How to make your Android mobile more secure?

Simple steps for baseline device security.

Device Management and Access Control;

  • Enable passcode and biometric authentication
  • Ensure Pattern and Swipe only lock is Disabled
  • Enforce a minimum of 6 characters for the device authentication passcode
  • Disallow rooted Android mobile devices
  • Ensure ‘Ask for unlock pattern/PIN/password before unpinning’ is set to ‘Enabled’
  • Ensure ‘Show passwords’ is set to ‘Disabled’
  • Ensure ‘Add users from lock screen’ is set to ‘Disabled’
  • Ensure ‘Guest profiles’ do not exist
  • Ensure ‘Automatically Lock’ is set to ‘Immediately’
  • Ensure ‘Power button instantly locks’ is set to Enabled’
  • Ensure ‘Screen Lock’ is set to ‘Enabled’
  • Ensure smart lock is set to ‘Disabled’
  • Ensure ‘Screen timeout’ is set to ‘2 minute or less’

Update and Patching;

  • Ensure device OS is up to date.
  • Ensure device firmware is up to date.
  • Ensure device apps are kept up to date
  • Enable automatic updates for device
  • Ensure “Install unknown apps’ is set to ‘Disabled’
  • Do not install apps from unknown sources
  • Ensure ‘Instant apps’ is set to ‘Disabled’

Data Protection and Backup;

  • Ensure device encryption is ‘Enabled’
  • Ensure full device encryption is enabled including encryption of removable storage
  • Enable SIM card lock
  • Backup to Google Drive is Disabled
  • Opt-out of Ads and Personalisation is Enabled

Network Settings;

  • Use of a trusted VPN
  • Do not connect to unencrypted/untrusted networks
  • Do not connect mobile device to untrusted Wi-Fi – Cafe, Hotel, Airport & Free Public WiFi
  • Ensure Wi-Fi assistant is set to ‘Disabled’
  • Disable ‘Find my Device’
  • Ensure ‘Google Location Sharing’ is ‘Disabled’

Threat Detection and Prevention;

  • Ensure ‘Developer Options’ is set to ‘Disabled’
  • Ensure “Scan device for security threats’ is set to ‘Enabled”
  • Ensure ‘improve harmful app detection’ is set to ‘Disabled’ – it sends anonymous information to Google
  • Ensure ‘Safe Browsing’ is set to ‘Enabled’
  • Ensure ‘Allow third-party cookies’ is set to ‘Disabled’

References;

CI Security

Cyber – Gov – Au