Root and Source Security Concerns

What can the default user account do in both iOS and Android?

install apps and configure settings

What is the default user account in both iOS and Android restricted from doing?

making system-level changes

What is root access on Android?

gaining administrative control over the device

How might Android root access be obtained?

authorized vendor methods, exploiting vulnerabilities, or installing custom firmware (custom ROMs)

What can rooting do to Android security and management software?

disable security features, compromising the device's integrity and any management software

What is jailbreaking in iOS?

gaining root privileges

What can jailbreaking allow on iOS?

sideloading apps, changing carriers, and customizing the interface

How is jailbreaking typically done?

booting with a patched kernel, often requiring a tethered connection to a computer

What security impact can jailbreaking have?

leave security measures disabled, compromising the device's security

How do rooting and jailbreaking affect OS security controls?

subvert OS security controls, leaving devices vulnerable

What can MDM do with rooted or jailbroken devices?

detect them and prevent access to enterprise apps, networks, or workspaces

What else can MDM block regarding firmware and developer mode?

devices with custom firmware lacking valid signatures and devices with developer mode enabled

What does developer mode grant access to?

advanced configuration settings and diagnostic data

When should developer mode be used, and why not routinely enabled?

exclusively for app development; it can be exploited to install unauthorized apps

What do trusted app sources do for app signing and security?

authenticate developers and issue certificates for app signing, ensuring apps are secure

What else may service providers do with submitted apps?

analyze submitted code to prevent security or privacy risks and enforce policies

What is app spoofing?

malicious apps disguised as legitimate ones

How do malicious spoofed apps often appear credible?

mimic popular apps with similar names and use fake reviews

What should users be cautious about even when using an approved store?

apps requesting unrelated permissions

What app installation model do mobile operating systems typically use?

restrict app installations to official stores

How do enterprises privately distribute custom corporate apps?

enterprise developer and distribution programs or Managed Google Play, allowing MDM suites to push apps from private channels directly to devices

What is sideloading on Android?

downloading and installing apps using the .APK file format from third-party sources if enabled

Why does enabling unknown sources weaken security?

it allows apps from third-party sources to be installed

What can MDM do regarding third-party stores or sideloading?

prevent the use of third-party stores or sideloading, effectively blocking unapproved app sources

Why are bootleg app stores risky?

they may tempt users to enable unknown sources for sideloading, infringing copyrights, and exposing devices to malware

How is app source security maintained overall?

using trusted stores, exercising caution with app permissions, and leveraging MDM to enforce policies and monitor app installations

What can Location Services use to pinpoint your location?

GPS, Wi-Fi, or cell towers

Why might someone turn off Location Services?

if concerned about privacy and someone knowing their location, and to help save battery life

How can app access to location be controlled?

set the allowed access for each specific app or service

What are tracking permissions for?

asking permission to track activity when visiting other websites or running other applications

Why do apps request tracking permission?

to gain more information for advertising or to share it with data brokers

How can app access to features like the camera be managed?

view all applications that requested access in a category and turn them on or off in one place

Why should you understand how your information is collected, stored, and shared?

to be in control of your information