Tim Rowan, Editor & Publisher of Home Care Technology Report
Smart phones are becoming standard equipment among home health nurses and in-home personal care workers. With these phones and their use come concerns about patient privacy, and preventing malware infections within the phones themselves. The chances of privacy being breached can be solved with administering secure passwords and remote wipe capabilities, but keeping offshore bad guys out of a phone network eyts to – requires enforcing company cyber security policn on all remote workers. Here are some policy recommendations from cyber security expert Jack Wallen, writing for TechRepublic.
1. Do not obtain sidelind applications
These are games or quizzes or celebrity scandal apps that are offered as a free extra when you are downloading a legitimate app. As much as you want to install that fun looking game you heard about (the one only available as a download from some nefarious-looking site), don’t.
Period. End. Of. Story.
Sideloading applications might be okay for those who are trying to test new features in upcoming releases of official software (that have yet to make their way to the Google Play Store). It’s not okay for installing games, themes, and other sundry apps. It’s just not. Why? Because there is absolutely no vetting to be had with that software. You have no idea where it came from, what’s in it, and no way of knowing. In fact, chances are actually good that game is nothing more than a front for a data siphon or ransomware.
So don’t install it. Period.
2. Use caution when perusing items in the Google Play Store
Thing is, you can’t even be certain if the apps you want from the official Google Play Store can be fully trusted. Why? Ads. Although ads are a great way for developers to monetize their applications, it’s also a great way for ne’er do wells to inject malicious code onto your device and sniff your traffic.
Tt’s that end, maybe it’s time for Google to consider a new means for developers to monetize their apps. It’s become all too clear that ad networks are dangerous to the mobile world–an issue that should not lie on the shoulders of the users or app developers. This, of course, is a double-edged sword, as developers know fewer and fewer users are willing to pay a single penny for an app (which is a statement in and of itself). Because of this, developers are caught in a no-win situation, where they have to rely on in-app ads to make a penny or two for their hard work.
Think about your own experience. How often have you tried to click on a button in an app, only to find you accidentally clicked on the tiny ad at the bottom of the page? Even if you immediately close that ad, it may be too late.
One solution is to completely end the ad revenue method and test out a subscription model for users. Users could, say, pay $10 per month to have completely ad-free access to all apps that would otherwise normally depend on ad revenue. The income from those subscriptions would go to pay developers (and Google, of course).
Until that innovation is created, users need to employ a serious amount of caution when installing anything from the Google Play Store that is not an official app or developed by a reputable company or developer.
3. Go full-on open source. But numerous warnings follow, should you do so
Another option is to go the route of F-Droid. What is F-Droid? F-Droid is an app you install (not from the Google Play Store) that serves as an installable catalogue of open source applications for the Android platform. But wouldn’t it be even more of a risk to install from an entity that doesn’t have the massive and official backing of Google?
One thing you should know about F-Droid is that none of the applications found within the catalogue include tracking. F-Droid also has a very strict auditing process and, because the apps are all open source, it’s quite easy for the auditors to comb through the app source code to find out if everything is on the up-and-up. In fact, F-Droid even has its own site audited, to ensure it follows best practices. They’ve worked with Radically Open Security and Cure53 for audits. Their first external audit (in 2015) found some critical issues with the site’s opt-in beta features and some minor issues with fdroid import, which isn’t used on core infrastructure.
You can read the full document of the F-Droid Security Model and judge for yourself how trustworthy the site (and what they offer) is.
4. Only install what you have to use .[Final and very good advice:]
Here’s where the tough love comes in.
At some point the burden of blame has to also land on the shoulders of the user. Why? Because no one is making them install any and every shiny new thing they see on the Google Play Store. To that end, stop installing random apps. Just stop. Install only what you need to remain connected, informed, and productive. Sure, go ahead and install Facebook, Twitter, WhatsApp, and Instagram. And, of course, install a game or two (but only from reputable game developers).
As for everything else? Forget it. No more “FaceApp.” No more shopping/coupon apps. In fact, any app that looks too good to be true, avoid it as though the life of your data security depends on it (because it likely does).
If you have one phone for work and a separate personal phone, download nothing but your home care apps on your work phone. If you use one phone for everything, check company policy. “It’s my phone, I can download what I want,” will be a weak defense after you infet the entire company network with malware.
If you do use your personal Android device for work, and also need it to stay in contact with friends and family, install only those things necessary to do so. If you depend on your Android device for entertainment, only install apps developed by official entities. They are careful to offer only safe apps because their bottom line could be negatively impacted by software rife with malicious code.
Broad recommendations, not necessarily for everyone, are listed below in a list numbering more than one dozen sites, including Email; Google Drive; etc. Note: Most of these apps come pre-installed on stock Android phones. None of them rely on ads for revenue.
Add Facebook if you must, but that’s it. Think about the above list. Put your company’s uses for patient care at the forefront of your choices. What’s key about your choice: you can get your work done and be connected.
The moral of thais story is simple: The more apps you install, the more likely you are to inadvertently install malware. So before you install that random app, ask yourself, “Is this worth the risk of installing malicious software on my phone?” Chances are, the answer will be a resounding “no.”
©2019 by TechRepublic. Reprinted by permission. This article appeared in Tim Rowan’s Home Care Technology Report. homecaretechreport.com One copy may be printed for personal use; further reproduction by permission only. editor@homecaretechreport.com
