Secure Mobile Business Information Processing

Abstract

Abstract-An ever increasing amount of functionality is incorporated into mobile phones-this trend will continue as new mobile phone platforms are more widely used such as the iPhone or Android. Along with this trend, however, new risks arise, especially for enterprises using mobile phones for security-critical applications such as business intelligence (BI). Although platforms like Android have implemented sophisticated security mechanisms, security holes have been reported [9]. In addition, different stakeholders have access to mobile phones such as different enterprises, service providers, operators, or manufacturers. In order to protect security-critical business applications, a trustworthy mobile phone platform is needed. Starting with typical attack scenarios, we describe a security architecture for Android mobile phones based on the concepts of Trusted Computing. In particular, this architecture allows for a dynamic policy change to reflect the current environment the phone is being used in.

Mobile Business Intelligence: Key Considerations for Implementations Projects

“…Kuntze et al [28] devoted a full study to the information security aspect of mobile BI and state that an attacker may have two goals for an attack: To gain unauthorized access to company data (industrial espionage) or to manipulate BI data (sabotage). Hence, it is neither advisable nor feasible to make all BI content mobile [38].…”

“…An additional constraint is that different stakeholders (including network operators, service providers) have influence on the operations of the device. Kuntze et al [28] provides nine nonexhaustive but common attack scenarios for mobile BI applications. He also introduces a set of rules that must be introduced in order to address these security treats.…”

State-of-the-Art Review and Critical Success Factors for Mobile Business Intelligence

“…McCalister (2012), Arnott (2008), Wixom and Watson (2001) (Kuntze et al, 2010). Security of wireless data transmission from BI server to mobile devices is a major concern, especially when the users are on a public network, because intruders could easily attack the Virtual Private Network (VPN) via interconnected nodes (Deepak et al, 2012).…”

Using static analysis for automatic assessment and mitigation of unwanted and malicious activities within Android applications

“…Ongtang et al [6] aim at the upper levels of Android application stack and describe modifications to its high-level security system to allow dynamic permission management. A more business-oriented approach is presented by Kuntze et al [5], including usage of a trusted computing platform as a basis for an enterprise-grade secure smartphone based on Android. While creating a fork of Android for a specific purpose remains feasible, the history of large and frequent updates to Google's official source mainline 1 has shown that maintaining an own development branch is a tedious and costly task.…”