Mobile and IoT Device Security Flashcards

A company wants to enforce a security policy that requires all employee-owned smartphones accessing corporate email to have a mandatory PIN and the ability to be remotely wiped if lost or stolen. Which of the following solutions would BEST achieve this?

Answer: Mobile Device Management (MDM)

Mobile Device Management (MDM) solutions are specifically designed to allow administrators to manage and enforce security policies on mobile devices. This includes capabilities like enforcing PINs, encrypting data, and performing a remote wipe to protect corporate data if a device is lost or stolen.

What is a primary security consequence of jailbreaking an iOS device or rooting an Android device?

Answer: It bypasses the operating system's built-in security controls and sandboxing.

Jailbreaking or rooting a device removes the security restrictions and protections, like app sandboxing, that are built into the mobile operating system. This action grants the user elevated privileges but also makes the device significantly more vulnerable to malware and unauthorized access.

A user has several IoT devices, such as smart light bulbs and a smart thermostat, on their home network. To minimize the potential damage if one of these devices is compromised, which of the following is the BEST network security practice?

Answer: Placing all IoT devices on a separate, isolated network segment.

Network segmentation is a critical security practice for IoT devices. By placing them on a separate network (like a guest Wi-Fi network or a VLAN), you isolate them from your primary computers and data. If an IoT device is compromised, the attacker's access is contained within that segment, preventing them from easily accessing more sensitive systems on the main network.

A user receives an SMS text message that warns their bank account has been locked and provides a link to 'verify' their identity. This is a classic example of which type of attack?

Answer: Smishing

Smishing is a form of phishing that is conducted using SMS (Short Message Service) text messages. The goal is the same as email phishing: to trick the user into revealing sensitive information or clicking a malicious link, but the medium is a mobile text message.

An individual in a crowded public area suddenly receives an unsolicited, anonymous business card contact on their phone via Bluetooth. The contact contains a simple advertising message. What is this activity called?

Answer: Bluejacking

Bluejacking is the act of sending unsolicited messages to other Bluetooth-enabled devices. It is often harmless and used for advertising or as a prank, unlike Bluesnarfing, which involves the unauthorized theft of data from a device via Bluetooth.

Upon setting up a new smart security camera, a user connects it to their network without changing the default username and password printed on the device's label. What is the MOST significant security risk of this action?

Answer: The manufacturer's default credentials are often publicly known and can be easily exploited by attackers.

Many IoT devices are shipped with simple, default credentials (like 'admin'/'password'). These defaults are often well-known and published online. Attackers can run automated scans to find these devices on the internet and gain unauthorized access if the credentials have not been changed, posing a major security and privacy risk.