Threat Category: Physical Access
ID: PHY-0
Threat Description: Lost or stolen mobile devices gives an adversary unhindered access to the device, and if there’s an insecure or no PIN in place, access to the data on the device as well.
Threat Origin
FAQ on Lost/Stolen Devices 1
Exploit Examples
Phone Theft in America: What really happens when your phone gets grabbed 2
Smartphone thefts drop as kill switch usage grows 3
CVE Examples
Not Applicable
Possible Countermeasures
To prevent accidental loss of a device, pair it with another device, such as a smart watch, capable of alerting the user to separation from the device, or quickly triggering mechanisms to help the user locate it.
To prevent theft of a device, closely attend the device at all times, and if leaving it unattended, apply strong physical security measures (e.g., lock it into a secure container).
To mitigate the impact of a lost or stolen device in the possession of an attacker, use remote lock, activation lock, locate, or wipe capabilities as deemed appropriate based on the sensitivity of data stored on or capabilities of the device.
EnterpriseTo mitigate the impact of a lost or stolen device in the possession of an attacker, use remote lock, activation lock, locate, or wipe capabilities as deemed appropriate based on the sensitivity of data stored on or capabilities of the device.
References
FAQ on Lost/Stolen Devices, in Your Wireless Life, July 2016; http://www.ctia.org/your-wireless-life/consumer-tips/how-to-deter-smartphone-thefts-and-protect-your-data/faq-on-lost-stolen-devices#anti-theft-commitment [accessed 8/31/2016] ↩
“Phone Theft in America: What really happens when your phone gets grabbed”, blog, 7 May 2014; https://blog.lookout.com/blog/2014/05/07/phone-theft-in-america/ [accessed 8/25/2016] ↩
C. Deitrick, Smartphone thefts drop as kill switch usage grows, Consumer Reports, 11 June 2015; http://www.consumerreports.org/cro/news/2015/06/smartphone-thefts-on-the-decline/index.htm [accessed 8/30/2016] ↩