Research question and Annotated Bibiliogrpahy-5 Pages Due in 15 hours.

ww.sciencedirect.com

j o u r n a l o f i n f o r m a t i o n s e c u r i t y a n d a p p l i c a t i o n s 2 0 ( 2 0 1 5 ) 8 4 e8 9

Available online at w

ScienceDirect

journal homepage: www.elsevier.com/locate/jisa

Safe use of mobile devices arises from knowing the threats

Bla�z Markelj*, Igor Bernik

University of Maribor, Faculty of Criminal Justice and Security, Information Security Department, Kotnikova 8,

1000 Ljubljana, Slovenia

a r t i c l e i n f o

Article history:

Available online 7 December 2014

Keywords:

Mobile devices

Cybersecurity

Threats

Users

* Corresponding author. E-mail addresses: [email protected]

1 Mobile devices mostly include devices w and are portable (mobile phones, tablets, etc laptops, portable gaming consoles, industria intended solely for phone calls and sending which offers a whole range of additional f networks. http://dx.doi.org/10.1016/j.jisa.2014.11.001 2214-2126/© 2014 Elsevier Ltd. All rights rese

a b s t r a c t

Today, the safe use of mobile devices is a prerequisite for successful and transparent work,

both on a personal and business level. The study presented in this paper shows that work

safety in cyberspace depends on the users' knowledge of threats and their appropriate

response to them. Based on the results, it has been established that user awareness should

be raised, users should be informed of threats and undergo suitable education on work

safety in cyberspace.

© 2014 Elsevier Ltd. All rights reserved.

1. Introduction

The information technology is an important factor in the way

an individual works and lives. Due to the fast development of

information technology, information is becoming increasingly

accessible to each individual and plays an ever more impor-

tant role in the decision making process. Non-stop access

(unlimited and uninterrupted) to information is important.

This is made possible by the information technology e to be

precise, by the advanced mobile networks and mobile de-

vices.1 The latter enable individual users to have an unfor-

gettable user experience by means of mobile networks and

diverse software. People use mobile devices, among which

smart phones have been on the rise over the last period, for

gaining mobile access to cyberspace. According to research

conducted by IDC (2011), the global sales of smart mobile

b.si (B. Markelj), igor.ber ith an adapted operation .). This category can incl l readers, etc.). On the ot short messages and sma unctions, similar to tho

rved.

phones have been increasing by 55 percent on an annual

basis. The IDC report (2014) showing the sales of smart mobile

phones (as part of the mobile devices' group) indicates that the sales of such devices exceeded one billion items in 2013 alone.

The sales of other mobile devices (pads, e-watches, etc.) follow

the same trend.

Mobile devices represent an increasingly important factor

in the world of communications. They provide a faster and

more efficient access to information. They are consequently

making the decision process quicker by providing greater ac-

cess to current information on any given problem. Mobile

devices are not popular only among people in the business

world, but rather among the entire population. As in the real

world, communication is required in order to maintain con-

tact and it is carried out through social portals, including via

mobile devices. Due to the lack of users' knowledge, tools

[email protected] (I. Bernik). al system, such as iOS, Android, BlackBerry OS, Windows mobile; ude all portable devices with a wireless Internet access (including her hand, the mobile phone group includes both mobiles phones rt mobile phones representing a modern communication device, se of a personal computer, in addition to calls through mobile

Sample, ΣN = 282 N %

Classic mobile phone and laptop computer 79 28.01

59.6267enohptramS

Smart phone and laptop computer 56 19.86

Classic mobile phone 48 17.02

Classic mobile phone, tablet and laptop computer 9 3.19

Smart phone, tablet and laptop computer 7 2.48

Classic mobile phone and smart phone 4 1.42

Classic mobile phone, smart phone, tablet and laptop computer 1 0.35

Smart phone and tablet 1 0.35

53.01telbaT

Fig. 1 e Types of mobile devices used.

j o u r n a l o f i n f o r m a t i o n s e c u r i t y a n d a p p l i c a t i o n s 2 0 ( 2 0 1 5 ) 8 4 e8 9 85

providing them with additional protection are currently more

of a hindrance than a benefit.

The study, published by the Ponemon (2011) organisation

in 2011, was carried out to determine the level of awareness

regarding safety and privacy among users (American citizens)

of smart phones. It showed that individuals mainly use smart

phones for various data transmissions from the Internet (in

addition to making phone calls). The equivalent numbers

related to the intended use are interesting (most people have

smart phones for personal as well as business use). On

average, an American citizen spends 2.7 h a day participating

in social networks and socialising through mobile devices,

respectively (Microsoft Tag, 2011). Young people find the

continuous connectivity to the Internet interesting, as it en-

ables access to messaging and the opportunity to use

numerous advanced social network services (Facebook, Goo-

gle Chat, Twitter, etc.).

Mobile device software is developing at the speed of light,

above all with the intention of attracting users and increasing

sales. Young people forget the traps that are present with the

use of mobile devices, as well the need for additional protec-

tion in order to avoid these pitfalls too often.

A mobile device can also be under threat by software

fragments, installed on the device unsupervised, such as

malware and other threats (e.g. spyware, botnets, Bluetooth

connection and social network viruses (Leavitt, 2011)).

Research carried out by Lookout (2011) shows that the number

of malware application-based threats has increased consid-

erably in the second half of 2011, especially compared to

spyware threats, by as much as 14 percent. According to the

Lookout report from 2011, the probability of malware infection

ranges from 1 to 4 percent. The report published by Juniper

Networks (2011) states that the number of Android mobile

devices, infected with malware, increased by 400 percent

since the summer of 2010. The report also found that 85

percent of protection tools on the users' mobile devices is useless, since (certain) mobile device software manufacturers

take it upon themselves to install “back doors”, enabling them

to manage software settings on the mobile device without the

users' knowledge, have the device automatically send infor- mation on where it is located (e.g. GPS location), or even take

control of the mobile device, etc. According to reports pub-

lished by F-Secure (2013), Juniper Networks (2013) and McAfee

(2013, 2014), the trend of growing threats for mobile devices

continues to rise. Insufficient knowledge of software and of all

features enabled by a mobile device software can get people in

trouble and make them targets of cybercrime. Users of mobile

devices must be conscious of threats and consequences that

they are exposed to, also in order to become aware of the need

for adequate cybersecurity. Users should be able to take some

level of security for granted (e.g. PIN code for the SIM card,

locking of the Bluetooth connection and locking of mobile

devices).

In December 2011, a survey was conducted among stu-

dents of Slovenian faculties, entitled “Mobile device threat

awareness”. The purpose of the survey was to determine the

extent to which young people are aware of dangers/threats

they are exposed to and what security solutions they have

implemented. The goal of the research is to obtain data on the

purpose, manner and type of the use of mobile devices, and

consequently acquire knowledge about the manner of use,

threats and protection. Conclusions about the users' suscep- tibility and knowledge of cybercrime can be drawn on the

basis of their knowledge of threats and the safe management

of mobile devices.

2. Method

The survey was carried out using an online questionnaire,

which was published on the “1ka” portal (www.1ka.si) and

was active for 21 days. Students were informed of the survey/

questionnaire via e-mail, Facebook profiles and in person. The

questionnaire was structured in a way that made it possible to

determine how the mobile device is used and with what

purpose, as well as what types of mobile devices and software

solutions are being used. A section of the questionnaire was

structured so as to provide results, which offer an insight into

the knowledge and use of security solutions, as well as the

knowledge and awareness of threats associated with the use

of mobile devices. Data analysis was performed using the

SPSS software. 281 completed questionnaires were analysed.

The majority of respondents were between 21 and 25 years

old, followed by the group aged 20 or younger; 61.5 percent of

respondents were women; 63.2 percent completed secondary

school education and 36.8 percent were postgraduate

students.

We were trying to determine the knowledge of the use of

mobile devices. In order to achieve that the questionnaire

aimed at establishing what types of mobile devices are used

by the respondents. Fig. 1 shows the numbers and percent-

ages of respondents that use different types of mobile devices.

As shown in Fig. 1, the group that uses a classic mobile

phone (today, many of them also provide a connection to the

Internet) and a laptop computer simultaneously, is the largest.

Almost 27 percent of them already use a smart phone, fol-

lowed by 20 percent of respondents that use a smart phone, as

well as a laptop computer. On the basis of these results, it is

possible to deduce that respondents use multiple mobile

devices.

Sample, ΣN = 216 N %

For personal use only 126 58.3

For personal, as well as business use 56 25.9

For personal and business use 31 14.4

For business and partial personal use 1 0.5

For business use only 2 0.9

Fig. 2 e Intended use of the mobile device.

j o u r n a l o f i n f o r m a t i o n s e c u r i t y a n d a p p l i c a t i o n s 2 0 ( 2 0 1 5 ) 8 4 e8 986

Fig. 2 shows the intended use of the mobile device. More

than half (58.3 percent) use mobile devices for personal pur-

poses, while a quarter of users use them for personal and

business purposes. The acquired data was to be expected,

given the population of respondents (students). The fact that

the percentage of those using mobile devices for private, as

well as business purposes is still quite high is disconcerting,

particularly if the same mobile device is used. Mixing personal

with business use (mainly data access) namely causes a

problem and the need for adequate cybersecurity is conse-

quently not met. The Ponemon (2011) study offers a similar

example, in which the combined personal and business use

group is just as large (40 percent). Based on both studies, it can

be stated that it is and it will continue to be difficult to draw a

boundary between a personal and professional use of mobile

devices (with the arrival of newer and more advanced mobile

devices).

In order to be aware of the needs regarding the adequate

level of information security when using mobile devices, it is

useful to know what the threats are. Fig. 3 shows the threats

known to respondents.

The knowledge and specific awareness of individual

threats that users of mobile devices face is essential also with

Theft of the device (n=246)

Malware infection (n=236)

Spyware infection (n=239)

Infection via an application (n=243)

Phishing (n=235)

Rootkit infection (n=229)

Drive-By Downloads (automatic download of an applicatio browser) (n=233)

Misappropriation of data (n=234)

Infection of a browser, where malware is automatica lly do the visit of a specific web page, which activates advertising disabling the device (n=238)

Interception of communications (also includes data transm

Bluetooth intrusions (n=238)

Viruses (n=242)

Payment fraud (n=239)

Automatic data transmissions (n=237)

Tracing (n=242)

Fig. 3 e Knowing

respect to information security. Fig. 3 shows which threats the

respondents were familiar with. It is not surprising that theft,

with almost 90 percent, holds the first place among all listed

threats. However, it is surprising that respondents have such

little knowledge about threats, such as malware, spyware and

rootkit infections, particularly given the fact that the reports

of studies, such as Lookout (2011), Juniper (2011) and McAfee

(2013, 2014), point to a steep increase in infections involving

before mentioned threats.

The perception of threat feasibility (Fig. 4) also depends on

the knowledge of such threats. The results show the number

of respondents who believe that a certain threat can occur.

Again, the number of those, who believe that a theft of a de-

vice is possible, is the highest (77.5 percent); the same goes for

those who believe in the possible malware (39.1 percent),

spyware (39.7 percent) and rootkit (45.3 percent) infection.

In order to protect our mobile devices against various

threats, it is advisable to at least be familiar with basic security

measures (Fig. 5). Respondents answered that they mostly use

a PIN code for the SIM card, which was expected. This safety

feature is incorporated into the SIM card by every mobile

telephony provider. However, the cause for concern lies in the

fact that the majority of respondents are familiar with the

mobile device application access PIN code security feature,

but do not use it (56.8 percent). Mobile devices provide this

option automatically. Another security solution that was

considered was the possibility to remotely erase content from

mobile device. This solution is appropriate in the event of loss

or theft of a mobile device. However, only 40 percent of re-

spondents are familiar with this security solution, but still do

not use it; and 52 percent of respondents are not familiar with

the said security solution at all. Considering the data in Fig. 5,

where most believe that a theft of the device is most likely, the

knowledge of this solution could be very beneficial. All of the

above listed aspects of how to secure a mobile device should

be provided to users through education. Such training could

YES NO

N % N %

220 89.4 26 10.6

79 33.5 157 66.5

107 44.8 132 55.2

157 64.6 85 35

68 28.9 167 71.1

32 14 197 86

n upon opening a 103 44.2 130 55.8

152 65 82 35

wnloaded upon content thus 117 49.2 121 50.8

ission) (n=237) 137 57.8 100 42.2

186 78.2 52 21.8

201 83.1 41 16.9

167 69.9 72 30.1

132 55.7 105 44.3

189 78.1 53 21.9

the threats.

Probable Did happen to me Not probable

N % N % N %

.11 82 1.11 72 5.77 981 )442=n( ecived eht fo tfehT 5

1.93 29 7.1 4 1.95 931 )532=n( noitcefni erawlaM

7.93 39 7.1 4 5.85 731 )432=n( noitcefni erawypS

Infection via an application (n=236) 154 65.3 10 4.2 72 30.5

5.34 101 4.0 1 65 031 )232=n( gnihsihP

3.54 501 4.0 1 3.45 621 )232=n( noitcefni tiktooR

Drive-By Downloads (automatic download of an application upon opening a browser) (n=234) 141 60.3 7 3 86 36.8

Misappropriation of data (n=235) 164 69.8 4 1.7 67 28.5

Infection of a browser, where malware is automatically downloaded upon the visit of a specific web page, which activates advertising content thus disabling the device (n=239)

157 65.7 5 2.1 77 32.2

Interception of communications (also includes data transmission) (n=236) 165 69.9 6 2.5 65 27.5

9.13 67 4.3 8 7.46 451 )832=n( snoisurtni htooteulB

91 54 5.01 52 5.07 761 )732=n( sesuriV

1.33 87 7.1 4 3.56 451 )632=n( duarf tnemyaP

Automatic data transmissions (n=234) 163 69.7 4 1.7 67 28.6

5.62 36 3.1 3 3.27 271 )832=n( gnicarT

Fig. 4 e Probability of the misuse of a mobile device.

j o u r n a l o f i n f o r m a t i o n s e c u r i t y a n d a p p l i c a t i o n s 2 0 ( 2 0 1 5 ) 8 4 e8 9 87

be general in nature and focus on how to secure all models of

mobile devices or very specific by focusing on individual

model types and software solutions. Regardless, when

considering the survey data, it becomes clear that the situa-

tion will have to improve considerably, since more than 42

percent of respondents know about a security solution, but do

not use it, and almost 39 percent of them are not familiar with

any at all.

Threat probability assessment relating to smart phone use

was made by measuring 25 variables and performing a factor

analysis. Services made available to the user via their smart

Use

N %

PIN code for SIM card (n=212) 190 89.6

Smart phone application access PIN code (n=206) 44 21.4

Data encryption (n=206) 12 5.8

Authentication when using certain functions (n=208) 27 13

Remote erasure of content (n=206) 14 6.8

Anti-virus protection (n=207) 61 29.5

VPN connection (n=206) 14 6.8

Archiving of smart phone content (n=205) 40 19.5

Centralised smart phone control (use policy determination) (n=205) 13 6.3

Enabled tracking of a smart phone in 42 20.3

Fig. 5 e Use of security solut

phone were listed and respondents were asked to evaluate the

likelihood of the occurrence of a threat when using an indi-

vidual service (rated from 1 ¼ never to 5 ¼ always). In the performed factor analysis (Fig. 6) the variables were

divided among three factors (using the Varimax perpendicular

rotation method with Kaiser Normalisation), using the prin-

cipal components method. The first factor was entitled

“Working with the Internet and data transmission” and con-

tains mobile device services pertaining to data transmission

and working in cyberspace. Within the framework of this

factor, there is a probability of the occurrence of a threat when

Know, but do not use Do not know

N % N %

21 9.9 1 0.5

117 56.8 45 21.8

112 54.4 82 39.8

90 43.3 91 43.8

84 40.8 108 52.4

102 49.3 44 21.3

84 40.8 108 52.4

91 44.4 74 36.1

83 40.5 109 53.2

104 50.2 61 29.5

ions on mobile devices.

Fig. 6 e Factor analysis of the threat probability assessment.

j o u r n a l o f i n f o r m a t i o n s e c u r i t y a n d a p p l i c a t i o n s 2 0 ( 2 0 1 5 ) 8 4 e8 988

j o u r n a l o f i n f o r m a t i o n s e c u r i t y a n d a p p l i c a t i o n s 2 0 ( 2 0 1 5 ) 8 4 e8 9 89

working using the Internet and transmitting data while using

a mobile device. The probability is greatest during the trans-

mission of different content. The second factor was entitled

“Automatic data transmission”. It was possible to observe that

there is a probability of the occurrence of a threat when

automatically transmitting data. E-mail synchronisation is

the highest placed variable in this threat probability assess-

ment factor, followed by calendar synchronisation and con-

tacts synchronisation. In the third group of variables that was

established, there is a probability of the occurrence of a threat

while working using a mobile device. The probability is high-

est with the messaging variable, followed by taking photos

and listening to music.

The Cronbach's Alfa coefficient of reliability in this factor analysis is 0.974, which signifies high reliability and proves

that a replication of this survey would give similar results. The

total variance amounts to 75.752 percent.

On the basis of presented data it can be concluded that the

use of mobile devices in cyberspace can result in the occur-

rence of particular threats; users should therefore employ

suitable work methods and ensure protection against threats

in an appropriate manner, as presented bellow.

3. Discussion

By examining numerous theoretical findings and research, the

authors find that the use and usability of mobile devices is on

the increase, as are the threats. Mobile devices are used for

different purposes, but the most common are those associ-

ated with the possibility of continuous communication and

access to information. The area of software offers numerous

applications facilitating the users' work by allowing them to download information from cyberspace.

Despite the popularity of mobile devices, the users too

often do not realise that they must ensure safe use them-

selves. Therefore, the knowledge of threats that the users of

mobile devices may face and the use of security measures are

essential. The use of necessary security solutions derives from

knowing the threats. However, ignorance in this area creates

doubt about the individual's knowledge and use of security solutions. The survey we presented clearly shows a poor

knowledge of respondents with regard to threats to mobile

devices. The threats they are familiar with are general, while

knowledge of specific, more complex threats e those that are

most on the rise e is lacking. The same is true for the use of

security features. The most commonly used simple security

features of mobile devices have been around for a long time

(e.g. PIN code), while the use and knowledge of more sophis-

ticated security measures is insufficient. The finding, which

the authors find interesting, is that despite knowing the

numerous dangers that threaten the users' mobile devices, they still do not believe that this could happen to them.

Consequently, potential risks are consciously disregarded.

The results show that respondents mostly use their mobile

devices for the purpose of communicating with their peers.

The software and methods they use differ greatly. In

accordance with current research, the use of mobile devices

will continue to increase. There will be an ever greater number

of advanced applications that will provide greater and faster

access to data. In the flood of different mobile devices and a

variety of software, one must not forget the importance of

privacy, information security and the establishment of a

comprehensive cybersecurity. Education and awareness

raising among users must be put at the core of said provisions.

Users must be made aware of methods for the safe use of

mobile devices, various threats and potential consequences of

their materialisation, and the importance of using security

features. Once a threat becomes a reality and data is mis-

appropriated, there is no going back. Therefore, the necessary

level of security must be implemented beforehand.

r e f e r e n c e s

F-Secure. Mobile threat report. 2013. Retrieved 25.09.14, from: http://www.f-secure.com/static/doc/labs_global/Research/ Mobile_Threat_Report_Q3_2013.pdf.

International Data Corporation [IDC]. IDC e press release. 2011. Retrieved 10.09.11, from: http://www.idc.com/getdoc.jsp? containerId¼prUS22871611.

International Data Corporation [IDC]. IDC e press release. 2014. Retrieved 25.09.14, from: https://www.idc.com/getdoc.jsp? containerId¼prUS24645514.

Juniper Networks. Malicious mobile threats report 2010/2011. 2011. Retrieved 10.09.11, from: http://www.juniper.net/us/en/ dm/interop/go.

Juniper Networks. Juniper Networks third annual mobile threats report. 2013. Retrieved 08.11.13 from: http://www.juniper.net/ us/en/local/pdf/additional-resources/3rd-jnpr-mobile- threats-report-exec-summary.pdf.

Leavitt N. Mobile security: finally a serious problem?. Largo: University of Maryland; 2011. Retrieved 07.09.11 from: http:// www.computer.org/portal/web/computingnow.

Lookout. Lookout mobile threat report. 2011. Retrieved 10.09.11, from: https://www.mylookout.com/mobile-threat-report.

McAfee. Threats predictions. 2013. Retrieved 07.11.13, from: http://www.f-secure.com/static/doc/labs_global/Research/ Mobile_Threat_Report_Q3_2013.pdf.

McAfee. McAfee Labs 2014 threats predictions. 2014. Retrieved 07.09.14, from: http://www.mcafee.com/uk/resources/reports/ rp-threats-predictions-2014.pdf.

Microsoft Tag. Infographic: mobile statistics, stats & facts 2011. 2011. Retrieved 02.02.12, from: http://www.digitalbuzzblog. com/2011-mobile-statistics-stats-facts-marketing- infographic/.

Ponemon. Second annual cost of cybercrime study: benchmark study of U.S. companies. Ponemon Institute; 2011.

Bla�z Markelj is a Lecturer at the Faculty of Criminal Justice and Security. His research interests include blended threats to mobile devices, and information security.

Igor Bernik, Ph.D. is an Assistant Professor at the Faculty of Criminal Justice and Security and Head of Information Security Department. His research fields are information systems, cyber- security, cybercrime, cyberwarfare and the growing requirements for cybersecurity awareness.