What you'll learn
- Platform security models
- Managing devices
- Mobile threats
- Secure mobile apps: OWASP MASVS
Lessons
1Platform security models
iOS and Android both sandbox apps, require signed code, use permission prompts and hardware-backed key storage (Secure Enclave, StrongBox). Rooting or jailbreaking removes many of these protections, so corporate policy usually blocks such devices.
2Managing devices
MDM/UEM (Intune, Jamf, Workspace ONE) enforces passcodes, encryption, OS version and app policies. For personal devices, use app protection policies (MAM) that protect only work data. Conditional Access can require a compliant device before granting access.
3Mobile threats
- Smishing and malicious QR codes ("quishing").
- Sideloaded apps and fake app-store listings.
- Zero-click exploit chains used by commercial spyware (see Pwn2Own 2026 and the Candiru reports).
- Lost or stolen devices: rely on encryption, remote wipe and short auto-lock.
4Secure mobile apps: OWASP MASVS
MASVS groups requirements into Storage, Crypto, Auth, Network, Platform, Code, Resilience and Privacy. Common findings: secrets in the app bundle, no certificate validation, sensitive data in logs, and over-broad permissions.
Hands-on lab: Harden your own phone
- Update to the latest OS version and enable automatic updates.
- Review app permissions: revoke location, mic and camera from apps that don't need them.
- Enable a strong passcode and biometric unlock with a short auto-lock.
- Turn on Find My / Find My Device and test remote locate.
- On iPhone, read about Lockdown Mode; on Android, check Google Play Protect status.
Outcome: A hardened personal device and a checklist you can give users.
Practice questions
App protection policies (MAM) are best for…
Answer: Personal BYOD devices. Protects work data without managing the whole device.
Why block jailbroken/rooted devices?
Answer: Platform protections are weakened. Sandboxing and integrity checks can be bypassed.
'Quishing' uses…
Answer: Malicious QR codes. QR-code phishing.
The full graded assessment (4 questions, pass mark 70%) is in the platform.
Key terms
- MDM
- Mobile Device Management: enrols and enforces policy on whole devices.
- MAM
- Mobile Application Management: protects work apps and data on personal devices.
- Jailbreak/root
- Removing OS restrictions, weakening the platform security model.
- Zero-click exploit
- Attack that compromises a device without any user interaction.
See the full cyber security glossary →
Official references
Related courses
Application Security
OWASP Top 10, secure SDLC, code review, SAST/DAST/SCA and software supply chain.
DevSecOps & Secure CI/CD
Building security into pipelines: secrets, scanning gates, IaC security, signed artifacts and SLSA.