Kenneth van Wyk: Shutting down security gotchas in iOS 6
What to do if you have data on your iPhone or other iOS device that you want to protect
Computerworld - I and many of my fellow iOS users spent some time last week upgrading our iPhones, iPads and/or iPod Touches. If you are among those people, or even if you're one of the cautious souls who decided to wait before downloading iOS 6, you probably want to know what security gotchas await and what you can do to keep from getting burned.
First off -- and admittedly this is true of all iOS devices, not just those upgraded to iOS 6 -- the single most important thing you as a consumer can do to protect your data on your iOS device is to use a strong passcode. (Go to Settings --> General --> Passcode Lock, then "Turn Passcode On" and turn OFF the "Simple Password" toggle.)
While you're on that Passcode Lock screen, you might also want to tweak the Require Passcode setting by selecting a brief period of time before the device locks itself. "Brief" can be as short as "immediate." The downside is that you have to enter your passcode every time you let your device rest a bit. It's a trade-off between convenience and security. I suggest going with as short a time period as you can stand. Start short, then turn it up a bit if it really annoys you.
Why does this matter? Why isn't a four-digit PIN adequate? Because a lost or stolen device with a weak passcode puts all the data stored on the device at risk, as well as anything on iCloud or other network services you use.
And the passcode isn't just for locking and unlocking the device. It is used as part of the encryption key for data on the device (such as your email and app data that has "full protection"). If you use a simple PIN, an attacker won't have a hard time breaking that encryption and getting to your most sensitive stuff.
Of course, using a real passcode can be massively annoying. I use passcodes on my own iOS devices, and I'm not going to pretend it's never annoying. But that annoyance is nothing compared to the pain of having your data compromised. If the data on your device matters to you, there is no better single thing you can do as a consumer to protect it (other than not having the data on the device in the first place).
I also recommend turning off access to Siri and Passbook when your device is locked. This will prevent an attacker from getting into a lot of your data; if Siri can be accessed from a locked device, then an attacker could just say, "Siri, what appointments do I have today?" for example. I write more about Passbook below, but if you're using it for anything important (such as payments or boarding passes), this setting will prevent an attacker from getting access to that data when the device is locked. Note that these are not the default settings, so you need to change them if you want to lock attackers out in this way. (Both of these things can be done on the Passcode Lock screen of General Settings.)
More by Kenneth van Wyk
- Kenneth van Wyk: Apple's big fail
- Kenneth van Wyk: After Snowden
- Kenneth van Wyk: Target breach underscores how backward U.S. payment tech is
- Kenneth van Wyk: Enjoy your trip, but protect the data you take with you
- Kenneth van Wyk: Lingering faults with security by default
- Kenneth van Wyk: High hopes for iPhone's Touch ID
- Kenneth van Wyk: Why mobile apps beat Web apps for privacy
- Bug bounties: Bad dog! Have a treat!
- How to avoid Big Brother's gaze
- The true root causes of software security failures
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts