Internet and Mobile Device Security
This domain tests safe behavior on the web and on mobile devices: what browser warnings mean, how URLs are read, how apps and permissions are managed, and what changes when work data lives on a personal phone.
Browser and web basics
HTTPS protects data in transit only; a padlock says nothing about the honesty of the site. A certificate warning means stop, not proceed. Read URLs from the registrable domain outward and watch for typosquatting, extra hyphens and homoglyph characters. Drive-by downloads and malicious advertising mean legitimate sites can serve bad content. Extensions run with the privileges you grant, so review permissions and remove what you do not use.
Mobile devices
- Install only from official stores; sideloading, rooting and jailbreaking remove protections.
- Review permissions: SMS, accessibility, contacts and location are high-risk. Accessibility services are abused by banking trojans.
- Enable screen lock, device encryption, updates and remote wipe.
- Under BYOD and MDM, corporate data may be wiped separately; know what your employer can see.
- Disable Bluetooth, AirDrop and NFC when unused; avoid public charging kiosks.
- On public Wi-Fi, use cellular data or a trusted VPN for sensitive work, and disable auto-join.
Worked example
An employee receives an SMS claiming the HR portal has moved, with a shortened link, and opens it on a personal phone that is not enrolled in MDM. The shortener hides the destination, the personal device has no corporate filtering, and the page asks for the corporate login. Reasoning: the risk is credential harvesting, not malware on the phone. Correct action is to stop before entering anything, report the message with the link, and if credentials were entered, reset the password and revoke sessions immediately.
Marks that are easy to lose
- Equating a padlock with a trustworthy site.
- Believing a VPN makes a malicious page safe.
- Assuming one mobile platform cannot be attacked.
- Enabling installation from unknown sources to get a free app.
- Ignoring app permissions because the app came from an official store.