Module 11 · The pocket-sized attack surface

Mobile Security

Smartphones carry more sensitive data per device than any other category of endpoint — corporate email, banking credentials, MFA seeds, location history, photos, the company VPN. They are also different from laptops in security model, attack surface, and management options. This module covers what's different and what to do about it.

4

Reference pages

2

Platforms (iOS, Android)

1

Threat triage lab

Mobile is the largest user-facing attack surface for most organizations — and the one most likely to be unmanaged. This module covers the platform security models that make mobile different from desktop, the app-level threats that target every mobile user, the enterprise management options (MDM/BYOD/MAM), and the network threats unique to mobile.

It is deliberately a smaller module. The goal is foundational fluency — enough to talk credibly with a mobile security team, evaluate an MDM platform, or triage a suspicious mobile incident — not deep specialization. Deeper mobile work lives in dedicated courses.

11.A

Reference pages

Platform Security Models · iOS vs Android

App sandboxing, code signing, the iOS walled garden vs Android's openness. Secure Enclave / Titan M / TEE. The architectural decisions that make mobile different from desktop.

Mobile App Security

Secure storage (Keychain, Keystore), IPC mechanisms (intents, URL schemes, deep links), the OWASP Mobile Top 10. What goes wrong inside mobile apps and what makes the bugs different from web app bugs.

Enterprise Management · MDM, BYOD, MAM

Mobile Device Management (Intune, Jamf), Mobile Application Management (work profiles, app wrapping), the BYOD policy tradeoffs, and what employees should and shouldn't accept on personal devices.

Mobile Network Threats

Rogue Wi-Fi APs, captive portals, SS7 attacks, SIM swapping, Stingrays/IMSI catchers, eSIM hijacking. The mobile-specific attacks that don't have desktop equivalents.

11.B

Hands-on lab

Mobile Incident Triage

An employee reports their iPhone is "acting weird." Walk through the triage: pop-ups, battery drain, unexpected profiles, unknown enterprise apps, and the questions that distinguish "user installed something sketchy" from "device is fully compromised."