Mobile devices are usually designed to be single-user devices and normally lack basic user profile and security tracking beyond just a simple password. Other common desktop mechanisms are also likely to be missing. The discoverability of mobile devices over protocols such as Bluetooth can present users with unexpected scenarios. Mobile applications can also be especially challenging due to connectivity interruptions. Consider all possible connectivity scenarios, whether over-the-air or hard-wired.

General Mobile Application Security Guidelines:

Do not assume that security mechanisms available on larger platforms, such as Windows XP, will be available on a mobile platform, even if you are using the same tools. For example, access control lists (ACLs) are not available in Windows Mobile, and consequently there is no operating system–level file security.

Main Considerations for Securing Mobile Solutions:

Securing the Server

  • Follow standard server hardening recommendations

Securing the communication pipe

  • If you want to support a wireless/field synchronization of GIS data then you need to ensure access to your server external to the DMZ. To address this need, users commonly implement 2 solutions:
    • Using a reverse proxy
    • Fully hosting their server on the DMZ
  • Design authentication for over-the-air, cradled synchronization, Bluetooth discovery, and local SD card scenarios.
  • Ensure that you require authentication for access by Bluetooth devices.
  • Identify trust boundaries within your mobile application layers; for instance, between the client and the server or the server and the database. This will help you to determine where and how to authenticate.
  • From a data perspective, it is quite rare that field projects are completed on production geodatabases. Most often a replica is created and then data in the replica is served to the mobile user. This is done for 2 reasons:
    • Isolate edits
    • There is a need to transform the data model for field use.

Securing the mobile cache

  • If you are building a custom application using the Mobile ADF, you can encrypt the cache using Cryptography.
    • Many users focus primarily on securing the device.

Securing the mobile device

  • Many users lock the device itself
  • Some utilize install Virtual Private Network (VPN) software on the device to secure communications
  • Remote device wipe software can clear information off of a mobile device if it is lost utilizing tools such as:
  • Consider that different devices might have variations in their programming security models, which can affect authorization to access resources

Summary of Security Guidance for specific Esri mobile products:

ArcPad

  • Password protect and encrypt the AXF data file
  • Encrypt mobile device memory cards
  • Secure your ArcGIS Server environment with users and groups to limit who can publish ArcPad data
  • Secure your internet connection used for synchronizing ArcPad data

ArcGIS Mobile

 

Filed under: