Study into the Implications of Smartphone Operating System Security

Study into the implications of Smartphone operating system security
Summary and Recommendations
Smartphones have become the remote control for our digital and non-digital lives, replacing
desktop computers, notebooks and even TVs and personal music players. As such, they are
subject to the same threats that have affected consumers for many years.
These threats are controlled by legislation and governed by bodies that have been assigned
responsibility to govern them.
Governing bodies need to understand the nature of these threats. Many of the current
threats are old ones adapted for Smartphones, e.g. Dialler fraud.
There are threats that are either unique to the Smartphone or are amplified as a result of the
characteristics of the Smartphone. A Smartphone is more likely to be lost and stolen and
when it gets into the hands of unauthorised users more likely to be poorly protected by either
no passcodes or weak ones.
From table 7.1 above, we have identified the current Smartphone security risks and matched
them against relevant legislation and the bodies responsible for governing them.
Goode Intelligence believes that current legislation should be sufficient in dealing with
current Smartphone security issues. There does not seem to be any major holes in current
legislation that could result in a disparity between the technology and the governing
framework.
However, this must be constantly reviewed in light of emerging, sometimes disruptive,
technology that could alter the effectiveness of regulation and legislation.
Related to legislation is education (engagement) and enforcement; educating affective
parties as to the nature of legislation by engaging with all parts of the ecosystem and
enforcement once there has been a breach (either intentional or unintentional).
Recommendations
Goode Intelligence recommends the following:
1. Creation of a cross-regulatory working party to discuss potential issues and gaps in
protecting Smartphones, and their associated services. This study could act as the
initial reference point for such a group.
2. Review of Smartphone security risks against UK legislation to determine:
a. UK legislation related to particular security risk
b. UK regulatory that is responsible for particular security risk
c. Gaps
d. Action plan to manage security risks
Goode Intelligence © 2013 P a g e | 112 www.goodeintelligence.com