Unit 3 Assignment 1 User Authentication

We consider the situation where an attacker is already in possession of the smartphone. This scenario is common because the user might forget her smartphone somewhere, i.e., in her office, canteen, etc., or an attacker manages to steal the smartphone (e.g., through pickpocketing, etc). More specifically, we target three scenarios: (i) an attacker accidentally finds the smartphone, (ii) the attacker is victim's friend or colleague (who knows about the implemented mechanism), and (iii) an attacker who tries to mimic the user behaviors (e.g., using recorded video, etc) to unlock the victim's smartphone.

Workplace privacy is one of the biggest issues facing businesses today. Do you feel like you are being watched all the time, all your e-mails being read, and every key stroke is being monitored by your boss? Some people feel this way and that is why privacy in the workplace is a problem with many businesses today. Employees feel like they are not being trusted, or feel the company invades on their personal privacy, or violates their fourth amendment rights. On the other hand many businesses have many federal and state laws to follow, and must keep their assets safe, and their employees. Technology makes communications of all sorts as easy as a few pushes of a button. This technology makes it

Authentication of an individual to access and use files, systems, and screens is vital to

In addition to that, company must develop policies about dealing sensitive data, for users and IT department. Such documents may vary from company to company but there are some important aspects that each of them must include:

The framework of security policy is defined to construct a structure by the help of which policy gaps can be identified in an easy manner. A system specific policy would assist to ensure that all employees and management comply with the policies. This is also used to maintain the confidentiality for user authentication would assist in the confidentiality aspect of security, maintain integrity (There are several limiting rules or constraints which are distinct in the relational data model and whose work is to maintain the data’s accuracy and maintain its integrity.), availability and authenticity of the system. Access controls are a collection of mechanisms that work together to create security architecture to protect the assets of an information system. One of the goals of access control is personal accountability, which is the mechanism that proves someone performed a computer activity at a specific point in time. So, the framework acts as the guideline

Physical security will involve the company securing its assets by devices such as alarm system for off hour use, and identification cards for employees. A process should be in place to make sure that guests are properly identified before gaining assess to the facility. Users cannot take computer home unless they are protected by encryption software. Downloading proprietary information onto floppies, CD, thumb/flash/memory drives and other portable media should be disallowed unless such transactions are pre-approved and proper security measures are taken.

This article gives a synopsis of threats to the mobile devices and the data existing in them and the available defenses. It classifies seven different types of threats on mobile devices and then it discusses about the precautions that can be taken to avoid these threats. It recommends how to prioritize the different threats and defenses.

However mobile devices also represent a significant risk to information security and data security as, if the appropriate security applications and procedures are not applied, they can be a conduit for unauthorized access to the Eastern Widgets’ data and IT infrastructure. This can subsequently lead to data leakage and system infection. Eastern Widgets has a requirement to protect its information assets in order to safeguard its customers, intellectual property and reputation. This policy outlines a set of practices and requirements for the safe use of mobile devices.

The next step option to further prevent this security will involve restricting access to data by requiring a password, personal identification numbers, or a callback procedure. This approach will restrict logon time to a maximum of 2 minutes; if the computer goes idle for 2 minutes, a login password will be required to gain access to the system. The only problem with previous approach will the redundant need to frequently reenter password, to alleviate this problem associated with redundant authentication, the organization can adopt the use of a biometric method of authentication, for example, the use iris scanner, fingerprint, or an electronic signature (Joos et al, 2010).

Current authentication systems suffer from many weaknesses. Textual passwords are commonly used. Users tend to choose meaningful words from dictionaries, which make textual passwords easy to break and vulnerable to dictionary or brute force attacks. Many available graphical passwords have a password space that is less than or equal to the textual password space.Smart cards or tokens can be stolen. Many biometric authentications have been proposed.However, users tend to resist using biometrics because of the intrusiveness and the effect on their privacy. Moreover, biometrics cannot be revoked.

Touch ID is a secure faster and easier fingerprint sense system that provides access to the device. The fingerprinting innovation peruses the data from any edge and acquires each time the user uses the sensor. The fingerprint touch ID makes utilizing a more drawn out, more perplexing passwords much more commonsense considering that fact that clients won’t need to enter it as often. Touch ID additionally beats the bother of a password based bolt, not by supplanting it but rather by safely giving access to the device inside keen limits and time

Therefore, it is essential to address issues like security of the banking transactions that are executed from a distant place and transmitted over the air. Besides this, it is also important to ensure the security of financial transactions, if the device is stolen by hackers. If these concerns are properly addressed, then it would help increase the popularity of mobile banking by instilling a sense of trust among the customers.

As a first line of defense, many organizations enforce ActiveSync policies, preinstalled in most consumer mobile devices, to enforce password protection and remote wipe and lock. More sophisticated IT departments may request the installation of additional mobile device management software agents to extend corporate IT reach into any application and functionality of your device. While security and manageability are legitimate concerns for the company, most BYOD programs rely on IT tools that don’t make a clear separation between personal and corporate data and applications. As a result, in case of unauthorized access a real or presumed situation the whole content of the device is more or less likely to be deleted and the device will be unusable. In regards to privacy, from a legal standpoint the fact that the employee owns the device holds no bearing in the event of litigation. As mentioned earlier regarding discovery, the court may require forensic review of all devices in connection with the litigation. An employee participating in a company’s BYOD program may be asked to produce their personal devices for a third party examination. The employee will have to make any personal information stored in the device accessible. This also includes the history of websites visited; songs and movies download and played copies of financial

Thesis; Along with the efficiency mobile devices render, come along its risks, in which raises substantial security and privacy concerns. It’s important to be aware of the possible threats a mobile can have, along with knowing what and how to secure information, as well as trying to prevent threats from happening.

These papers "Design of Touch Dynamics Based User Authentication with an Adaptive Mechanism on Mobile Phone," by Y. Meng, D. S. Wong, and L.-F. Kwok , and " Continuous Mobile Authentic-cation Using Touchscreen Gestures," by T. Feng, Z. Liu, K.-A. Kwon, W. Shi, B. Carbunar, Y. Jiang, and N. Nguy are compared. The two papers illustrate that touchscreen mobile phones are very popular and used to store sensitive information such as passwords, personal photos and business information [1,2]. Thus, smartphones become valuable places and targets for attacks. Moreover, smartphones are eligible to be stolen and lost which enhances the chance for unauthorized users access to personal, sensitive information [1,2]. Consequently, the Y. Meng et al.