PDF p.269 In progress

Full Device Encryption and External Media

Open PDF at p.269 16 flashcards

Summary

PDF p.269

Modern mobile devices provide full device encryption to protect user data. iOS and Android have different encryption methods and capabilities, with iOS using multiple levels of encryption and Android focusing on file-level encryption. Removable storage on Android devices may also require additional encryption measures.

In plain words

Supplementary — not from your PDF

iOS encrypts all user data, and its Data Protection feature adds a second layer, with keys derived from the user's passcode, as soon as a passcode is set. Android (since version 10) encrypts at the file level by default rather than the full disk. Removable storage such as microSD may not be covered by OS encryption, so limit sensitive data on it or use extra encryption software. A microSD HSM can carry cryptographic keys between devices.

Detailed explanation

PDF p.269

iOS Encryption
- Full Device Encryption: All user data is encrypted, with the key stored on the device.
- Data Protection Option: Provides a second layer of encryption for email and certain apps using a key derived from the user's credential.
- Automatic Enablement: Data Protection encryption is enabled when a password lock is configured.
Android Encryption
- File-Level Encryption: As of Android 10, user data is encrypted at the file level by default.
- No Full Disk Encryption: Full disk encryption is not used due to performance concerns.

Removable Storage

Android Devices: Some support removable storage like Micro SD cards or USB storage devices.
Encryption: Mobile OS encryption software may or may not support removable storage encryption. Third-party software may be needed.
Sensitive Data: Limit storing sensitive data on removable storage.

MicroSD HSM

Hardware Security Module: A small form factor device designed to securely store cryptographic keys.
Usage: Allows cryptographic material to be used with different devices, such as laptops and smartphones.

Important terms

taken from the text above

Full Device Encryption: All user data is encrypted, with the key stored on the device.
Data Protection Option: Provides a second layer of encryption for email and certain apps using a key derived from the user's credential.
Automatic Enablement: Data Protection encryption is enabled when a password lock is configured.
File-Level Encryption: As of Android 10, user data is encrypted at the file level by default.
No Full Disk Encryption: Full disk encryption is not used due to performance concerns.
Android Devices: Some support removable storage like Micro SD cards or USB storage devices.
Encryption: Mobile OS encryption software may or may not support removable storage encryption. Third-party software may be needed.
Sensitive Data: Limit storing sensitive data on removable storage.
Hardware Security Module: A small form factor device designed to securely store cryptographic keys.

Examples & real-world scenarios

Supplementary — not from your PDF

Setting a passcode on an iPhone to enable Data Protection.
Blocking corporate data from being saved to SD cards.
A microSD HSM storing signing keys.

Scenario

An Android tablet stores exported reports on its SD card, which isn't encrypted. An MDM policy blocking corporate data on removable storage closes the gap.

Common mistakes

Supplementary — not from your PDF

Assuming removable storage is encrypted along with the device.
Thinking Android uses full disk encryption today. It's file-based.

Practical skills

Supplementary — not from your PDF

Explain iOS and Android encryption differences.

What I should remember

Key Points PDF p.269

iOS Encryption
- Full Device Encryption: All user data encrypted.
- Data Protection: Second layer of encryption for email and certain apps.
- Automatic Enablement: Enabled with password lock.
Android Encryption
- File-Level Encryption: Default for user data.
- No Full Disk Encryption: Due to performance concerns.
Removable Storage
- Support: Some Android devices support Micro SD cards and USB storage.
- Encryption: May require third-party software.
- Sensitive Data: Limit storage on removable media.
MicroSD HSM
- Secure Storage: Stores cryptographic keys securely.
- Versatility: Usable with multiple devices.