Mobile Computing A look at concepts, problems, and solutions Sam Johnson, Nick Twilley, Tianyi Zhang, Zhanni Zhou, & Suijun Wu ABSTRACT The primary focus of this paper is the concept of mobile computing. Discussed within are the concepts of short messaging services, mobile commerce, and mobile banking as they relate to mobile computing. Selected security risks associated with mobile computing are discussed within this paper, while methods of mobile device deployment are also discussed. Table of Contents Introduction .......................................................................................................................... 3 Mobile Computing Defined........................................................................................................................................................3 Mobile Computing Devices Defined.......................................................................................................................................3 Mobile Computing History ........................................................................................................................................................3 Mobile Computing Advantages and Threats ....................................................................................................................4 Mobile Computing and the Related Security Concerns ........................................................... 4 Technologies Associated with Mitigating Risk ................................................................................................................4 Mobile Computing Device Deployment Methods ............................................................................................................5 Short Messaging Services (SMS) Defined ................................................................................ 6 Threats to Short Messaging Services............................................................................................................................... 6 Data Privacy ....................................................................................................................................................................................6 SMS Initiated Phone Crashes ...................................................................................................................................................6 Viruses ................................................................................................................................................................................................6 Phishing .............................................................................................................................................................................................7 Short Messaging Services (SMS) Conclusion................................................................................................................ 7 Mobile Commerce ................................................................................................................. 7 Generations of Mobile Commerce ..........................................................................................................................................7 Mobile Commerce Shopping .....................................................................................................................................................8 Mobile Banking ..................................................................................................................... 8 Mobile Banking Platforms.........................................................................................................................................................9 Future of Mobile Banking ..........................................................................................................................................................9 Appendix............................................................................................................................. 11 Works Cited......................................................................................................................... 13 2 Introduction Estimates suggest that in roughly five years the number of mobile computing devices will be about 10 billion, or 1.5 for every single person on the planet (Ernst & Young “Bring” 1). The field of mobile computing is becoming more and more prevalent throughout our daily lives. This can be seen from the increase in the number of smartphone users from 114 million to 250 million in just the one-year period between 2012 and 2013 (Okoye). Additionally, according to Okoye’s research, 78% of adults within the United States own a smartphone. Today, almost every single person utilizes mobile computing in some shape or form. However, business professionals all over the world have been utilizing mobile computing as an integral part of their daily activities for a number of years. Through the use of mobile computing individuals are able to be in constant connection to the Internet, which has significantly changed the way people do things (“Mobile Computing: A Study” 3). However, because of the quickly changing environment of mobile computing technology, the risks associated with mobile computing are constantly growing and changing. They key objectives of this paper are to define and analyze some of the major security issues related to mobile computing from an organizational standpoint, while also defining mobile commerce, mobile banking, and short message services (SMS) from the perspective of an individual user, and how these particular aspects of mobile computing relate to the organizational security issues. Mobile Computing Defined Mobile computing, or what is sometimes referred to as nomadic computing, is defined as the use of transportable computing devices with mobile communication technologies (Rouse). Mobile computing is a technology that allows for the transmission of data, voice, and video via a computer or any other wireless enabled device without having to be connected to a fixed physical link (Livingston). Mobile computing utilizes a number of different methods to connect to a network. Some of these methods include, Internet, intranet, WAN, LAN, WLAN, and a number of other related methods. Mobile Computing Devices Defined The Information Systems Audit and Control Association’s (ISACA) white paper from 2010 on Securing Mobile Devices, defines the following seven types of items as mobile computing devices: 1. Smartphones (i.e. iPhone) 2. Laptops (portable computers) 3. Tablet Computers (i.e. iPad) 4. Portable Digital Assistants (PDAs) 5. Portable USB Storage Devices (portable universal serial bus storage devices) 6. Radio and Mobile Frequency Identification Devices (RFID) 7. Infrared-Enabled Devices (IrDA) Mobile Computing History In 1894, Guglielmo Marconi, the father of radio, was the first person to person to produce radio waves over long distances, which marks the beginning of both wireless and mobile computing technology. The first wireless network was completed in Germany in 1958. In 1983, he entered the mobile computing industry with Motorola’s invention of the world’s first personal cellular telephone (Livingston). This invention simultaneously marked the creation of the commercial cellular service market. The first 113 years of the history of mobile computing saw a steady 3 stream of key events (refer to Appendix A for additional information). The mobile computing industry has seen an exponential growth occur within the last seven years (refer to Appendix B for additional information). The beginning of this exponential growth can primarily be attributed to the release of the iPhone and the mobile operating system iOS by Apple in January 2007. Mobile Computing Advantages and Threats There are a number of advantages associated with mobile computing including the ability for users to connect to the Internet anywhere and at anytime. An additional advantage of mobile computing is that it provides the ability to bring mobile communications to remote areas without any pre-existing infrastructure at a low cost (“Mobile Computing: A Study” 4). However, despite the numerous advantages, there are a number of threats faced by mobile computing. These threats include limitations associated with range and bandwidth issues, security issues, transmission interferences, power assumptions, as well as a number of other related items (Chapungu). The primary limitations associated with range and bandwidth can be attributed to the fact that the networks accessible by mobile computing devices are generally constrained to a range of commercial cell phone towers. However, according to Chapungu, the major threat associated with mobile computing is related to security issues, which are discussed in greater detail within this paper. Typical applications of mobile computing and the related security issues will be introduced and discussed within this paper. Mobile Computing and the Related Security Concerns The use of mobile computing is increasingly becoming an integral part of the framework of our daily lives. For the purposes of this paper the primary focus will be on the incorporation of a mobile computing framework into an information technology (IT) infrastructure from an organizational standpoint, and then the related technologies involved within mobile computing from an individual’s perspective. Technologies Associated with Mitigating Risk After the decision has been made to incorporate mobile computing into an organization’s IT infrastructure, the new security risks related to this implementation must be properly addressed. The two primary technologies that are being used by the majority of companies as well as CPA firms to alleviate the risks associated with mobile computing includes automated wireless security management systems (WSMS) for larger organizations, and thin computing for smaller organizations. From an organizational standpoint, “the primary benefit of automated WSMSs and thin computing is the ability to consistently enforce security controls at the point of use (Aldhizer 60).” The implementation costs associated with these two technologies can vary greatly, with the implementation of an automated WSMS involving the purchase of expensive software, while thin computing is a much more cost effective solution. There are a number of reasons as to why thin computing is considered to be such a cost effective solution. These reasons include the fact that “thin mobile devices have little or no operating systems, they can not store data, and the devices generally only have enough computing power to access the internal network where the applications and data needed by remote users are stored (Aldhizer 60).” Another benefit of thin computing is that all of the associated applications and data are stored on a central server controlled by the organization. Additionally, smaller organizations can benefit from the use of thin computing due to the fact that thin computing devices crash less frequently and linking them to internal networks 4 is generally considered to be less complex. While thin computing is better suited to smaller organizations, larger organizations should consider implementing automated WSMS systems due to the fact that they can be customized to fit the unique needs of the organization. The initial steps for the implementation of an automated WSMS system involve the organization conducting a feasibility study, which is immediately followed by management rallying key stakeholders in order to reach a consensus concerning the most sensitive data that needs to be protected. One of the primary benefits of an automated WSMS is that “if a user is in the process of violating the organization’s security policy, the WSMS can automatically shut down the procedure and send an alert to management for immediate investigation (Aldhizer 60).” Mobile Computing Device Deployment Methods After the organization has chosen a technology to implement in order to alleviate the risks associated with mobile device computing, the organization must choose a mobile device deployment method as well. Although there are a number of different mobile device deployment methods, the majority of organizations within the United States are primarily using Bring Your Own Device Deployment (BYOD). The concept of a BYOD mobile computing system involves a company’s employees using their own personal mobile devices for company related activities, while still being able to simultaneously use the devices for their own personal wants and needs. According to L. Gary Boomer, “BYOD policies make employees happier”, while Amy Vetter adds; “employers that oppose the trend are fighting a losing battle that could result in employees’ leaving” (Drew). The risk landscape associated with BYOD mobile device deployment is dependent on what can be narrowed down to three key factors; “the organization’s risk profile, current (and future) mobile use cases, and lastly the geographic deployment of the devices” (Ernst & Young Bring). For the first factor, the organization’s risk profile, the definition, as well as the treatment of risks, by the organization plays a crucial role in the identification of the proper security controls to employ. The second factor, current (and future) mobile use cases, is crucial primarily due to the fact that there is not a “one size fits all” use case. Finally, the third factor, the geographic deployment of the devices, is important due to the laws and regulations related to privacy concerns from an international standpoint. Moving forward in the process of conducting a mobile device configuration review audit from a BYOD perspective the associated risk factors are divided amongst three areas, “securing mobile devices, addressing app risk, and managing the mobile environment” (Ernst & Young Bring). A BYOD system is easily implemented, and a BYOD policy usually addresses ten general areas. These areas include, general security requirements for mobile devices, authentication (passcode/PIN) requirements, storage/transmission encryption requirements, requirements to automatically wipe devices after a number of failed login attempts, usage restrictions for mobile devices, company liability, rights to monitor, manage, and wipe, support model, leading practices for mobile data usage on international travel, acceptable use (if different from the normal acceptable use policy). Additionally, the process of securing and improving the BYOD system involves a series of eight steps. These steps include, creating a strategy for BYOD with a business case and a goal statement, involving stakeholders early through the formation of a mobility group, creating a support and operations model, analyzing the risk, creating a BYOD policy that adheres to the requirements previously discussed, securing devices and apps, testing and verifying the security of the implementation, and lastly measuring the success, ROI, and roll-forward lessons learned. Lastly the hidden service costs associated with BYOD include, user device control, users’ expectations relating the support of BYOD, costs 5 associated with request fulfillment, and the additional costs associated with the training of service desk staff (Ernst & Young Bring). Short Messaging Services (SMS) Defined Short Messaging Services, commonly referred to as SMS, are a prevalent way for people to communicate not only because of its cost effectiveness, but because it is very convenient and time saving. Thanks to the inventions of more powerful PDA style mobile devices with touch screens and advanced mobile operating systems, such as Android and iOS, the use of SMS has become increasingly more widespread and user-friendly. With advanced SMS style applications on mobile devices such as WeChat, Whatsapp, Twitter, and iMessage, people can send and receive not only short messages, but also pictures and videos in real time,. With its advantages mentioned above, many organizations, governments and companies use SMS for internal communications as well. Thus the security of short messaging services for them is very crucial. Before talking about the security threats to SMS, we will take a look at the operation of SMS. The main functions of the short message service are to store and forward messages. Messages at first are received from the sender and then are stored in the central server message center, after that, they are forwarded to receiver. If mobile phones are turned off, messages will not be sent immediately, so to make sure the message could finally be sent to the recipient in the end, enough storage is necessary (Androulidakis 65). Threats to Short Messaging Services Data Privacy Data privacy threats exist due to the insecure nature of protocol. Apart from that, since encryptions are not applicable to most text and voice messages, they are easy to be intercepted during message transmission and could be amended by unauthorized parties after they reach the data storing center. Intercepted messages not only could reveal information about how the SMS is implemented, but could enable the attacker to gain access for other type of attacks (Lundeen). SMS Initiated Phone Crashes Sometimes attackers do not need to intercept the messages one sends, they can instead spend a few minutes accessing a mobile device and installing malware on it (Androulidakis 65). Once a mobile devices is impacted by the malware, the malware, can cause damage such as disrupting mobile devices operation, gathering sensitive information, and gaining access to private mobile device systems, thus mobile devices crashes will happen (Chebyshev). Viruses A virus infecting short message services directly seems unlikely, but this is sure to happen thanks to the more powerful, computer-like mobile devices such as iPhone, iPad, Surface, and Android based mobile devices. More importantly, the SIM application toolkits have the ability to allow applications access to the dialing functions and phone book entries to make viruses spread with message sending (The Government of the Hong Kong Special Administrative Region). Many viruses are now designed for mobile devices. Once targeted viruses affect the mobile device, the data and the information stored in the device will suffer. 6 Phishing Currently many mobile devices can offer users the ability to check their e-mail status. Although this technology provides user convenience, there are problems that have arised. Just as a phishing email seen when checking personal email, the same thing could happen when checking activities on a mobile devices. Phishing is defined as “unauthorized acquiring personal information such as usernames, passwords, and credit card records by pretending to be an authentic party (Phishing).” When a user clicks a link provided by the phishing mail, they may be connected to a website provided by the phishing mail and be tricked to download malware onto their devices. Short Messaging Services (SMS) Conclusion Although short messaging services can provide a more convenient and inexpensive way for users to contact each other, it still has many security issues, which is a huge problem when the sensitive information of a credit card is stolen when online shopping or banking with a mobile device. The next sections will discuss some mobile computing issues of mobile commerce and mobile banking. Mobile Commerce The concept of electronic commerce, which is the trading products or services using computer networks, is particularly well suited for use within mobile computing. Mobile commerce, a branch of electronic commerce, refers to the transmission of data through wireless technology. It includes the use of mobile information terminals to participate in various business activities, which is a new kind of an e-commerce capability under the new technology and market environment. As the world of technology develops steadily, an increasing number of mobile devices lead to innovation, playing an important role in mobile commerce. The inventions and popularization of personal digital assistants (PDAs) and smartphones promote more businesses to use this technology as an effective method to communicate with their clients directly (Martin). Generations of Mobile Commerce Along with the rapid progress of mobile communication technology, the evolution of mobile commerce has gone through three generations. The first generation of mobile commerce brought access technology based on SMS. The first two cell phones involved in mobile commerce authorized Coca-Cola to build vending machines in Finland in 1997 for payment through SMS text message (Nawab). Poor real-time performance and size limitations created the need for innovation. The second generation of mobile commerce adopted a method based upon Wireless Application Protocol (WAP) technology so mobile phones could access the WAP web pages via browser to search information just as a PC would. As Russ Housley, the current chair of the Internet Architecture Board, mentioned, “WAP is an open global specification for providing Internet communications and advanced service to mobile users with wireless devices (Paro).” This new technology partially solved the problems of the first generation of mobile commerce with the capabilities of the internet. However, a disadvantage of the second generation mainly manifested itself in encryption. This is primarily due to the fact that the encryption authentication of Wireless Transport Layer Security protocol establishes a secure channel, which must be terminated within the WAP gateway that could potentially cause a number of security threats. The needs of customers were not met as a result of the WAP web access security issues (Paro). 7 The current generation of mobile commerce uses a web service built on Service Oriented Architecture (SOA), smart mobile terminals, and mobile Virtual Private Network (VPN) technology to greatly improve the system’s security and interactive ability. This generation provides e-commerce personnel a safe and modern mobile business office founded on the private network and wireless communication environment. This technology is widely used around the world and offers a more efficient and effective platform to do business via mobile devices (Newab). Mobile Commerce Shopping There are two areas of mobile commerce that are widely applied in our daily lives; Web Storefronts and Virtual Shops. Web Storefronts restrict one seller to market and sell products and services on the Internet. Customers around the world search the products and services they desire from online catalogs, which show the price, feature, recommendations, etc. Items are then added to a virtual shopping cart and rely on various forms of online banking as payment. The online market is by design more effective and efficient than a real-world shopping environment because consumers are able to compare products and services from different suppliers to find a bargain. Virtual Shops are similar to Web Storefronts but without the one seller limitation (Umar). For example, Amazon allows customers to purchase products from different sellers, bundle the products together in a single sale, and ship to their home addresses. The big issue for mobile commerce stems from the need to make quick, easy and safe transactions over the Internet. Customers want fast service and an interface that organizes their purchases/sales. However, what customers most care about is their money being safe online. An increasing number of resources have been invested in protecting data on internal networks with the use of firewalls, intrusion prevention software, and intrusion-detection software (Aldhizer 59). According to the Ponemon Institute’s 2014 cost of data breach study, the total average cost paid by organizations was $5.9 million in the last year (2014 Cost of Data Breach Study). Companies spend time and money because they cannot risk losing money of their customers, or of their own. Banks have a large presence on the internet due in large part for the need of accessible virtual money for mobile commerce. Mobile banking allows customers to manage their money virtually, in a safe and effective manner, for various types of transactions on a series of devices and platforms. Mobile Banking Mobile banking is growing exponentially each year as customers become more familiar and less threatened. Gemalto, a world leader in digital security, defines mobile banking as “enabling secure access to banking services on the mobile device (“Mobile Banking”).” Due to the surge of alternative technologies and the expanding marketplace that is mobile commerce, consumer usage is increasing. Gemalto also explains the benefits of mobile banking from a bank’s point of view; “Mobile banking helps banks create a compelling and satisfying online customer experience, driving increased interaction and sales over the mobile phone, and reducing operational costs (“Mobile Banking”).” Now that technology and consumer confidence in mobile banking has increased, it seems mobile banking is here to stay. Mobile banking is a significant advance in the banking industry, but how does it work? 8 Banks’ classify their mobile financial services based on how the information flows. A pull transaction is when a mobile user actively requests something from a bank, and a push transaction is when a bank will send information based on a specific set of rules (Harris 2). Examples of pull transactions are bill payments, funds transfers, account balance inquiries and transaction history. Examples of push transactions are minimum balance alerts, bill payment alerts, and credit/debit alerts. These information flows are the foundation of device communication within mobile banking (Harris 2). Mobile Banking Platforms There are two main platforms on which to do mobile banking. First, a basic platform uses SMS and voice recognition software. This platform is based on simple input/output interaction where the bank’s system will text or read to you an inquiry for which the user has to respond with an input. The system provides a response to each step of this process with a corresponding output based on the user requests. This platform has many advantages with the biggest being that it works on almost every cell phone regardless of its level of technology. One disadvantage is not giving the user an interface to actually see everything, which is a big deal in this technological age. Other disadvantages are created by the inherent risks that come with calling and texting, such as poor service or the fact that there is no guarantee a text will be delivered to the recipient (Harris 3). The second, now more prevalent platform on which to do mobile banking is with an internet-based advanced platform. Almost every bank has an app now as many people move towards smart phones and tablets and virtually everyone has some access to the internet. The two approaches for setting up this type of mobile banking are Wireless Application Protocol (WAP) and standalone mobile application (Harris 3). WAP is the equivalent of accessing Internet pages on a mobile device. These are pages setup for a PC, but they are accessible to mobile devices the same way as they are to computers based on concepts of browsers, servers, URLs and gateways. An advantage of this approach is that users can use web pages they are familiar with using on their computers, and they do not have to download anything, such as an app. A major disadvantage is that mobile devices lack the same level of antivirus and personal firewall protection than a standard personal computer. The constant switching of wireless Internets gives a mobile device exposure to potentially dangerous networks (Harris 4). The second approach for internet-based mobile banking consists of standalone mobile applications. This requires users to download apps, which are extremely user friendly and allow banks to customize and brand the pages to their liking. This approach is widely regarded as the future of mobile banking. A disadvantage is an app needs the capability to be customized on each phone, greatly increasing development costs. These applications can also be vulnerable to attacks if not protected effectively (Harris 4). Future of Mobile Banking Overall mobile banking has a bright future, but as new technologies that handle money arise, so do instances of cyber-fraud. According to RT News “Android users faced six times as many cyberattacks this year than last, according to a new study. Hackers targeted 588,000 mobile users worldwide between August 2013 and July 2014 (“Mobile cyber-attacks”).” Of those attacks about 60% of the malware found on mobile devices was designed to steal banking details or money 9 (“Mobile cyber-attacks”). As fraudsters are starting to focus more on the mobile banking market this number will likely increase, but so will new technologies to combat these cyber-attacks. There are many directions mobile banking could go in the future, but the most prevalent seems to be with digital wallet technology. There is already technology for this on the iPhone 6 through “Apple Pay”. Apple has partnerships with many of the major banks to handle credit card transactions through their smartphones. Through security measures such as passwords and fingerprint scanners, many customers are comfortable enough to use digital wallets (Baig). This will be a new trend to keep in mind, and there are sure to be more mobile banking technologies created in the future. 10 Appendix Appendix A: Mobile Computing Timeline of Key Events from 1894 through 1983 (Livingston) ................................................................................................................................................ 11 Appendix B: Mobile Computing Timeline of Key Events from 2007 through 2010 (Ernst & Young “Mobile”) ........................................................................................................................................ 12 Appendix A: Mobile Computing Timeline of Key Events from 1894 through 1983 (Livingston) 11 Appendix B: Mobile Computing Timeline of Key Events from 2007 through 2010 (Ernst & Young “Mobile”) 12 Works Cited Aldhizer, George R., III, and John R. Bowles, Jr. "Mitigating the Growing Threat to Sensitive Data: 21st Century Mobile Devices." The CPA Journal LXXXI.5 (2011): 58-63. Web. 30 Nov. 2014. Baig, Edward. "Apple Pay: The Promise, Challenges Facing Digital Wallets." Detroit Free Press n.d.: n. pag. Detroit Free Press. 3 Oct. 2014. Web. 30 Nov. 2014 Chapungu, George. "Limitations of Mobile Computing." Web log post.Wells Digest. N.p., 1 Aug. 2013. Web. 30 Nov. 2014. Chebyshev, Victor, and Roman Unuchek. "Mobile Malware Evolution: 2013." SECURELIST. Kaspersky Lab, 24 Feb. 2013. Web. 30 Nov. 2014. Constantin, Lucian. "Security Analysis of Mobile Banking Apps Reveals Significant Weaknesses." PCWorld. IDG Consumer & SMB, 9 Jan. 2014. Web. 30 Nov. 2014. Drew, Jeff. "Technology and CPAs: Visions of the Future." Journal of Accountancy. AICPA, June 2012. Web. 30 Nov. 2014. Ernst & Young. Bring Your Own Device: Security and Risk Considerations for Your Mobile Device Program. Publication no. AU 1850. N.p.: EYGM, 2012. Print. Insights on Governance, Risk, and Compliance Collection. Ernst & Young. Mobile Device Security: Understanding Vulnerabilities and Managing Risks. Publication no. AU1070. N.p.: EYGM, 2012. Print. Insights on Governance, Risk, and Compliance Collection. Harris, William. "How Mobile Banking Works - HowStuffWorks."HowStuffWorks. InfoSpace LLC, n.d. Web. 30 Nov. 2014. Livingston, David. "Introduction & History of Mobile Computing."Slideshare. Linkedin Corporation, 5 Dec. 2013. Web. 30 Nov. 2014. Lundeen, Daniel. A Brief Discussion about Security Issues in the SMS World. Rep. N.p., n.d. Web. 30 Nov. 2014. Martin, James. "Mobile Computing: PDAs vs. Smart Phones." TechHive. N.p., 26 Aug. 2004. Web. 30 Nov. 2014. "Mobile Banking." Gemalto. N.p., n.d. Web. 30 Nov. 2014. <http://www.gemalto.com/financial/mobile-security/mobile-banking>. 13 Mobile Computing: A Study of Internal Auditors’ Awareness. Rep. Dallas Chapter Institute of Internal Auditors, 2013. Web. 30 Nov. 2014. "Mobile Cyber-attacks Surge as Hackers Chase Banking Info." RT News. TV-Novosti, 22 Oct. 2014. Web. 30 Nov. 2014. Newab, Ahmad. Mobile Commerce. Rep. Academia.edu, n.d. Web. 30 Nov. 2014. Okoye, John. "How Mobile Computing Changed Business Strategy."Techopedia. Janalta Interactive Inc., 19 Sept. 2013. Web. 30 Nov. 2014. Paro, Dwayne. WIRELESS APPLICATION PROTOCOL. Rep. SANS Institute, n.d. Web. 30 Nov. 2014. "Phishing." TechTerms. N.p., n.d. Web. 30 Nov. 2014. Rouse, Margaret. "Nomadic Computing (mobile Computing)." TechTarget. N.p., May 2007. Web. 30 Nov. 2014. SHORT MESSAGE SERVICE SECURITY. Rep. The Government of the Hong Kong Special Administrative Region, Feb. 2008. Web. 1 Dec. 2014. Androulidakis. "SMS Security Issues." Mobile Phone Security and Forensics a Practical Approach. New York: Springer, 2012. 65. Print. Umar A. (P18-20). Mobile Computing and Wireless Communication. NGE Solutions. 2014 Cost of Data Breach Study: United States. Rep. Ponemon Institute, May 2014. Web. 30 Nov. 2014. 14