2. Who owns your phone?
Who feels that they have the right to use your phone for their purposes or on your behalf?

3. Your Phone Code Data OS Activity Micro-phone Battery Peripherals
Competitors
Your Phone
Code
Data
Application Authors
Your Keeper OS
Activity
Phone Company
Your Employer
Camera
Micro-phone
Network
Location
Battery
Law Enforcement
Hardware Manufacture
Peripherals
Identity
Mal
OS Author

4. IOS Security Architecture
All apps must signed by Apple
To reduce malicious code
Quick erase of key store
Prevents data access, permanently
Backups use different keys
Firmware non-readable key (UID)
To prevent cloning

5. IOS Security Architecture
Signed Applications
Data
Library/Device
Permissions
File Keys
Signed OS
File Metadata
Class Keys
Effaceable Storage
Boot Loader
Phone UID
Firmware
Apple Root Certificate

6. Android Security Architecture
Linux file system permissions model
All apps must be signed
Apps run in their own user space
“eXecute Never” markings
Device resource permissions
Confirmed on install
Accept all or go away

7. BYOD
Can one device make your kids happy and let IT security sleep nights?
Being pushed by Apple
With root, all security arrangements are subvertable (futile?)
Several venders (e.g. Good) propose walled gardens

8. HTML5 Security OWASP Top Ten SSL Iframe sandbox
Cross Site Scripting (XSS)
More opportunities in HTML5
Validate ALL input
Make sure data is data and not executable!
SSL
Secured channel (privacy issues)
Server authentication
Post vs Get
Iframe sandbox
Hybrid mobile/web applications
Server access to native phone features

9. References IOS Security Architecture Anroid Security Architecture
Anroid Security Architecture
OWASP

10. Thank You
Robert Klerer
ListYourself.net inc.