices so that connections can be made) could allow an attacker to install malware through that connection, or surreptitiously activate a microphone or camera to eavesdrop on the user. In addition, using unsecured public wireless Internet networks or WiFi spots could allow an attacker to connect to the device and view sensitive information.

In addition, connecting to an unsecured WiFi network could allow an attacker to access personal information from a device, putting users at risk for data and identity theft. One type of attack that exploits the WiFi network is known as man-in-the-middle, where an attacker inserts himself in the middle of the communication stream and steals information. For example, figure 4 depicts a man-in-the-middle attack using an unsecured WiFi network. As a result, an attacker within range could connect to a user’s mobile device and access sensitive information.

The number and variety of threats aimed at mobile devices combined with the vulnerabilities in the way the devices are configured and used by consumers means that consumers face significant risks that the proper functioning of their devices as well as the sensitive information contained on them could be compromised.

Security Controls and Practices Identified by Experts Can Reduce Vulnerabilities

Mobile device manufacturers and wireless carriers can implement a number of technical features, such as enabling passwords and encryption, to limit or prevent attacks. In addition, consumers can adopt key practices, such as setting passwords, installing software to combat malware, and limiting the use of public wireless connections for sensitive transactions, which also can significantly mitigate the risk that their devices will be compromised.

Security Controls for Mobile Devices

Table 3 outlines security controls that can be enabled on mobile devices to help protect against common security threats and vulnerabilities. The security controls and practices described are not a comprehensive list, but are consistent with recent studies and guidance from NIST and DHS, as well as recommended practices identified by the FCC CSRIC advisory committee. In addition, security experts, device manufacturers, and wireless carriers agreed that the security controls and practices identified are comprehensive and are in agreement with the lists. Appendix III provides links to federal websites that provide information on mobile security.

Organizations may face different issues than individual consumers and thus may need to have more extensive security controls in place. For example, organizations may need additional security controls to protect proprietary and other confidential business data that could be stolen from mobile devices and need to ensure that mobile devices connected to the organization’s network do not threaten the security of the network itself. Table 4 outlines controls that may be appropriate for organizations to implement to protect their networks, users, and mobile devices.

In addition to using mobile devices with security controls enabled, consumers can also adopt recommended security practices to mitigate threats and vulnerabilities. Table 5 outlines security practices consumers can adopt to protect the information on their devices. The practices are consistent with guidance from NIST and DHS, as well as recommended practices identified by FCC’s CSRIC advisory committee.

Organizations also benefit from establishing security practices for mobile device users. Table 6 outlines additional security practices organizations can take to safeguard mobile devices.

Public and Private- Sector Entities Have Taken Initial Steps to Address Security of Mobile Devices, but Consumers Remain Vulnerable to Threats

Federal agencies and mobile industry companies have taken steps to develop standards for mobile device security and have participated in initiatives to develop and implement certain types of security controls. However, these efforts have been limited in scope, and mobile device manufacturers and carriers do not consistently implement security safeguards on mobile devices. Although FCC has facilitated public-private coordination to address specific challenges, such as cellphone theft, and developed cybersecurity best practices, it has not yet taken similar steps to encourage device manufacturers and wireless carriers to implement a more complete industry baseline of mobile security safeguards. Furthermore, DHS, FTC, NIST, and the private sector have taken steps to raise public awareness about mobile security threats. However, security experts agree that many consumers still do not know how to protect themselves from mobile security vulnerabilities. DHS and NIST have not yet developed performance measures that would allow them to determine whether they are making progress in improving awareness of mobile security issues.

Efforts Have Been Made to Address Security Vulnerabilities, but Controls Are Not Always Implemented

Federal agencies and mobile industry companies have worked to develop best practices and taken steps to address certain aspects of mobile security.

FCC has worked with mobile companies on several initiatives. For example, FCC tasked its advisory committee, CSRIC, with developing cybersecurity best practices, including recommended practices for wireless and mobile security. In March 2011, CSRIC released its report recommending that wireless carriers and device manufacturers consider adopting practices such as: working closely and regularly with customers to provide recommendations concerning existing default settings and to identify future default settings that may introduce vulnerabilities; employing fraud detection systems to detect customer calling anomalies (e.g., system access from a single user from widely dispersed geographic areas); having processes in place to ensure that all third-party software has been properly patched with the latest security patches and that the system works correctly with those patches installed; establishing application support for cryptography that is based on open and widely reviewed and implemented encryption algorithms and protocols; and enforcing strong passwords for mobile device access and network access.

In addition, in March 2012 FCC tasked CSRIC with examining three major cybersecurity threats to networks that allow cyber criminals to access Internet traffic for theft of personal information and intellectual property. In response, CSRIC recommended that wireless carriers (1) use key practices when mitigating botnet threats, (2) use best practices for deploying and managing Domain Name System Security Extensions, and (3) develop an industry framework to prevent Internet route hijacking via security weaknesses in the Border Gateway Protocol.working with the wireless carriers to implement these recommendations and is tasked with developing ways to measure the effectiveness of the recommendations.

FCC also tasked the Technological Advisory Council’s Wireless Security and Privacy working group to examine mobile security issues, such as vulnerabilities of WiFi networks, security of older generation cellular networks, malicious applications, and text messaging security. The working group is scheduled to issue its recommendations in December 2012.

Moreover, in April 2012, FCC announced that it had reached agreement with the CTIA-the Wireless Association, and multiple wireless carriers to establish processes to deter theft of mobile devices. Under the antitheft agreement, participating wireless carriers are to take several specific actions and submit quarterly progress reports to FCC. For example, the antitheft agreement calls for wireless carriers to initiate, implement, and deploy database solutions by October 31, 2012, to prevent reportedly lost or stolen smartphones from being used on another wireless network. The FCC plans to monitor progress in developing these databases and CTIA agreed to report progress quarterly, beginning June 30, 2012. The agreement also will result in the launch of a public education campaign by July 1, 2012, to inform consumers about the ability to lock or locate and erase data from a smartphone.

In addition, wireless carriers and device manufacturers reported that they participate in private-sector standards-setting organizations, which have addressed aspects of mobile security. For example, the Open Mobile Alliance, an industry standards group, has developed a specification to provide a common means for mobile developers to implement standards for secure and reliable data transport between two communicating parties. Furthermore, a consortium of wireless carriers and mobile device manufacturers known as the Messaging, Malware and Mobile Anti-Abuse Working Group has an initiative underway to address text-message-based spam. Under this initiative, wireless carriers encourage customers to forward spam text messages back to the carriers, who can use the messages to identify the source of spam and take corrective action to block its content from their networks. According to FCC officials, the current chairman of the Messaging, Malware and Mobile Anti-Abuse Working Group is a member of CSRIC and the chair of the working group that developed recommended solutions for the botnet threats.

While private and public sector entities have initiated activities to identify mobile security safeguards, these safeguards are not always available on mobile devices or activated by users. According to a 2012 study by NQ Mobile and the National Cyber Security Alliance (NCSA), approximately 30 percent of respondents said they did not have mobile security features on their smartphones. In addition, approximately 66 percent of respondents did not report that they activated password protection on their devices to prevent unauthorized access and that at least 67 percent did not report activating a remote-wipe or remote-locate security feature. Security company representatives told us that these results were generally consistent with their experiences and observations.

In addition, mobile device manufacturers and wireless carriers do not consistently implement or activate security safeguards on their mobile devices. According to most of the device manufacturers and several wireless carriers we spoke with, safeguards such as passwords, encryption, and remote wipe/lock/locate can be made available on their mobile devices, although one wireless carrier noted that encryption might be inappropriate for certain types of devices. Several of these companies also acknowledged that it is possible to preconfigure mobile devices to prompt the user to implement safeguards when the phone is first set up. However, with the exception of password protection for online voicemail accounts, none of the device manufacturers or wireless carriers stated that they generally configure their devices to prompt the user to implement these controls. We also observed that general cybersecurity instructions were not directly accessible from either carriers or device manufacturers, although instructions for implementing controls could be found by searching the company’s website for information about individual models of smartphones.

FCC has the ability to encourage broad implementation of mobile security safeguards among mobile industry companies. While it has taken steps to encourage implementation of safeguards in certain areas, it has not yet taken similar steps to encourage industry implementation of a broad baseline of mobile security safeguards. For example, in its recent antitheft agreement with CTIA, and participating wireless carriers, FCC took an active role in encouraging major wireless carriers to adopt specific procedures to discourage the theft of mobile devices. This effort demonstrates that FCC can facilitate private sector efforts to establish an industry baseline and milestones for addressing mobile security challenges. Moreover, representatives from multiple companies agreed that FCC could play a role in coordinating private sector efforts to improve mobile security.

FCC has also facilitated private sector efforts to establish cybersecurity best practices in areas not specific to mobile security. As mentioned previously, FCC tasked CSRIC to review best practices for botnet threats, Domain Name System attacks, and Internet route hijacking. CSRIC developed voluntary recommendations in these areas and has been working with wireless carriers to implement them. According to FCC officials, wireless carriers representing 90 percent of the domestic customer base have committed to adopting and using these practices. Although these recommendations are not specific to mobile devices, FCC officials stated that the process of seeking voluntary compliance from carriers had been successful and demonstrated the willingness of carriers to adopt best practices.

FCC officials stated that they hope to have the same cooperation from wireless carriers when the Technological Advisory Council’s Wireless Security and Privacy working group releases its recommendations on mobile security issues, scheduled for December 2012. While it is not clear that the working group will develop a baseline of recommended practices for implementation by mobile industry companies, the council’s recommendations nevertheless could be part of such a baseline.

Another candidate for a set of baseline mobile security standards that mobile industry companies could be encouraged to implement is the collection of cybersecurity best practices developed by CSRIC in 2011. Those practices have not yet been adopted as a baseline within the mobile industry. FCC officials from the Public Safety and Homeland Security Bureau stated that they had not yet taken action to promote this specific set of recommended practices, although they had held informal meetings with industry to discuss the implementation of cybersecurity practices. Whether mobile industry companies adopt the CSRIC- recommended practices or choose other baseline practices and controls, it will be important for FCC to encourage industry to adopt recommended practices. If such practices are not implemented, vulnerabilities in mobile devices are likely to continue to pose risks for consumers.

The Effectiveness of Public and Private Sector Efforts to Raise Awareness about Mobile Security Is Unclear

Many of the key practices that have been identified as effective in mitigating mobile security risks depend on the active participation of users. Thus it is important that an appropriate level of awareness is achieved among consumers who use mobile devices on a regular basis. To address this need, federal agencies have developed and distributed a variety of educational materials. For example:

DHS’s US-Computer Emergency Readiness Team (US-CERT) has developed cybersecurity tip sheets and technical papers related to mobile security. These materials, which are published on the US- CERT website, provide lists of suggestions, such as the use of passwords and encryption, to help consumers to protect their devices and sensitive data from network attacks and theft.

DHS coordinates domestic and international engagements and cybersecurity outreach endeavors. For example, as the lead agency for the awareness component of the NICE initiative, DHS coordinates the National Cyber Security Awareness Month and a national cybersecurity public awareness campaign called “Stop. Think. Connect.” As part of these efforts, DHS has developed educational materials that, although not specifically related to mobile security, encourage users to adopt safe practices when using the Internet. The DHS website related to this effort also provides links to educational materials hosted on third-party websites, such as StaySafeOnline.org.

FTC manages the OnGuardOnline website, which provides individuals with information about how to use the Internet in a safe, secure, and responsible manner. As part of this effort, FTC has developed educational materials specifically related to mobile security, such as avoiding malicious mobile applications and protecting children who use mobile devices. In addition, FTC and DHS have developed and distributed printed cybersecurity guides to schools, business, and other entities, according to an FTC staff member.

NIST published guidelines on the security of cellphones and personal digital assistants in 2008. provides users with information about how to secure their devices. For example, the guidance discusses the value of implementing authentication (e.g., password protection) and remotely erasing or locking devices that are lost or stolen.

Among other things, this guidance DHS and nonprofit organizations also have developed and distributed cybersecurity educational materials in collaboration with NCSA. In addition to funding from the private sector, DHS officials stated that DHS has contributed a grant to NCSA to conduct surveys and other activities. NCSA has produced educational materials that specifically relate to mobile security. For example, NCSA’s website provides tips that individuals can follow to protect their mobile devices such as avoiding malware, using trusted internet connections, and securing personal information through the use of strong passwords.

NIST, Special Publication 800-124, Guidelines on Cell Phone and PDA Security (October 2008). According to NIST officials, they are revising this publication and will release a draft update in fiscal year 2012. mobile phone theft, (2) spam and mobile phones, and (3) computer viruses and mobile phones. Similarly, CTIA maintains a blog with information on topics such as establishing passwords and using applications that can track, locate, lock, and/or wipe wireless devices that are lost or stolen. In addition, as part of the antitheft initiative discussed above, CTIA agreed that its members would implement a system to inform users about security safeguards on mobile devices as well as launch an education campaign regarding the safe use of smartphones.

Despite the efforts underway by the federal government and the private sector to develop and distribute educational materials, it is unclear whether consumer awareness has improved as a result. Representatives from companies that specialize in information security told us that many consumers do not understand the importance of implementing mobile security safeguards or do not know how to implement them. Their views are consistent with the results of the 2012 NCSA study, which suggested that many mobile users do not know how to implement mobile security safeguards. The survey reported that more than half of respondents felt that they required additional information in order to select and/or implement security solutions for their mobile devices. Further, the study reported that approximately three-quarters of respondents reported that they did not receive information about the need for security solutions at the time they purchased their phone. The survey did not include data that would indicate whether consumer awareness had improved or worsened over time.

While DHS and NIST have conducted or supported several consumer cybersecurity awareness efforts, neither has developed outcome-oriented performance measures to assess the effectiveness of government efforts to enhance consumer awareness of mobile security. An outcome-oriented performance measure is an assessment of the result, effect, or consequence that will occur from carrying out a program or activity compared to its intended purpose. NIST officials stated that they do not currently measure progress related to awareness activities associated with NICE. Furthermore, although DHS officials stated that the department assesses the effectiveness of several of the awareness activities, these assessments are not based on outcome-oriented measures. For example, DHS officials stated that they assess the “Stop.

Think. Connect.” events by (1) the number of individuals who join the campaign and agree to receive additional information, such as newsletters, concerning cybersecurity; (2) the total number of events held; (3) the number of agencies and states that join the campaign; and (4) the number of times the campaign website is visited. However, these measures are not outcome-oriented because they do not indicate how, if at all, these activities have (1) improved citizens’ knowledge about managing online risk, (2) improved knowledge of cybersecurity within organizations, or (3) enabled access to cybersecurity resources.

To develop measures of the impact of government efforts on consumer awareness of mobile security issues, a baseline measure of consumer awareness would be needed from which to mark progress. However, neither DHS nor NIST has developed a baseline measure of the state of national cybersecurity awareness. Establishing a baseline measure and regularly assessing consumer awareness and behavior regarding a particular issue can enable organizations to document where problems exist, identify causes, prioritize efforts, and monitor progress. DHS officials stated that the department has considered conducting a study on consumer behavior and awareness related to general cybersecurity but has not yet done so.

Without a baseline measure of consumer awareness, it will remain difficult for NIST and DHS to measure any correlation between the government’s activities and enhanced consumer awareness. Further, without outcome-oriented performance measures, the government will be limited in its ability to determine whether it is achieving its identified goals and objectives, including whether cybersecurity awareness efforts are effective at increasing adoption of recommended security practices.

Conclusions

Mobile devices face an array of threats that take advantage of numerous vulnerabilities commonly found in such devices. These vulnerabilities can be the result of inadequate technical controls, but they can also result from the poor security practices of consumers.

Private sector entities and relevant federal agencies have taken steps to improve the security of mobile devices, including making certain controls available for consumers to use if they wish and promulgating information about recommended mobile security practices. However, security controls are not always consistently implemented on mobile devices, and it is unclear whether consumers are aware of the importance of enabling security controls on their devices and adopting recommended practices.

Although FCC has taken steps to work with industry to develop cybersecurity best practices, it has not yet taken steps to encourage wireless carriers and device manufacturers to implement a more complete industry baseline of mobile security safeguards, and NIST and DHS have not determined whether consumer awareness of mobile security issues has improved since the government’s efforts have been initiated.

Recommendations for Executive Action

To help mitigate vulnerabilities in mobile devices, we recommend that the Chairman of the Federal Communications Commission continue to work with wireless carriers and device manufacturers on implementing cybersecurity best practices by encouraging them to implement a complete industry baseline of mobile security safeguards based on commonly accepted security features and practices; and monitor progress of wireless carriers and device manufacturers in achieving their milestones and time frames once an industry baseline of mobile security safeguards has been implemented.

To determine whether the NICE initiative is having a beneficial effect in enhancing consumer awareness of mobile security issues, we recommend that the Secretary of Homeland Security in collaboration with the Secretary of Commerce establish a baseline measure of consumer awareness and behavior related to mobile security and develop performance measures that use the awareness baseline to assess the effectiveness of the awareness component of the NICE initiative.

Agency Comments and Our Evaluation

We received written comments on a draft of this report from the Chief of FCC’s Public Safety and Homeland Security Bureau, the Director of DHS’s Departmental GAO-OIG Liaison Office, and the Acting Secretary of Commerce. These officials generally concurred with our recommendations and provided technical comments, which we have considered and incorporated as appropriate into the final report. FTC did not provide written comments on the draft report, but an attorney in FTC’s Office of the General Counsel did provide technical comments in an e-mail that we addressed as appropriate. DOD did not provide comments on the draft report. The comments we received are summarized below.

In addition to FCC’s written comments, the Chief of FCC’s Public Safety and Homeland Security Bureau stated in e-mail comments that the commission generally concurred with our recommendations that it encourage wireless carriers and device manufacturers to implement a complete industry baseline of mobile security safeguards; and to monitor progress of wireless carriers and device manufacturers in achieving their milestones and time frames once a baseline has been implemented. In the written comments, the Chief added that FCC has facilitated private sector efforts, for example, through advisory committees such as CSRIC to establish and promote the implementation of cybersecurity best practices that secure the underlying Internet infrastructure. FCC officials also provided preliminary oral and written technical comments, which we addressed as appropriate (FCC’s written comments are reprinted in app. II).

The Director of DHS’s Departmental GAO-OIG Liaison Office provided written comments in which the department concurred with our recommendations that it work with Commerce to establish a baseline measure of consumer awareness and behavior related to mobile security and develop performance measures that use the baseline to assess the effectiveness of the awareness component of the NICE initiative. He stated that the department will coordinate with its counterparts at Commerce to assess the feasibility of different methods to create a baseline measure of consumer awareness and continue to promote initiatives to educate the public about cybersecurity. He also stated that the department will coordinate with its NIST counterparts on the development of performance measures using the awareness campaign and other methods. He also provided technical comments, which we have incorporated as appropriate (DHS’s comments are reprinted in app. III).

The Acting Secretary of Commerce provided written comments in which the department concurred in principle with our recommendations that NIST work with DHS to establish a baseline measure of consumer awareness and behavior related to mobile security and that it develop performance measures that use the baseline to assess the effectiveness of the awareness component of the NICE initiative. The Acting Secretary provided technical comments and asked that we consider replacing “baseline understanding” with “baseline measure,” which we have incorporated into the final report. She also provided suggested revised text. However, we believe that the information in the draft is correct and communicates appropriately as written. Therefore, we have not added the suggested text (Commerce’s comments are reprinted in app. IV).

We are sending copies of this report to the appropriate congressional committees; the Chairmen of the Federal Communications Commission and Federal Trade Commission; the Secretaries of Commerce, Defense, and Homeland Security; and other interested congressional parties. The report also is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact: Gregory C. Wilshusen at (202) 512-6244 or Dr. Nabajyoti Barkakati at (202) 512-4499, or by e-mail at wilshuseng@gao.gov or barkakatin@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VI.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine: (1) what common security threats and vulnerabilities currently exist in mobile devices, (2) what security features are currently available and what practices have been identified to mitigate the risks associated with these vulnerabilities, and (3) the extent to which government and private entities are addressing security vulnerabilities of mobile devices.

To determine the common security threats and vulnerabilities that currently exist in mobile devices (cellphones, smartphones, and tablets), as well as security features and practices to mitigate them, we identified agencies and private companies with responsibilities in the telecommunication and cybersecurity arena, and reviewed and analyzed information security-related websites, white papers, and mobile security studies. We interviewed officials, and obtained and analyzed documentation from the Federal Communications Commission (FCC), Department of Homeland Security (DHS), Department of Defense (DOD), Department of Commerce (Commerce), and Federal Trade Commission (FTC) to determine the extent to which they have identified mobile security vulnerabilities and developed standards and guidance on the security of mobile devices. We interviewed and obtained documents from an industry group and an advisory council, both of which have representation from the telecommunication industry; these included the CTIA-The Wireless Association and the Communications Security, Reliability, and Interoperability Council (CSRIC). We also analyzed information from the US-Computer Emergency Readiness Team (US- CERT) and the National Vulnerability Database on mobile security vulnerabilities.

Further, we obtained input from the private companies who make up the largest market share for mobile devices in the United States to determine what steps they are taking to provide security for their mobile devices. These included mobile device manufacturers—HTC Corporation, Research In Motion, Corp, Motorola Mobility Inc., Samsung, and LG Electronics—as well as wireless carriers—Verizon Wireless, AT&T Inc., T-Mobile USA Inc., and Sprint. We also met with representatives of information security companies, including Symantec Corporation and Juniper Networks. We approached Apple Inc. and Google Inc.; however, Apple officials did not agree to meet with us and Google officials did not provide responses to our questions. We developed draft lists of common vulnerabilities and security practices based on our analysis of government security guidance as well as private sector studies and reports. We provided copies of these lists to each of the companies listed above and addressed their comments as appropriate.

To determine the extent to which government and private entities are addressing security vulnerabilities of mobile devices, we analyzed statutes and regulations to determine federal roles related to mobile security. In order to identify initiatives related to improving mobile security or raising consumer awareness, we interviewed the federal and private sector officials mentioned above, and members of a private sector working group devoted to mobile security issues, known as the Messaging, Malware, and Mobile Anti-Abuse Working Group. In addition, we analyzed multiple studies related to consumer attitudes and practices related to mobile devices. Specifically, we assessed available methodological information against general criteria for survey quality and relevant principles derived from the Office of Management and Budget (OMB) Standards and Guidelines for Statistical Surveys. Because the available methodological documentation did not allow us to fully assess the quality of the survey data, the risk of error in the surveys makes it possible that reported results may not be very accurate or precise. Although we corroborated the study’s general findings with information security experts, readers should be cautious in drawing conclusions based on these results.

We conducted this performance audit from November 2011 to September 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Federal Communications Commission

Appendix III: Comments from the Department of Homeland Security

Appendix IV: Comments from the Department of Commerce

Appendix V: Federal Websites for Information Related to Mobile Security

The table below provides information and website links to federal sites that include information related to mobile security. Website links are current as of July 10, 2012.

Appendix VI: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the individuals named above, key contributions to this report were made by John de Ferrari (Assistant Director), West E. Coile, Neil J. Doherty, Rebecca E. Eyler, Richard J. Hagerman, Tammi N. Kalugdan, David F. Plocher, Carl M. Ramirez, Meredith R. Raymond, and Brandon C. Sanders.