Information Security Best Practices to Eliminate Mobile Threats and Attacks

Mobile security is more and more important with the fast growth of mobile devices, and people are becoming more dependent on mobile devices in their daily life. Malicious samples in mobile devices are growing in double times each year from 2011 to 2017 in China. ISO/IEC 27000 family of standards helps organizations keep information assets secure, such as financial information, intellectual property, employee details or information entrusted to you by third parties. ISO/IEC 27001 is the best-known standard in the family providing requirements for an information security management system (ISMS). However, ISO/IEC 27001 is not quite adaptable for mobile devices, because these developing mobile information devices lead to new challenges and security risks. This paper analyzes mobile devices security issues, and gives the drawback for 27001 in mobile security. Finally, this paper gives a consideration to these issues under ISO/IEC 27001 information security management system framework.

Introduction: The introduction of Clinical Information Systems (CIS) to manage and store patient information has deeply modified the workflow of caregivers. As the information is no longer stored on a physical medium, caregivers depend on the presence of a computer to access patient data. This constraint has built up an invisible barrier between the source of information and the place of its use. The popularisation of mobile devices offers an oportunity to break this barrier by providing a ubiquitous access to information. The use of a mobile platform merges the advantages of a modern CIS and the mobility offered by paper. We have developed an application on a mobile device that nurses can carry along on all their visits. It allows the information gathered during their visits to be entered directly into the system. Method: The tool we present aims to manage the daily interventions of nurses. The interventions concern all kinds of treatments provided by nurses to patients. In the current organisation, nurses start their day by printing out all the daily interventions and use it as a procedure to follow. Every time a nurse performs an intervention, she takes a note indicating that the task has been done properly. When they have some spare time, nurses enter all the gathered information in the CIS. Once nurses are equipped with mobile devices, paper becomes useless. Consequently, the process is simplified. Replacing the paper by a mobile device application is not straightforward. In order to access patient information, the tool must be linked to the existing CIS of the hospital without creating too strong dependencies. Moreover, the mobile interface must be adapted to the specificities of the mobile device such as a smaller display size, a reduced computational power, a tactile-based interaction and a real-time usage. Results: In order to link the mobile application to the existing CIS, we relied on a Service Oriented Architecture (SOA). It was mandatory to think of a software architecture that would not create a dependency with any legacy system. Thus, we defined a gateway server providing centralised access for the mobile application to any required information to or from the CIS. Integrating any mobile application would only require integrating this bridge. The gateway server also clearly separates the services that are available remotely from the ones proposed as usual Web services. The developed application not only allows the validation of the interventions and the input of measures, but it also offers a simple way to define the context in which nurses are working. This context is necessary to identify the specific list of interventions for the patients under the caregiver’s responsibility. The current CIS of the HUG includes a module that provides information concerning the interventions. Its interface is adjusted for a personal computer screen. Since caregivers are accustomed to this organisation of the information, we aimed to develop an interface on a mobile device that guarantees a certain level of homogeneity with the existing PC application. However, a mobile device’s screen is of limited size, therefore the interface has been completely rebuilt to be adapted to the new display. To deal with the limited display size, we rely on hierarchy and indexicality principles. For instance, based on the hypothesis that all tasks belonging to one category and planned at the same time can be regrouped under a single item; we regroup the interventions of similar top level in a common item. Moreover, to minimise user manipulations, relevant items are automatically moved to the top. Conclusion: The current daily workflow of nurses cannot be managed consistently using a unique tool. The need to switch from paper to computer induces work overload and is a source of errors. Therefore, we have developed a program running on a mobile device that nurses can carry during their visits. This program allows to manage nurses' daily interventions in real-time. The development of such a tool has required a complete reconstruction of the classical personal computer interface. This new interface takes into account a smaller display size, an innovative interaction paradigm, and real-time constraints.

Research ProblemCyber attacks are targeting the cloud computing systems, where enterprises, governments, and individuals are outsourcing their storage and computational resources for improved scalability and dynamic management of their data. However, the different types of cyber attacks, as well as the different attack goals, create difficulties providing the right security solution needed. This is because different cyber attacks are associated with different threats in the cloud computing systems, where the importance of threats varies based on the cloud user requirements. For example, a hospital patient record system may prioritize the security of cyber attacks tampering patient records, while a media storage system may prioritize the security of cyber attacks carrying out a denial of service attack for ensuring a high availability. As a result, it is of paramount importance to analyze the risk associated with the cloud computing systems taking into account the importance of threats based on different cloud user requirements.However, the current risk evaluation approaches focus on evaluating the risk associated with the asset, rather than the risk associated with different types of threats. Such a holistic approach to risk evaluation does not show explicitly how different types of threats contribute to the overall risk of the cloud computing systems. Consequently, This makes it difficult for security administrators to make fine-grained decisions in order to select security solutions based on different importance of threats given the cloud user requirements. Therefore, it is necessary to analyze the risk of the cloud computing systems taking into account the different importance of threats, which enables the allocation of resources to reduce particular threats, identify the risk associated with different threats imposed, and identify different threats associated with cloud components.Proposed SolutionThe STRIDE threat modeling framework (short for STRIDE) is proposed by Microsoft, which can be used for threat categorization. Using the STRIDE, we propose a threat-guided risk evaluation approach for the cloud computing systems, which can evaluate the risk associated with each threat category from the STRIDE explicitly. Further, we utilize seven different types of security metrics to evaluate the risk namely: \textit{component, component-threat, threat-category, snapshot, path-components, path-threat}, and \textit{overall asset}. Component, component-threat, threat-cateory, and snapshot risks measure the total risk on a component, component risk for a particular threat category, total snapshot risk for a single threat, and the total risk of the snapshot considering all threat categories, respectively. Path-components, path-threat, and overall asset measure the total risk of components in an attack path, the risk of a single threat category in the attack path, and the overal risk to an asset considering all attack paths, respectively. These metrics makes it possible to measure the contribution of each threat category to the overall risk more precisely.When a vulnerability is discovered in a component (e.g. a Virtual Machine) of the Cloud deployment, the administrator first determines which types of threats could be posed should the vulnerability be successfully exploited, and what would be the impacts of each of those threats on the asset. The impact assignment of each threat type is weighted depending on the importance of the component. For example, a Virtual Machine (VM) that acts a Web Server in a medical records management application could be assigned a higher weighting for \textit{denial-of-service} threats because if such attacks are successfully launched then the rest of the VMs that are reached through the Web Server will be unavailable. On the other hand, a vulnerability discovered in a VM that hosts a database of medical records would be rated highest impact for \textit{information disclosure} because if it is compromised confidentiality of the medical history of patients will be violated.By multiplying the probability of successfully exploiting the vulnerability with the threat impact, we compute the risk of each threat type. The variation in the assignment of impact for different threat types enables our approach to compute risks associated with the threats - thus empowering the security administrator with the ability to make fine-grained decisions on how much resources to allocate for mitigating which type of threat and which threats to prioritize. We evaluated the usefulness of our approach through its application to attack scenarios in an example Cloud deployment. Our results show that it is more effective and informative to administrators compared to asset-based approaches to risk evaluation.

Mobile and handheld devices are becoming an integral part of people’s work, life and entertainment. These lightweight pocket-sized devices offer great mobility, acceptable computation power and friendly user interfaces. As people are making business transactions and managing their online bank accounts via handheld devices, they are concerned with the security level that mobile devices and systems provide. In this chapter we will discuss whether these devices, equipped with very limited computation power compared to full-sized computers, can make equivalent security services available to users. We focus on the security designs and technologies of hardware, operating systems and applications for mobile and handheld devices.

With the increasing use of artificial intelligence (AI) models, more attention is being paid to issues of trust and security in AI systems against various types of threats (evasion attacks, poisoning, membership inference, etc.). In this work, we focus on the task of graph node classification, highlighting it as one of the most complex. To the best of our knowledge, this is the first study exploring the relationship between defense methods for AI models against different types of threats on graph data. Our experiments are conducted on citation and purchase graph datasets. We demonstrate that, in general, it is not advisable to simply combine defense methods for different types of threats, as this can lead to severe negative consequences, including a complete loss of model effectiveness. Furthermore, we provide theoretical proof of the contradiction between defense methods against poisoning attacks on graphs and adversarial training.

“Essential Security Practices for Fortifying Mobile Apps” is a definitive guide designed to empower developers, security professionals, and organizations with the knowledge and tools needed to secure mobile applications in an increasingly complex digital landscape. This comprehensive book covers every aspect of mobile app security, providing actionable insights and practical strategies to protect apps from the ever-evolving threat landscape. The book begins with an Introduction to Mobile App Security (Chapter 1), where readers are introduced to the critical importance of securing mobile apps. It discusses common security threats, the principles of security by design, and the unique challenges faced in mobile app development. The chapter also includes case studies of major security breaches, offering real-world context to the concepts discussed. In Secure Development Lifecycle (Chapter 2), the book emphasizes the importance of integrating security into the Software Development Lifecycle (SDLC). Topics such as threat modeling, secure coding practices, and penetration testing are explored in depth. This chapter also covers the role of continuous integration in maintaining security and the necessity of incident response planning and security training. Authentication and Authorization (Chapter 3) dives into the mechanisms that ensure only authorized users have access to mobile apps. It covers secure authentication methods, including multi-factor authentication and token-based authentication, as well as best practices for session management and password storage. The chapter provides guidelines to avoid common authentication flaws that could compromise app security. Data Protection and Privacy (Chapter 4) addresses the crucial aspects of encrypting data both at rest and in transit. It discusses secure data storage, privacy by design principles, and the handling of personally identifiable information (PII). Readers will learn about secure data deletion and compliance with data protection regulations, as well as the use of secure cryptographic libraries. Network Security (Chapter 5) explores the protocols and techniques needed to secure communication between mobile apps and their backend systems. The chapter covers the correct use of TLS/SSL, protecting against man-in-the-middle attacks, and securing backend APIs. It also discusses the importance of monitoring and logging network activity to detect and respond to potential threats. The book then moves on to Secure Coding Practices (Chapter 6), providing guidance on avoiding common coding vulnerabilities through input validation, error handling, and defensive programming techniques. It also covers secure code reviews and the best practices for using mobile platform APIs securely. Mobile Device Security (Chapter 7) shifts focus to the security of the devices on which mobile apps run. The chapter discusses mobile device threats, secure device configuration, and the use of mobile device management (MDM) solutions. It also addresses the security features of mobile devices, such as secure boot and remote wiping, which are essential for protecting against device theft or loss. In Secure Deployment and Distribution (Chapter 8), readers will learn about secure strategies for deploying and distributing mobile apps. Topics include code signing, protecting against repackaging and tampering, and securely distributing sensitive data. The chapter also covers handling updates and patches, ensuring that apps remain secure after deployment. Security Testing and Validation (Chapter 9) provides an in-depth look at the various types of security testing, including automated and manual testing techniques. It discusses penetration testing best practices, vulnerability assessment, and the integration of security testing into CI/CD pipelines. Regular security audits and addressing found vulnerabilities are also emphasized. Incident Response and Management (Chapter 10) guides readers in building an effective incident response team and creating a robust incident response plan. The chapter covers the steps for detecting, analyzing, containing, eradicating, and recovering from security incidents. Post-incident analysis and communication with stakeholders are also discussed, alongside legal and regulatory considerations. Finally, Future Trends in Mobile App Security (Chapter 11) explores the emerging threats and advancements in mobile security technologies. The chapter discusses the role of artificial intelligence in security, the integration of IoT with mobile devices, and the potential of blockchain in enhancing mobile security. It also highlights the importance of user education and awareness in safeguarding mobile applications in the future. “Essential Security Practices for Fortifying Mobile Apps” is an invaluable resource for anyone involved in the development, deployment, and management of mobile applications, offering a thorough understanding of the security challenges and the strategies needed to overcome them.

This study seeks to investigate different types of threats which affect the journalists' safety in Egypt and how do they manage their work in the presence of the diverse threats. The study analyzes the Egyptian legislative framework in order to explain whether it protects media freedom and journalists or it needs further reforms. To address the research objective in detail, the study also incorporates the feedback of 45 Egyptian journalists belonging to government's partisan and private media organizations.

This paper introduces iFringe, a mobile application that attempts to incorporate the resource heavy fringe analysis algorithms into the smart mobile devices platform. This first step taken towards mobility in the optical processing field aims to become a catalyst for modernization of various aspects of the field as well as to diversify developments to other applications. Predominantly, the motivation of this work stems from the vastly indifferent human interactive method of mobile devices, which enable images displayed on its touch screen to be manipulated in ways that could enhance the fringe analysis experience. Furthermore, given its hardware compatibility to the conventional fringe projection system, these mobile devices could potentially serve as a much more compact replacement. However, one imperative weakness that mobile devices pose is its limited computing ability. Therefore, to examine the feasibility of incorporating the fringe analysis algorithms into a mobile platform, we have implemented two fundamental fringe analysis techniques, namely the Fourier transform fringe analysis method and the phase-shifting technique. Formulas and processing procedures such as discrete Fourier transform (DFT) and quality-guided phase unwrapping, were included in accordance to their original algorithms to test their performance and usability on a smart mobile device. Details of the implementation and the performance results will also be presented in this paper to demonstrate the practicality of these algorithms on the smart mobile device platform.

The competency to use mobile devices for work-related tasks gives advantages to the company productiveness and expedites business processes. Thus Bring Your Own Device (BYOD) setting emerge to enable work flexibility and technological compatibility. For management, employees’ productivity is important, but they could not jeopardise the security of information and data stored in the corporate network. Securing data and network becomes more complex tasks as it deals with foreign devices, i.e., devices that do not belong to the organisation. With much research focused on pre-implementation and the technical aspects of mobile device usage, post-implementation advancement is receiving less attention. IS audit as one of the post-implementation mechanisms provides performance evaluation of existing IS assets, business operations and process implementation, thus helping management formulating the best strategies in optimising IS practices. This paper discusses the feasibility of IS audit in assessing mobile device security by exploring the risks and vulnerabilities of mobile devices for organisational IS security as well as the perception of Information system management in mobile device security. By analysing related literature, authors pointed out how the references used in the current IS audit research address the mobile device security. This work serves a significant foundation in the future development in mobile device audit.

Mobile systems and mobile applications have gained a lot of attention both in research and industry over the last years. The market share of mobile devices is constantly growing. More and more, users expect their mobile devices to provide functionality similar to the one they know from their desktop computers, but also to provide additional, mobile device specific functionality, like location based services. However, software development for mobile devices is still cumbersome and a methodology geared towards supporting the development of such mobile applications is still lacking. While there is broad agreement that developing for mobile devices is more difficult than traditional software engineering, we lack a precise understanding that goes beyond anecdotic evidence of why this is the case and how the situation can be ameliorated. We do not precisely know where and how the development of mobile application differs from “normal” software development and where new methodologies are needed. Aspects that need to be addressed in this context are, among others, the questions of software architectures for mobile applications, approaches to the software design for mobile applications and how the consequences of being mobile, e. g., changing location, changing context, changing connectivity, heterogeneous software and platforms influence the software development process and what design approaches do reflect the specialties of mobile applications and systems appropriately. While this special issue cannot provide a definite or complete answer to these questions, it does provide answers to some important aspects. In the following, we will first try to get a more thorough understanding of some of the main differences between mobile and classical application development and will then discuss how the papers contained in this special issue address these differences.

In the nowadays enterprise computerized context, there is a trend that shifts the business applications to the new mobile environments. In the light of this information, it is highly important to be knowledgeable about the software development methodologies available in order to make the right choice when it comes to developing a mobile application. The current research aims to presenting the methodological approaches regarding the development cycle of classic enterprise software versus mobile apps. In the first part of the paper a brief literature review regarding the mobile is made, for the purpose of justifying the current research theme. The most consistent part of the article puts face-to-face the classical and the new development methodologies adapted to the requirements of the new mobile environment trends. The paper also presents the challenges and limitations of mobile applications as well as few of the future trends in the researched domain.Keywords: Application 's Lifecycle Models, Agile Models, Mobile Environment, Mobile Apps1 Introduction to Mobile ApplicationsMobile applications, also referred to as mobile apps, are software applications that are usually designed to be ran on smart phones and tablet computers [1], The term apps had become extremely popular and, as a consequence, in 2010 was listed as Word of the Year by the American Dialect Society. Mobile applications are available through application distribution platforms, which are managed by mobile operating system developer.There are several major trends that we believe it contributes to the boost of using the today mobile applications:* the increased availability and options to Internet connection for mobile devices;* the shift to the new mobile environments for the business applications;* cloud application's development;* the newest research findings that identifies new technologies which increased the performance of mobile device while the price remained at the same level, allowed mobile devices to became available for a wider variety of users.Another important aspect, when it comes to mobile application development, is the number of users. Thus, the number of mobile worldwide workers in 2013 is over 1 billion and accounts for about 35% of the worldwide workforce. The structure of the above ratio shows that Asia/Pacific (including Japan) have the largest total number of mobile workers, 785 million, while the second place is taken by Western Europe whose mobile workforce reached 129.5 million in 2013 and accounts for about half of the Western European workforce population. The study [2] also highlights that US has the highest percentage of mobile workers in its workforce, with 75.5% by the end 2013 accounting to 119.7 million mobile workers. A quick glimpse to the future is displayed in the two most recent studies which predict that mobile worker population will reach 1.2 billion by 2014 (a VDC study [3]) and 1.3 billion by 2015 (an IDC study [4]).Every day, hundred thousands of mobile devices are sold and about the same number of applications is downloaded. By 2015, International Data Corporation (IDC) predicts [5] that 182.7 billion mobile will be downloaded. That's a 1600 % increase from the 10.7 billion downloaded in 2010. This information highlights the mobile user's appetite for a wide range of software applications.Cloud application development brings innovation [6] to mobile computing as mobile devices use clouds for a wide range of purposes, from data processing and data storage to other intensive data and information transactions. So far, there are few mobile cloud applications (like Google Maps, Gmail for iPhone and Cisco's WebEx on iPad and several others that use Software as a Service model) but the trend is highly increasing.The main purpose of the paper is to present the methodologies for developing classic enterprise application versus mobile applications. …

In article, it is shown that distributed nature the infotelekommunikation of systems and networks, a large number of users in them leads to considerable increase of “bottlenecks” and because of vulnerabilities of these structures. It steadily lowers the level of information security, increases risks of damage or destruction of data, and negatively affects confidentiality of information. Further, the concept of application at the heart of mechanisms of information security of the distributed system of the principles of functioning of immune system of the person as effective remedy of counteraction to different types of threats is considered. This publication is one more step in the direction of discussion of a possibility of creation of the program technical means imitating functioning of biological systems.

Nurses Need Training and Policies to Address Barriers to Use of Mobile Devices and Apps for Direct Patient Care in Hospital Settings

The use of mobile devices by employees to access organizational Information Systems (IS) is common nowadays, and it can be seen from the trend to the formalization of Bring Your Own Device (BYOD) and remote working settings. However, allowing IS resources to be accessed by mobile devices that enable work flexibility across time, location, and network also increased the cybersecurity risk and vulnerabilities towards organizational resources, including network, system, and data. Therefore, this paper presents a systematic literature review on this context to explore the cybersecurity deficiency and mitigating techniques proposed for mobile device risk mitigation in organizational IS. Following the Systematic Literature Review protocol, 31 research articles are selected and reviewed using Thematic Analysis. Three themes were set to classify the output presented by the selected articles according to the context of Security Control, Cybersecurity Pillars, and Information System Management (ISM). This thematic analysis has successfully integrated various terms and narratives. Through analysis, nine security controls have been identified, with the most frequent concern being on Cybersecurity systems and Mobile Device profiling. The authors also discovered that deficiency in the Process factor is mostly discussed compared to the People and Technology factor, which also called for improvement in the ISM Planning phase. This study is beneficial in understanding the organizational cybersecurity deficiency in mitigating the risk of mobile devices and providing a reference for the significant security control in the context of the discussed environment.

The present generation of mobile handheld devices comes equipped with a large number of sensors. The key sensors include the Ambient Light Sensor, Proximity Sensor, Gyroscope, Compass and the Accelerometer. Many mobile applications are driven based on the readings obtained from either one or two of these sensors. However the presence of multiple-sensors will enable the determination of more detailed activities that are carried out by the user of a mobile device, thus enabling smarter mobile applications to be developed that responds more appropriately to user behavior and device usage. In the proposed research we use recent advances in machine learning to fuse together the data obtained from all key sensors of a mobile device. We investigate the possible use of single and ensemble classifier based approaches to identify a mobile device’s behavior in the space it is present. Feature selection algorithms are used to remove non-discriminant features that often lead to poor classifier performance. As the sensor readings are noisy and include a significant proportion of missing values and outliers, we use machine learning based approaches to clean the raw data obtained from the sensors, before use. Based on selected practical case studies, we demonstrate the ability to accurately recognize device behavior based on multi-sensor data fusion.