ENISA Information security risks, opportunities and recommendations for users

　こんにちは、丸山満彦です。会社の同僚に教えられていたENISAのスマートフォンのセキュリティ関係の資料、斜め読みのまま放置されていましたが、やっと読み終わりました。。。VIDEOも聴きました。。。

　
■ENISA
・2010.10.12 Security in smartphones: risk, opportunities & recommendations - new report launched.
　●REPORT

・2010.10.12 New video on smartphones security released.
　●VIDEO

報告書の目次
＝＝＝＝＝
Table of contents
1. Introduction
2. Information security risks
3. Information security opportunities
4. Information security recommendations
5. Conclusions
6. Appendix: Vulnerabilities
7. References to other related best practice guides
Bibliography
＝＝＝＝＝

Exective Summaryでリスクについては、次のようにまとめていますね。。。
＝＝＝＝＝
 R1 Data leakage: a stolen or lost phone with unprotected memory allows an attacker to access the data on it.
 R2 Improper decommissioning: the phone is disposed of or transferred to another user without removing sensitive data, allowing an attacker to access the data on it.
 R3 Unintentional data disclosure: most apps have privacy settings but many users are unaware (or do not recall) that the data is being transmitted, let alone know of the existence of the settings to prevent this.
 R4 Phishing: an attacker collects user credentials (e.g. passwords, creditcard numbers) using fake apps or (sms,email) messages that seem genuine.
 R5 Spyware: the smartphone has spyware installed allowing an attacker to access or infer personal data. NB spyware includes any software requesting and abusing excessive privilege requests. It does not include targeted surveillance software (R7).
 R6 Network spoofing attacks: an attacker deploys a rogue network access point and users connect to it. The attacker subsequently intercepts the user communication to carry out further attacks such as phishing.
 R7 Surveillance: spying on an individual with a targeted user’s smartphone.
 R8 Diallerware: an attacker steals money from the user by means of malware that makes hidden use of premium sms services or numbers.
 R9 Financial malware: malware specifically designed for stealing credit card numbers, online banking credentials or subverting online banking or ecommerce transactions.
 R10 Network congestion: network resource overload due to smartphone usage leading to network unavailability for the end-user.
＝＝＝＝＝

当然ですが、計算処理機器にソフトウェアがのっかったものがインターネットに接続されているという構造を考えれば、PCの時と同じ話になりますね。。。

　問題は、PCと比較したときに脅威と脆弱性、対策の強さがあるのかということだと思います。しかも、それは日々変化しています。。。