72

TLDR: There are several categories of security you must consider when looking for a phone. The main advice, though, is to get a newer phone with the latest security features, and from a manufacturer that has a good reputation of providing updates. Security against other people (peers, police/government) Look for newer devices with full disk encryption, ...


59

One of the key aspects to consider for this is the support/patching policy of your mobile device vendor. If you're planning to keep the phone for say 2-3 years you don't want it to go out of support after 18 months. Unfortunately this can be quite tricky information to come across with many vendors not providing published support lifecycles. Also ...


37

The other answers regarding encryption are great. I'm going to approach this question from the tinfoil / dissident angle, as I believe it's valid for nearly every scenario... but I still want to explain my reasoning, and how I came to these conclusions. All of the problems I'll discuss are routinely exploited by criminals, and repressive governments. In ...


37

Some technical factors that may be relevant: Performance - across whatever matters for your application (if any): encryption/decryption/key generation/signing, symmetric, asymmetric, EC, ... Scale: Is there a limit to the number of keys it supports, and could that limit be a problem? How easy is it to add another HSM when your application becomes more ...


23

A HSM will not avoid complexity; rather, it will add quite a lot of complexity to the whole system. What HSM do best is key storage: the key is in the HSM and does not get out of it, never. However, you still have to worry about the key life cycle. With a "software" key, stored in a file or in the entrails of the operating system, backups are a ...


16

Trying to avoid recommendations, to keep your phone safe an secure I will break it down into 3 levels: Applications When looking for applications to place on your phone you need to look at the permissions they ask for and ask yourself, Does this chess game really need access to my contacts, bluetooth and internet? NO it does not, an app to me is suspicious ...


6

First of all: There's a good guide from the TOR project about hardening Android. You can deduce all criteria you have to look for from it. Second: I can't believe that nobody here even mentions the biggest backdoor which circumvents most security measures as long the telephone is turned on: the baseband processor. There were already some vulnerabilities ...


6

I'd say that the PCI compliance aspect is going to complicate things more than a little bit and that you should really speak to your QSA about requirements. Whilst I'm not a QSA it would seem to me that if you backup card data then that backup service would effectively become part of your cardholder data environment. Apart from that one thing I always look ...


5

In no particular order and off the top of my head: Single vendor: easier and faster relationships (usually) better integration of different products, provided they're not rebranded kits simpler to "pass the buck" if products A and B don't see eye to eye - they're both the same vendor's responsibility. Multiple vendors: less risk of vendor lock-in more ...


4

I'd say that there is nothing per se which would always lead to outsourced software being less secure than an in-house development but there are some common factors which may in practice lead to this commonly being the case Cost concerns. If a key factor in winning the work is low cost, then the risk of insecure software is likely to increase. Whichever ...


4

This may sound a bit of a cop-out, but at the end of the day it is down to what assurances you need from the provider so you should ask both of them the same questions - and these should be specifically on what you need to feel confidence that using the provider doesn't expose you to more risk than you can accept. Have a look at this question about EC2 ...


3

If you want a secure account look at yourself not the bank. Banks rely on insurance to secure deposits, their security is there to keep the premiums low and the insurance will take care of anything that gets past. However if someone gets into your account via identity theft then the insurance will not cover the stolen funds. Therefore if you want a secure ...


3

Let me state up front, that I am a partner of Palo Alto Networks as well as Check Point and Juniper. Over the years we have had a lot of success with all three manufacturers. Palo Alto Networks has built a network security device that is technically different from everything else on the market. If you clear away the marketing BS, there is no denying it. My ...


2

Summary: Go with a big bank with a good password policy. MFA is a huge plus, but I wouldn't go to a small bank ever. Unfortunately if you are in the US, MFA is not very prevalent in the banking industry (at least for large banks). If you can find it, I would look there. And if you find that in a big bank (top 10), please let me know. =) Having ...


2

One of the things I would look at is what the bank says about their security. That doesn't mean they are actually doing anything about it, but if they are talking about it at least they know it is important to their customers. I would research the security accreditations that the bank has, and the level of certification of its it staff if the information ...


2

Open source software, like OpenVPN is likely to be free of back-doors. Other than that, depends on how paranoid you are, but it is possible for back-doors to be in everything. While companies based in other countries may be able to say no, the NSA according to leaks had budget to pay them for cooperation. They could also make it hard for resisting companies ...


1

I have used different approaches (and sometimes combined them) in my work based upon what it is from the vendor that my company is consuming. We have small vendors that provide us with SaaS services which they leverage AWS to host, or it could be that they are proviing services (where we give them data and they perform either analysis or other services), or ...


1

The level of security you receive from software is almost entirely determined by the talent and experience of the software developers, rather than the relationship you have with them. Consider two developers, let's call them A and B. A knows how to write the software very securely, and B does not. Both A and B may be hired as employees or as contractors, and ...


1

As a rule of thumb involving a third party complicates security. It does not mean the product (software or otherwise) cannot be secure, but it does add another factor into the equation. Things to consider: Quality of the staff Experience of the third party in creating software with a focus on security, i.e. the organization as a whole needs the right focus, ...


1

I don't explicitly know the answer to your sourcing problem, but I do know a bit about the cards and their internals. That being said, I'm pretty sure GIS manufactures them. There are two classes of card internals: Discrete small pitch surface-mount components embedded inside the plastic. Custom chip-on-board encased in epoxy, again embedded in the plastic....


1

First if they claim to be PCI Compliant ask for the latest version of a filled out questionnaire and their current quarters scan results. Based on the depth of how they filled out the questionnaire you should have some understanding of how competant they are. Also press if they have external audits? Do they employ external companies to do manual pentests ...


1

You should look at what the Cloud Security Alliance is doing including a register of cloud providers who have self attested to their security which is a step in the right direction. https://cloudsecurityalliance.org/ Even better you should be asking for a 3rd party assurance report such as ISAE3402 or a SOC 2 report which will have been done by an ...


1

It does depend on your requirements [confidentiality, integrity, availability] however two great general resources I've found useful are: Cloud Computing Security Considerations by Defence Signals Directorate A recent blog post from sophos


Only top voted, non community-wiki answers of a minimum length are eligible